Merge lp:~bkerensa/ubuntu/raring/iptables/new-upstream-version into lp:ubuntu/raring/iptables

[Benjamin Kerensa]

New Upstream Release

[James Page (james-page)]

This version is also in Debian unstable so this should really be a merge from Debian rather than a direct new upstream version in Ubuntu.

Disapproving; please prepare as merge instead.

Thanks.

review: Disapprove

Unmerged revisions

35. By Benjamin Kerensa on 2012-11-21

New Upstream Version

=== modified file '.gitignore'
--- .gitignore	2012-07-20 15:45:01 +0000
+++ .gitignore	2012-11-21 23:36:21 +0000
@@ -1,38 +1,21 @@
-.*.d
-.*.dd
 *.a
 *.la
 *.lo
-*.oo
 *.so
 *.o
-.deps
+.deps/
 .dirstamp
-.libs
+.libs/
 Makefile
 Makefile.in
 
-/extensions/GNUmakefile
-/extensions/initext.c
-/extensions/initext?.c
-/extensions/matches?.man
-/extensions/targets?.man
-
-/include/xtables.h
+/include/xtables-version.h
 /include/iptables/internal.h
 
 /aclocal.m4
-/autom4te*.cache
-/compile
-/config.guess
-/config.h*
-/config.log
-/config.status
-/config.sub
+/autom4te.cache/
+/build-aux/
+/config.*
 /configure
-/depcomp
-/install-sh
 /libtool
-/ltmain.sh
-/missing
 /stamp-h1

=== removed directory '.pc/0101-changelog.patch'
=== removed file '.pc/0101-changelog.patch/Changelog'
=== removed directory '.pc/9000-howtos.patch'
=== removed file '.pc/9000-howtos.patch/Makefile.am'
--- .pc/9000-howtos.patch/Makefile.am	2011-11-07 13:46:11 +0000
+++ .pc/9000-howtos.patch/Makefile.am	1970-01-01 00:00:00 +0000
@@ -1,26 +0,0 @@
-# -*- Makefile -*-
-
-ACLOCAL_AMFLAGS  = -I m4
-AUTOMAKE_OPTIONS = foreign subdir-objects
-
-SUBDIRS          = extensions libiptc iptables
-if ENABLE_DEVEL
-SUBDIRS         += include
-endif
-if ENABLE_LIBIPQ
-SUBDIRS         += libipq
-endif
-if HAVE_LIBNFNETLINK
-SUBDIRS         += utils
-endif
-
-.PHONY: tarball
-tarball:
-	rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION};
-	pushd ${top_srcdir} && git archive --prefix=${PACKAGE_TARNAME}-${PACKAGE_VERSION}/ HEAD | tar -C /tmp -x && popd;
-	pushd /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION} && ./autogen.sh && popd;
-	tar -C /tmp -cjf ${PACKAGE_TARNAME}-${PACKAGE_VERSION}.tar.bz2 --owner=root --group=root ${PACKAGE_TARNAME}-${PACKAGE_VERSION}/;
-	rm -Rf /tmp/${PACKAGE_TARNAME}-${PACKAGE_VERSION};
-
-config.status: extensions/GNUmakefile.in \
-	include/xtables.h.in include/iptables/internal.h.in

=== removed directory '.pc/9000-howtos.patch/howtos'
=== removed file '.pc/9000-howtos.patch/howtos/Makefile'
=== removed file '.pc/9000-howtos.patch/howtos/NAT-HOWTO.sgml'
=== removed file '.pc/9000-howtos.patch/howtos/netfilter-extensions-HOWTO.sgml'
=== removed file '.pc/9000-howtos.patch/howtos/netfilter-hacking-HOWTO.sgml'
=== removed file '.pc/9000-howtos.patch/howtos/packet-filtering-HOWTO.sgml'
=== removed directory '.pc/9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch'
=== removed directory '.pc/9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch/include'
=== removed directory '.pc/9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch/include/linux'
=== removed file '.pc/9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch/include/linux/types.h'
--- .pc/9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch/include/linux/types.h	2012-07-20 15:45:01 +0000
+++ .pc/9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch/include/linux/types.h	1970-01-01 00:00:00 +0000
@@ -1,38 +0,0 @@
-#ifndef _LINUX_TYPES_H
-#define _LINUX_TYPES_H
-
-#include <asm/types.h>
-
-#ifndef __ASSEMBLY__
-
-#include <linux/posix_types.h>
-
-
-/*
- * Below are truly Linux-specific types that should never collide with
- * any application/library that wants linux/types.h.
- */
-
-#ifdef __CHECKER__
-#define __bitwise__ __attribute__((bitwise))
-#else
-#define __bitwise__
-#endif
-#ifdef __CHECK_ENDIAN__
-#define __bitwise __bitwise__
-#else
-#define __bitwise
-#endif
-
-typedef __u16 __bitwise __le16;
-typedef __u16 __bitwise __be16;
-typedef __u32 __bitwise __le32;
-typedef __u32 __bitwise __be32;
-typedef __u64 __bitwise __le64;
-typedef __u64 __bitwise __be64;
-
-typedef __u16 __bitwise __sum16;
-typedef __u32 __bitwise __wsum;
-
-#endif /*  __ASSEMBLY__ */
-#endif /* _LINUX_TYPES_H */

=== removed directory '.pc/9002-libxt_recent-Add-support-for-reap-option.patch'
=== removed directory '.pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions'
=== removed file '.pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions/libxt_recent.c'
--- .pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions/libxt_recent.c	2012-07-20 15:45:01 +0000
+++ .pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions/libxt_recent.c	1970-01-01 00:00:00 +0000
@@ -1,203 +0,0 @@
-#include <stdbool.h>
-#include <stdio.h>
-#include <string.h>
-#include <xtables.h>
-#include <linux/netfilter/xt_recent.h>
-
-enum {
-	O_SET = 0,
-	O_RCHECK,
-	O_UPDATE,
-	O_REMOVE,
-	O_SECONDS,
-	O_HITCOUNT,
-	O_RTTL,
-	O_NAME,
-	O_RSOURCE,
-	O_RDEST,
-	F_SET    = 1 << O_SET,
-	F_RCHECK = 1 << O_RCHECK,
-	F_UPDATE = 1 << O_UPDATE,
-	F_REMOVE = 1 << O_REMOVE,
-	F_ANY_OP = F_SET | F_RCHECK | F_UPDATE | F_REMOVE,
-};
-
-#define s struct xt_recent_mtinfo
-static const struct xt_option_entry recent_opts[] = {
-	{.name = "set", .id = O_SET, .type = XTTYPE_NONE,
-	 .excl = F_ANY_OP, .flags = XTOPT_INVERT},
-	{.name = "rcheck", .id = O_RCHECK, .type = XTTYPE_NONE,
-	 .excl = F_ANY_OP, .flags = XTOPT_INVERT},
-	{.name = "update", .id = O_UPDATE, .type = XTTYPE_NONE,
-	 .excl = F_ANY_OP, .flags = XTOPT_INVERT},
-	{.name = "remove", .id = O_REMOVE, .type = XTTYPE_NONE,
-	 .excl = F_ANY_OP, .flags = XTOPT_INVERT},
-	{.name = "seconds", .id = O_SECONDS, .type = XTTYPE_UINT32,
-	 .flags = XTOPT_PUT, XTOPT_POINTER(s, seconds)},
-	{.name = "hitcount", .id = O_HITCOUNT, .type = XTTYPE_UINT32,
-	 .flags = XTOPT_PUT, XTOPT_POINTER(s, hit_count)},
-	{.name = "rttl", .id = O_RTTL, .type = XTTYPE_NONE,
-	 .excl = F_SET | F_REMOVE},
-	{.name = "name", .id = O_NAME, .type = XTTYPE_STRING,
-	 .flags = XTOPT_PUT, XTOPT_POINTER(s, name)},
-	{.name = "rsource", .id = O_RSOURCE, .type = XTTYPE_NONE},
-	{.name = "rdest", .id = O_RDEST, .type = XTTYPE_NONE},
-	XTOPT_TABLEEND,
-};
-#undef s
-
-static void recent_help(void)
-{
-	printf(
-"recent match options:\n"
-"[!] --set                       Add source address to list, always matches.\n"
-"[!] --rcheck                    Match if source address in list.\n"
-"[!] --update                    Match if source address in list, also update last-seen time.\n"
-"[!] --remove                    Match if source address in list, also removes that address from list.\n"
-"    --seconds seconds           For check and update commands above.\n"
-"                                Specifies that the match will only occur if source address last seen within\n"
-"                                the last 'seconds' seconds.\n"
-"    --hitcount hits             For check and update commands above.\n"
-"                                Specifies that the match will only occur if source address seen hits times.\n"
-"                                May be used in conjunction with the seconds option.\n"
-"    --rttl                      For check and update commands above.\n"
-"                                Specifies that the match will only occur if the source address and the TTL\n"
-"                                match between this packet and the one which was set.\n"
-"                                Useful if you have problems with people spoofing their source address in order\n"
-"                                to DoS you via this module.\n"
-"    --name name                 Name of the recent list to be used.  DEFAULT used if none given.\n"
-"    --rsource                   Match/Save the source address of each packet in the recent list table (default).\n"
-"    --rdest                     Match/Save the destination address of each packet in the recent list table.\n"
-"xt_recent by: Stephen Frost <[e-mail]>.  http://snowman.net/projects/ipt_recent/\n");
-}
-
-static void recent_init(struct xt_entry_match *match)
-{
-	struct xt_recent_mtinfo *info = (void *)(match)->data;
-
-	strncpy(info->name,"DEFAULT", XT_RECENT_NAME_LEN);
-	/* even though XT_RECENT_NAME_LEN is currently defined as 200,
-	 * better be safe, than sorry */
-	info->name[XT_RECENT_NAME_LEN-1] = '\0';
-	info->side = XT_RECENT_SOURCE;
-}
-
-static void recent_parse(struct xt_option_call *cb)
-{
-	struct xt_recent_mtinfo *info = cb->data;
-
-	xtables_option_parse(cb);
-	switch (cb->entry->id) {
-	case O_SET:
-		info->check_set |= XT_RECENT_SET;
-		if (cb->invert)
-			info->invert = true;
-		break;
-	case O_RCHECK:
-		info->check_set |= XT_RECENT_CHECK;
-		if (cb->invert)
-			info->invert = true;
-		break;
-	case O_UPDATE:
-		info->check_set |= XT_RECENT_UPDATE;
-		if (cb->invert)
-			info->invert = true;
-		break;
-	case O_REMOVE:
-		info->check_set |= XT_RECENT_REMOVE;
-		if (cb->invert)
-			info->invert = true;
-		break;
-	case O_RTTL:
-		info->check_set |= XT_RECENT_TTL;
-		break;
-	case O_RSOURCE:
-		info->side = XT_RECENT_SOURCE;
-		break;
-	case O_RDEST:
-		info->side = XT_RECENT_DEST;
-		break;
-	}
-}
-
-static void recent_check(struct xt_fcheck_call *cb)
-{
-	if (!(cb->xflags & F_ANY_OP))
-		xtables_error(PARAMETER_PROBLEM,
-			"recent: you must specify one of `--set', `--rcheck' "
-			"`--update' or `--remove'");
-}
-
-static void recent_print(const void *ip, const struct xt_entry_match *match,
-                         int numeric)
-{
-	const struct xt_recent_mtinfo *info = (const void *)match->data;
-
-	if (info->invert)
-		printf(" !");
-
-	printf(" recent:");
-	if (info->check_set & XT_RECENT_SET)
-		printf(" SET");
-	if (info->check_set & XT_RECENT_CHECK)
-		printf(" CHECK");
-	if (info->check_set & XT_RECENT_UPDATE)
-		printf(" UPDATE");
-	if (info->check_set & XT_RECENT_REMOVE)
-		printf(" REMOVE");
-	if(info->seconds) printf(" seconds: %d", info->seconds);
-	if(info->hit_count) printf(" hit_count: %d", info->hit_count);
-	if (info->check_set & XT_RECENT_TTL)
-		printf(" TTL-Match");
-	if(info->name) printf(" name: %s", info->name);
-	if (info->side == XT_RECENT_SOURCE)
-		printf(" side: source");
-	if (info->side == XT_RECENT_DEST)
-		printf(" side: dest");
-}
-
-static void recent_save(const void *ip, const struct xt_entry_match *match)
-{
-	const struct xt_recent_mtinfo *info = (const void *)match->data;
-
-	if (info->invert)
-		printf(" !");
-
-	if (info->check_set & XT_RECENT_SET)
-		printf(" --set");
-	if (info->check_set & XT_RECENT_CHECK)
-		printf(" --rcheck");
-	if (info->check_set & XT_RECENT_UPDATE)
-		printf(" --update");
-	if (info->check_set & XT_RECENT_REMOVE)
-		printf(" --remove");
-	if(info->seconds) printf(" --seconds %d", info->seconds);
-	if(info->hit_count) printf(" --hitcount %d", info->hit_count);
-	if (info->check_set & XT_RECENT_TTL)
-		printf(" --rttl");
-	if(info->name) printf(" --name %s",info->name);
-	if (info->side == XT_RECENT_SOURCE)
-		printf(" --rsource");
-	if (info->side == XT_RECENT_DEST)
-		printf(" --rdest");
-}
-
-static struct xtables_match recent_mt_reg = {
-	.name          = "recent",
-	.version       = XTABLES_VERSION,
-	.family        = NFPROTO_UNSPEC,
-	.size          = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
-	.userspacesize = XT_ALIGN(sizeof(struct xt_recent_mtinfo)),
-	.help          = recent_help,
-	.init          = recent_init,
-	.x6_parse      = recent_parse,
-	.x6_fcheck     = recent_check,
-	.print         = recent_print,
-	.save          = recent_save,
-	.x6_options    = recent_opts,
-};
-
-void _init(void)
-{
-	xtables_register_match(&recent_mt_reg);
-}

=== removed file '.pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions/libxt_recent.man'
--- .pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions/libxt_recent.man	2012-07-20 15:45:01 +0000
+++ .pc/9002-libxt_recent-Add-support-for-reap-option.patch/extensions/libxt_recent.man	1970-01-01 00:00:00 +0000
@@ -1,104 +0,0 @@
-Allows you to dynamically create a list of IP addresses and then match against
-that list in a few different ways.
-.PP
-For example, you can create a "badguy" list out of people attempting to connect
-to port 139 on your firewall and then DROP all future packets from them without
-considering them.
-.PP
-\fB\-\-set\fP, \fB\-\-rcheck\fP, \fB\-\-update\fP and \fB\-\-remove\fP are
-mutually exclusive.
-.TP
-\fB\-\-name\fP \fIname\fP
-Specify the list to use for the commands. If no name is given then
-\fBDEFAULT\fP will be used.
-.TP
-[\fB!\fP] \fB\-\-set\fP
-This will add the source address of the packet to the list. If the source
-address is already in the list, this will update the existing entry. This will
-always return success (or failure if \fB!\fP is passed in).
-.TP
-\fB\-\-rsource\fP
-Match/save the source address of each packet in the recent list table. This
-is the default.
-.TP
-\fB\-\-rdest\fP
-Match/save the destination address of each packet in the recent list table.
-.TP
-[\fB!\fP] \fB\-\-rcheck\fP
-Check if the source address of the packet is currently in the list.
-.TP
-[\fB!\fP] \fB\-\-update\fP
-Like \fB\-\-rcheck\fP, except it will update the "last seen" timestamp if it
-matches.
-.TP
-[\fB!\fP] \fB\-\-remove\fP
-Check if the source address of the packet is currently in the list and if so
-that address will be removed from the list and the rule will return true. If
-the address is not found, false is returned.
-.TP
-\fB\-\-seconds\fP \fIseconds\fP
-This option must be used in conjunction with one of \fB\-\-rcheck\fP or
-\fB\-\-update\fP. When used, this will narrow the match to only happen when the
-address is in the list and was seen within the last given number of seconds.
-.TP
-\fB\-\-hitcount\fP \fIhits\fP
-This option must be used in conjunction with one of \fB\-\-rcheck\fP or
-\fB\-\-update\fP. When used, this will narrow the match to only happen when the
-address is in the list and packets had been received greater than or equal to
-the given value. This option may be used along with \fB\-\-seconds\fP to create
-an even narrower match requiring a certain number of hits within a specific
-time frame. The maximum value for the hitcount parameter is given by the
-"ip_pkt_list_tot" parameter of the xt_recent kernel module. Exceeding this
-value on the command line will cause the rule to be rejected.
-.TP
-\fB\-\-rttl\fP
-This option may only be used in conjunction with one of \fB\-\-rcheck\fP or
-\fB\-\-update\fP. When used, this will narrow the match to only happen when the
-address is in the list and the TTL of the current packet matches that of the
-packet which hit the \fB\-\-set\fP rule. This may be useful if you have problems
-with people faking their source address in order to DoS you via this module by
-disallowing others access to your site by sending bogus packets to you.
-.PP
-Examples:
-.IP
-iptables \-A FORWARD \-m recent \-\-name badguy \-\-rcheck \-\-seconds 60 \-j DROP
-.IP
-iptables \-A FORWARD \-p tcp \-i eth0 \-\-dport 139 \-m recent \-\-name badguy \-\-set \-j DROP
-.PP
-Steve's ipt_recent website (http://snowman.net/projects/ipt_recent/) also has
-some examples of usage.
-.PP
-\fB/proc/net/xt_recent/*\fP are the current lists of addresses and information
-about each entry of each list.
-.PP
-Each file in \fB/proc/net/xt_recent/\fP can be read from to see the current
-list or written two using the following commands to modify the list:
-.TP
-\fBecho +\fP\fIaddr\fP\fB >/proc/net/xt_recent/DEFAULT\fP
-to add \fIaddr\fP to the DEFAULT list
-.TP
-\fBecho \-\fP\fIaddr\fP\fB >/proc/net/xt_recent/DEFAULT\fP
-to remove \fIaddr\fP from the DEFAULT list
-.TP
-\fBecho / >/proc/net/xt_recent/DEFAULT\fP
-to flush the DEFAULT list (remove all entries).
-.PP
-The module itself accepts parameters, defaults shown:
-.TP
-\fBip_list_tot\fP=\fI100\fP
-Number of addresses remembered per table.
-.TP
-\fBip_pkt_list_tot\fP=\fI20\fP
-Number of packets per address remembered.
-.TP
-\fBip_list_hash_size\fP=\fI0\fP
-Hash table size. 0 means to calculate it based on ip_list_tot, default: 512.
-.TP
-\fBip_list_perms\fP=\fI0644\fP
-Permissions for /proc/net/xt_recent/* files.
-.TP
-\fBip_list_uid\fP=\fI0\fP
-Numerical UID for ownership of /proc/net/xt_recent/* files.
-.TP
-\fBip_list_gid\fP=\fI0\fP
-Numerical GID for ownership of /proc/net/xt_recent/* files.

=== removed directory '.pc/9003-lp1020490.patch'
=== removed directory '.pc/9003-lp1020490.patch/extensions'
=== removed file '.pc/9003-lp1020490.patch/extensions/libxt_conntrack.c'
--- .pc/9003-lp1020490.patch/extensions/libxt_conntrack.c	2012-07-20 15:45:01 +0000
+++ .pc/9003-lp1020490.patch/extensions/libxt_conntrack.c	1970-01-01 00:00:00 +0000
@@ -1,1102 +0,0 @@
-/*
- *	libxt_conntrack
- *	Shared library add-on to iptables for conntrack matching support.
- *
- *	GPL (C) 2001  Marc Boucher ([e-mail]).
- *	Copyright © CC Computer Consultants GmbH, 2007 - 2008
- *	Jan Engelhardt <[e-mail]>
- */
-#include <stdbool.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <xtables.h>
-#include <linux/netfilter/xt_conntrack.h>
-#include <linux/netfilter/nf_conntrack_common.h>
-
-struct ip_conntrack_old_tuple {
-	struct {
-		__be32 ip;
-		union {
-			__u16 all;
-		} u;
-	} src;
-
-	struct {
-		__be32 ip;
-		union {
-			__u16 all;
-		} u;
-
-		/* The protocol. */
-		__u16 protonum;
-	} dst;
-};
-
-struct xt_conntrack_info {
-	unsigned int statemask, statusmask;
-
-	struct ip_conntrack_old_tuple tuple[IP_CT_DIR_MAX];
-	struct in_addr sipmsk[IP_CT_DIR_MAX], dipmsk[IP_CT_DIR_MAX];
-
-	unsigned long expires_min, expires_max;
-
-	/* Flags word */
-	uint8_t flags;
-	/* Inverse flags */
-	uint8_t invflags;
-};
-
-enum {
-	O_CTSTATE = 0,
-	O_CTPROTO,
-	O_CTORIGSRC,
-	O_CTORIGDST,
-	O_CTREPLSRC,
-	O_CTREPLDST,
-	O_CTORIGSRCPORT,
-	O_CTORIGDSTPORT,
-	O_CTREPLSRCPORT,
-	O_CTREPLDSTPORT,
-	O_CTSTATUS,
-	O_CTEXPIRE,
-	O_CTDIR,
-};
-
-static void conntrack_mt_help(void)
-{
-	printf(
-"conntrack match options:\n"
-"[!] --ctstate {INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED|SNAT|DNAT}[,...]\n"
-"                               State(s) to match\n"
-"[!] --ctproto proto            Protocol to match; by number or name, e.g. \"tcp\"\n"
-"[!] --ctorigsrc address[/mask]\n"
-"[!] --ctorigdst address[/mask]\n"
-"[!] --ctreplsrc address[/mask]\n"
-"[!] --ctrepldst address[/mask]\n"
-"                               Original/Reply source/destination address\n"
-"[!] --ctorigsrcport port\n"
-"[!] --ctorigdstport port\n"
-"[!] --ctreplsrcport port\n"
-"[!] --ctrepldstport port\n"
-"                               TCP/UDP/SCTP orig./reply source/destination port\n"
-"[!] --ctstatus {NONE|EXPECTED|SEEN_REPLY|ASSURED|CONFIRMED}[,...]\n"
-"                               Status(es) to match\n"
-"[!] --ctexpire time[:time]     Match remaining lifetime in seconds against\n"
-"                               value or range of values (inclusive)\n"
-"    --ctdir {ORIGINAL|REPLY}   Flow direction of packet\n");
-}
-
-#define s struct xt_conntrack_info /* for v0 */
-static const struct xt_option_entry conntrack_mt_opts_v0[] = {
-	{.name = "ctstate", .id = O_CTSTATE, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctproto", .id = O_CTPROTO, .type = XTTYPE_PROTOCOL,
-	 .flags = XTOPT_INVERT,
-	 XTOPT_POINTER(s, tuple[IP_CT_DIR_ORIGINAL].dst.protonum)},
-	{.name = "ctorigsrc", .id = O_CTORIGSRC, .type = XTTYPE_HOST,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctorigdst", .id = O_CTORIGDST, .type = XTTYPE_HOST,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctreplsrc", .id = O_CTREPLSRC, .type = XTTYPE_HOST,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctrepldst", .id = O_CTREPLDST, .type = XTTYPE_HOST,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctstatus", .id = O_CTSTATUS, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC,
-	 .flags = XTOPT_INVERT},
-	XTOPT_TABLEEND,
-};
-#undef s
-
-#define s struct xt_conntrack_mtinfo2
-/* We exploit the fact that v1-v2 share the same xt_o_e layout */
-static const struct xt_option_entry conntrack2_mt_opts[] = {
-	{.name = "ctstate", .id = O_CTSTATE, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctproto", .id = O_CTPROTO, .type = XTTYPE_PROTOCOL,
-	 .flags = XTOPT_INVERT, XTOPT_POINTER(s, l4proto)},
-	{.name = "ctorigsrc", .id = O_CTORIGSRC, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctorigdst", .id = O_CTORIGDST, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctreplsrc", .id = O_CTREPLSRC, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctrepldst", .id = O_CTREPLDST, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctstatus", .id = O_CTSTATUS, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORT,
-	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORT,
-	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORT,
-	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORT,
-	 .flags = XTOPT_INVERT | XTOPT_NBO},
-	{.name = "ctdir", .id = O_CTDIR, .type = XTTYPE_STRING},
-	XTOPT_TABLEEND,
-};
-#undef s
-
-#define s struct xt_conntrack_mtinfo3 /* for v1-v3 */
-/* We exploit the fact that v1-v3 share the same layout */
-static const struct xt_option_entry conntrack3_mt_opts[] = {
-	{.name = "ctstate", .id = O_CTSTATE, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctproto", .id = O_CTPROTO, .type = XTTYPE_PROTOCOL,
-	 .flags = XTOPT_INVERT, XTOPT_POINTER(s, l4proto)},
-	{.name = "ctorigsrc", .id = O_CTORIGSRC, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctorigdst", .id = O_CTORIGDST, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctreplsrc", .id = O_CTREPLSRC, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctrepldst", .id = O_CTREPLDST, .type = XTTYPE_HOSTMASK,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctstatus", .id = O_CTSTATUS, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctexpire", .id = O_CTEXPIRE, .type = XTTYPE_UINT32RC,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctorigsrcport", .id = O_CTORIGSRCPORT, .type = XTTYPE_PORTRC,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctorigdstport", .id = O_CTORIGDSTPORT, .type = XTTYPE_PORTRC,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctreplsrcport", .id = O_CTREPLSRCPORT, .type = XTTYPE_PORTRC,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctrepldstport", .id = O_CTREPLDSTPORT, .type = XTTYPE_PORTRC,
-	 .flags = XTOPT_INVERT},
-	{.name = "ctdir", .id = O_CTDIR, .type = XTTYPE_STRING},
-	XTOPT_TABLEEND,
-};
-#undef s
-
-static int
-parse_state(const char *state, size_t len, struct xt_conntrack_info *sinfo)
-{
-	if (strncasecmp(state, "INVALID", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_INVALID;
-	else if (strncasecmp(state, "NEW", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_BIT(IP_CT_NEW);
-	else if (strncasecmp(state, "ESTABLISHED", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED);
-	else if (strncasecmp(state, "RELATED", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_BIT(IP_CT_RELATED);
-	else if (strncasecmp(state, "UNTRACKED", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_UNTRACKED;
-	else if (strncasecmp(state, "SNAT", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_SNAT;
-	else if (strncasecmp(state, "DNAT", len) == 0)
-		sinfo->statemask |= XT_CONNTRACK_STATE_DNAT;
-	else
-		return 0;
-	return 1;
-}
-
-static void
-parse_states(const char *arg, struct xt_conntrack_info *sinfo)
-{
-	const char *comma;
-
-	while ((comma = strchr(arg, ',')) != NULL) {
-		if (comma == arg || !parse_state(arg, comma-arg, sinfo))
-			xtables_error(PARAMETER_PROBLEM, "Bad ctstate \"%s\"", arg);
-		arg = comma+1;
-	}
-	if (!*arg)
-		xtables_error(PARAMETER_PROBLEM, "\"--ctstate\" requires a list of "
-					      "states with no spaces, e.g. "
-					      "ESTABLISHED,RELATED");
-	if (strlen(arg) == 0 || !parse_state(arg, strlen(arg), sinfo))
-		xtables_error(PARAMETER_PROBLEM, "Bad ctstate \"%s\"", arg);
-}
-
-static bool
-conntrack_ps_state(struct xt_conntrack_mtinfo3 *info, const char *state,
-                   size_t z)
-{
-	if (strncasecmp(state, "INVALID", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_INVALID;
-	else if (strncasecmp(state, "NEW", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_BIT(IP_CT_NEW);
-	else if (strncasecmp(state, "ESTABLISHED", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED);
-	else if (strncasecmp(state, "RELATED", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_BIT(IP_CT_RELATED);
-	else if (strncasecmp(state, "UNTRACKED", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_UNTRACKED;
-	else if (strncasecmp(state, "SNAT", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_SNAT;
-	else if (strncasecmp(state, "DNAT", z) == 0)
-		info->state_mask |= XT_CONNTRACK_STATE_DNAT;
-	else
-		return false;
-	return true;
-}
-
-static void
-conntrack_ps_states(struct xt_conntrack_mtinfo3 *info, const char *arg)
-{
-	const char *comma;
-
-	while ((comma = strchr(arg, ',')) != NULL) {
-		if (comma == arg || !conntrack_ps_state(info, arg, comma - arg))
-			xtables_error(PARAMETER_PROBLEM,
-			           "Bad ctstate \"%s\"", arg);
-		arg = comma + 1;
-	}
-
-	if (strlen(arg) == 0 || !conntrack_ps_state(info, arg, strlen(arg)))
-		xtables_error(PARAMETER_PROBLEM, "Bad ctstate \"%s\"", arg);
-}
-
-static int
-parse_status(const char *status, size_t len, struct xt_conntrack_info *sinfo)
-{
-	if (strncasecmp(status, "NONE", len) == 0)
-		sinfo->statusmask |= 0;
-	else if (strncasecmp(status, "EXPECTED", len) == 0)
-		sinfo->statusmask |= IPS_EXPECTED;
-	else if (strncasecmp(status, "SEEN_REPLY", len) == 0)
-		sinfo->statusmask |= IPS_SEEN_REPLY;
-	else if (strncasecmp(status, "ASSURED", len) == 0)
-		sinfo->statusmask |= IPS_ASSURED;
-#ifdef IPS_CONFIRMED
-	else if (strncasecmp(status, "CONFIRMED", len) == 0)
-		sinfo->statusmask |= IPS_CONFIRMED;
-#endif
-	else
-		return 0;
-	return 1;
-}
-
-static void
-parse_statuses(const char *arg, struct xt_conntrack_info *sinfo)
-{
-	const char *comma;
-
-	while ((comma = strchr(arg, ',')) != NULL) {
-		if (comma == arg || !parse_status(arg, comma-arg, sinfo))
-			xtables_error(PARAMETER_PROBLEM, "Bad ctstatus \"%s\"", arg);
-		arg = comma+1;
-	}
-
-	if (strlen(arg) == 0 || !parse_status(arg, strlen(arg), sinfo))
-		xtables_error(PARAMETER_PROBLEM, "Bad ctstatus \"%s\"", arg);
-}
-
-static bool
-conntrack_ps_status(struct xt_conntrack_mtinfo3 *info, const char *status,
-                    size_t z)
-{
-	if (strncasecmp(status, "NONE", z) == 0)
-		info->status_mask |= 0;
-	else if (strncasecmp(status, "EXPECTED", z) == 0)
-		info->status_mask |= IPS_EXPECTED;
-	else if (strncasecmp(status, "SEEN_REPLY", z) == 0)
-		info->status_mask |= IPS_SEEN_REPLY;
-	else if (strncasecmp(status, "ASSURED", z) == 0)
-		info->status_mask |= IPS_ASSURED;
-	else if (strncasecmp(status, "CONFIRMED", z) == 0)
-		info->status_mask |= IPS_CONFIRMED;
-	else
-		return false;
-	return true;
-}
-
-static void
-conntrack_ps_statuses(struct xt_conntrack_mtinfo3 *info, const char *arg)
-{
-	const char *comma;
-
-	while ((comma = strchr(arg, ',')) != NULL) {
-		if (comma == arg || !conntrack_ps_status(info, arg, comma - arg))
-			xtables_error(PARAMETER_PROBLEM,
-			           "Bad ctstatus \"%s\"", arg);
-		arg = comma + 1;
-	}
-
-	if (strlen(arg) == 0 || !conntrack_ps_status(info, arg, strlen(arg)))
-		xtables_error(PARAMETER_PROBLEM, "Bad ctstatus \"%s\"", arg);
-}
-
-static void conntrack_parse(struct xt_option_call *cb)
-{
-	struct xt_conntrack_info *sinfo = cb->data;
-
-	xtables_option_parse(cb);
-	switch (cb->entry->id) {
-	case O_CTSTATE:
-		parse_states(cb->arg, sinfo);
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_STATE;
-		break;
-	case O_CTPROTO:
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_PROTO;
-		if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0
-		    && (sinfo->invflags & XT_INV_PROTO))
-			xtables_error(PARAMETER_PROBLEM,
-				   "rule would never match protocol");
-
-		sinfo->flags |= XT_CONNTRACK_PROTO;
-		break;
-	case O_CTORIGSRC:
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_ORIGSRC;
-		sinfo->tuple[IP_CT_DIR_ORIGINAL].src.ip = cb->val.haddr.ip;
-		sinfo->flags |= XT_CONNTRACK_ORIGSRC;
-		break;
-	case O_CTORIGDST:
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_ORIGDST;
-		sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.ip = cb->val.haddr.ip;
-		sinfo->flags |= XT_CONNTRACK_ORIGDST;
-		break;
-	case O_CTREPLSRC:
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_REPLSRC;
-		sinfo->tuple[IP_CT_DIR_REPLY].src.ip = cb->val.haddr.ip;
-		sinfo->flags |= XT_CONNTRACK_REPLSRC;
-		break;
-	case O_CTREPLDST:
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_REPLDST;
-		sinfo->tuple[IP_CT_DIR_REPLY].dst.ip = cb->val.haddr.ip;
-		sinfo->flags |= XT_CONNTRACK_REPLDST;
-		break;
-	case O_CTSTATUS:
-		parse_statuses(cb->arg, sinfo);
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_STATUS;
-		sinfo->flags |= XT_CONNTRACK_STATUS;
-		break;
-	case O_CTEXPIRE:
-		sinfo->expires_min = cb->val.u32_range[0];
-		sinfo->expires_max = cb->val.u32_range[0];
-		if (cb->nvals >= 2)
-			sinfo->expires_max = cb->val.u32_range[1];
-		if (cb->invert)
-			sinfo->invflags |= XT_CONNTRACK_EXPIRES;
-		sinfo->flags |= XT_CONNTRACK_EXPIRES;
-		break;
-	}
-}
-
-static void conntrack_mt_parse(struct xt_option_call *cb, uint8_t rev)
-{
-	struct xt_conntrack_mtinfo3 *info = cb->data;
-
-	xtables_option_parse(cb);
-	switch (cb->entry->id) {
-	case O_CTSTATE:
-		conntrack_ps_states(info, cb->arg);
-		info->match_flags |= XT_CONNTRACK_STATE;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_STATE;
-		break;
-	case O_CTPROTO:
-		if (info->l4proto == 0 && (info->invert_flags & XT_INV_PROTO))
-			xtables_error(PARAMETER_PROBLEM, "conntrack: rule would "
-			           "never match protocol");
-
-		info->match_flags |= XT_CONNTRACK_PROTO;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_PROTO;
-		break;
-	case O_CTORIGSRC:
-		info->origsrc_addr = cb->val.haddr;
-		info->origsrc_mask = cb->val.hmask;
-		info->match_flags |= XT_CONNTRACK_ORIGSRC;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_ORIGSRC;
-		break;
-	case O_CTORIGDST:
-		info->origdst_addr = cb->val.haddr;
-		info->origdst_mask = cb->val.hmask;
-		info->match_flags |= XT_CONNTRACK_ORIGDST;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_ORIGDST;
-		break;
-	case O_CTREPLSRC:
-		info->replsrc_addr = cb->val.haddr;
-		info->replsrc_mask = cb->val.hmask;
-		info->match_flags |= XT_CONNTRACK_REPLSRC;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_REPLSRC;
-		break;
-	case O_CTREPLDST:
-		info->repldst_addr = cb->val.haddr;
-		info->repldst_mask = cb->val.hmask;
-		info->match_flags |= XT_CONNTRACK_REPLDST;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_REPLDST;
-		break;
-	case O_CTSTATUS:
-		conntrack_ps_statuses(info, cb->arg);
-		info->match_flags |= XT_CONNTRACK_STATUS;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_STATUS;
-		break;
-	case O_CTEXPIRE:
-		info->expires_min = cb->val.u32_range[0];
-		info->expires_max = cb->val.u32_range[0];
-		if (cb->nvals >= 2)
-			info->expires_max = cb->val.u32_range[1];
-		info->match_flags |= XT_CONNTRACK_EXPIRES;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_EXPIRES;
-		break;
-	case O_CTORIGSRCPORT:
-		info->origsrc_port = cb->val.port_range[0];
-		info->origsrc_port_high = cb->val.port_range[cb->nvals >= 2];
-		info->match_flags |= XT_CONNTRACK_ORIGSRC_PORT;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_ORIGSRC_PORT;
-		break;
-	case O_CTORIGDSTPORT:
-		info->origdst_port = cb->val.port_range[0];
-		info->origdst_port_high = cb->val.port_range[cb->nvals >= 2];
-		info->match_flags |= XT_CONNTRACK_ORIGDST_PORT;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_ORIGDST_PORT;
-		break;
-	case O_CTREPLSRCPORT:
-		info->replsrc_port = cb->val.port_range[0];
-		info->replsrc_port_high = cb->val.port_range[cb->nvals >= 2];
-		info->match_flags |= XT_CONNTRACK_REPLSRC_PORT;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_REPLSRC_PORT;
-		break;
-	case O_CTREPLDSTPORT:
-		info->repldst_port = cb->val.port_range[0];
-		info->repldst_port_high = cb->val.port_range[cb->nvals >= 2];
-		info->match_flags |= XT_CONNTRACK_REPLDST_PORT;
-		if (cb->invert)
-			info->invert_flags |= XT_CONNTRACK_REPLDST_PORT;
-		break;
-	case O_CTDIR:
-		if (strcasecmp(cb->arg, "ORIGINAL") == 0) {
-			info->match_flags  |= XT_CONNTRACK_DIRECTION;
-			info->invert_flags &= ~XT_CONNTRACK_DIRECTION;
-		} else if (strcasecmp(cb->arg, "REPLY") == 0) {
-			info->match_flags  |= XT_CONNTRACK_DIRECTION;
-			info->invert_flags |= XT_CONNTRACK_DIRECTION;
-		} else {
-			xtables_param_act(XTF_BAD_VALUE, "conntrack", "--ctdir", cb->arg);
-		}
-		break;
-	}
-}
-
-#define cinfo_transform(r, l) \
-	do { \
-		memcpy((r), (l), offsetof(typeof(*(l)), state_mask)); \
-		(r)->state_mask  = (l)->state_mask; \
-		(r)->status_mask = (l)->status_mask; \
-	} while (false);
-
-static void conntrack1_mt_parse(struct xt_option_call *cb)
-{
-	struct xt_conntrack_mtinfo1 *info = cb->data;
-	struct xt_conntrack_mtinfo3 up;
-
-	memset(&up, 0, sizeof(up));
-	cinfo_transform(&up, info);
-	up.origsrc_port_high = up.origsrc_port;
-	up.origdst_port_high = up.origdst_port;
-	up.replsrc_port_high = up.replsrc_port;
-	up.repldst_port_high = up.repldst_port;
-	cb->data = &up;
-	conntrack_mt_parse(cb, 3);
-	if (up.origsrc_port != up.origsrc_port_high ||
-	    up.origdst_port != up.origdst_port_high ||
-	    up.replsrc_port != up.replsrc_port_high ||
-	    up.repldst_port != up.repldst_port_high)
-		xtables_error(PARAMETER_PROBLEM,
-			"conntrack rev 1 does not support port ranges");
-	cinfo_transform(info, &up);
-	cb->data = info;
-}
-
-static void conntrack2_mt_parse(struct xt_option_call *cb)
-{
-#define cinfo2_transform(r, l) \
-		memcpy((r), (l), offsetof(typeof(*(l)), sizeof(*info));
-
-	struct xt_conntrack_mtinfo2 *info = cb->data;
-	struct xt_conntrack_mtinfo3 up;
-
-	memset(&up, 0, sizeof(up));
-	memcpy(&up, info, sizeof(*info));
-	up.origsrc_port_high = up.origsrc_port;
-	up.origdst_port_high = up.origdst_port;
-	up.replsrc_port_high = up.replsrc_port;
-	up.repldst_port_high = up.repldst_port;
-	cb->data = &up;
-	conntrack_mt_parse(cb, 3);
-	if (up.origsrc_port != up.origsrc_port_high ||
-	    up.origdst_port != up.origdst_port_high ||
-	    up.replsrc_port != up.replsrc_port_high ||
-	    up.repldst_port != up.repldst_port_high)
-		xtables_error(PARAMETER_PROBLEM,
-			"conntrack rev 2 does not support port ranges");
-	memcpy(info, &up, sizeof(*info));
-	cb->data = info;
-#undef cinfo2_transform
-}
-
-static void conntrack3_mt_parse(struct xt_option_call *cb)
-{
-	conntrack_mt_parse(cb, 3);
-}
-
-static void conntrack_mt_check(struct xt_fcheck_call *cb)
-{
-	if (cb->xflags == 0)
-		xtables_error(PARAMETER_PROBLEM, "conntrack: At least one option "
-		           "is required");
-}
-
-static void
-print_state(unsigned int statemask)
-{
-	const char *sep = " ";
-
-	if (statemask & XT_CONNTRACK_STATE_INVALID) {
-		printf("%sINVALID", sep);
-		sep = ",";
-	}
-	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_NEW)) {
-		printf("%sNEW", sep);
-		sep = ",";
-	}
-	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_RELATED)) {
-		printf("%sRELATED", sep);
-		sep = ",";
-	}
-	if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED)) {
-		printf("%sESTABLISHED", sep);
-		sep = ",";
-	}
-	if (statemask & XT_CONNTRACK_STATE_UNTRACKED) {
-		printf("%sUNTRACKED", sep);
-		sep = ",";
-	}
-	if (statemask & XT_CONNTRACK_STATE_SNAT) {
-		printf("%sSNAT", sep);
-		sep = ",";
-	}
-	if (statemask & XT_CONNTRACK_STATE_DNAT) {
-		printf("%sDNAT", sep);
-		sep = ",";
-	}
-}
-
-static void
-print_status(unsigned int statusmask)
-{
-	const char *sep = " ";
-
-	if (statusmask & IPS_EXPECTED) {
-		printf("%sEXPECTED", sep);
-		sep = ",";
-	}
-	if (statusmask & IPS_SEEN_REPLY) {
-		printf("%sSEEN_REPLY", sep);
-		sep = ",";
-	}
-	if (statusmask & IPS_ASSURED) {
-		printf("%sASSURED", sep);
-		sep = ",";
-	}
-	if (statusmask & IPS_CONFIRMED) {
-		printf("%sCONFIRMED", sep);
-		sep = ",";
-	}
-	if (statusmask == 0)
-		printf("%sNONE", sep);
-}
-
-static void
-conntrack_dump_addr(const union nf_inet_addr *addr,
-                    const union nf_inet_addr *mask,
-                    unsigned int family, bool numeric)
-{
-	if (family == NFPROTO_IPV4) {
-		if (!numeric && addr->ip == 0) {
-			printf(" anywhere");
-			return;
-		}
-		if (numeric)
-			printf(" %s%s",
-			       xtables_ipaddr_to_numeric(&addr->in),
-			       xtables_ipmask_to_numeric(&mask->in));
-		else
-			printf(" %s%s",
-			       xtables_ipaddr_to_anyname(&addr->in),
-			       xtables_ipmask_to_numeric(&mask->in));
-	} else if (family == NFPROTO_IPV6) {
-		if (!numeric && addr->ip6[0] == 0 && addr->ip6[1] == 0 &&
-		    addr->ip6[2] == 0 && addr->ip6[3] == 0) {
-			printf(" anywhere");
-			return;
-		}
-		if (numeric)
-			printf(" %s%s",
-			       xtables_ip6addr_to_numeric(&addr->in6),
-			       xtables_ip6mask_to_numeric(&mask->in6));
-		else
-			printf(" %s%s",
-			       xtables_ip6addr_to_anyname(&addr->in6),
-			       xtables_ip6mask_to_numeric(&mask->in6));
-	}
-}
-
-static void
-print_addr(const struct in_addr *addr, const struct in_addr *mask,
-           int inv, int numeric)
-{
-	char buf[BUFSIZ];
-
-	if (inv)
-		printf(" !");
-
-	if (mask->s_addr == 0L && !numeric)
-		printf(" %s", "anywhere");
-	else {
-		if (numeric)
-			strcpy(buf, xtables_ipaddr_to_numeric(addr));
-		else
-			strcpy(buf, xtables_ipaddr_to_anyname(addr));
-		strcat(buf, xtables_ipmask_to_numeric(mask));
-		printf(" %s", buf);
-	}
-}
-
-static void
-matchinfo_print(const void *ip, const struct xt_entry_match *match, int numeric, const char *optpfx)
-{
-	const struct xt_conntrack_info *sinfo = (const void *)match->data;
-
-	if(sinfo->flags & XT_CONNTRACK_STATE) {
-        	if (sinfo->invflags & XT_CONNTRACK_STATE)
-			printf(" !");
-		printf(" %sctstate", optpfx);
-		print_state(sinfo->statemask);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_PROTO) {
-        	if (sinfo->invflags & XT_CONNTRACK_PROTO)
-			printf(" !");
-		printf(" %sctproto", optpfx);
-		printf(" %u", sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_ORIGSRC) {
-		if (sinfo->invflags & XT_CONNTRACK_ORIGSRC)
-			printf(" !");
-		printf(" %sctorigsrc", optpfx);
-
-		print_addr(
-		    (struct in_addr *)&sinfo->tuple[IP_CT_DIR_ORIGINAL].src.ip,
-		    &sinfo->sipmsk[IP_CT_DIR_ORIGINAL],
-		    false,
-		    numeric);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_ORIGDST) {
-		if (sinfo->invflags & XT_CONNTRACK_ORIGDST)
-			printf(" !");
-		printf(" %sctorigdst", optpfx);
-
-		print_addr(
-		    (struct in_addr *)&sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.ip,
-		    &sinfo->dipmsk[IP_CT_DIR_ORIGINAL],
-		    false,
-		    numeric);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_REPLSRC) {
-		if (sinfo->invflags & XT_CONNTRACK_REPLSRC)
-			printf(" !");
-		printf(" %sctreplsrc", optpfx);
-
-		print_addr(
-		    (struct in_addr *)&sinfo->tuple[IP_CT_DIR_REPLY].src.ip,
-		    &sinfo->sipmsk[IP_CT_DIR_REPLY],
-		    false,
-		    numeric);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_REPLDST) {
-		if (sinfo->invflags & XT_CONNTRACK_REPLDST)
-			printf(" !");
-		printf(" %sctrepldst", optpfx);
-
-		print_addr(
-		    (struct in_addr *)&sinfo->tuple[IP_CT_DIR_REPLY].dst.ip,
-		    &sinfo->dipmsk[IP_CT_DIR_REPLY],
-		    false,
-		    numeric);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_STATUS) {
-        	if (sinfo->invflags & XT_CONNTRACK_STATUS)
-			printf(" !");
-		printf(" %sctstatus", optpfx);
-		print_status(sinfo->statusmask);
-	}
-
-	if(sinfo->flags & XT_CONNTRACK_EXPIRES) {
-        	if (sinfo->invflags & XT_CONNTRACK_EXPIRES)
-			printf(" !");
-		printf(" %sctexpire ", optpfx);
-
-        	if (sinfo->expires_max == sinfo->expires_min)
-			printf("%lu", sinfo->expires_min);
-        	else
-			printf("%lu:%lu", sinfo->expires_min, sinfo->expires_max);
-	}
-
-	if (sinfo->flags & XT_CONNTRACK_DIRECTION) {
-		if (sinfo->invflags & XT_CONNTRACK_DIRECTION)
-			printf(" %sctdir REPLY", optpfx);
-		else
-			printf(" %sctdir ORIGINAL", optpfx);
-	}
-
-}
-
-static void
-conntrack_dump_ports(const char *prefix, const char *opt,
-		     u_int16_t port_low, u_int16_t port_high)
-{
-	if (port_high == 0 || port_low == port_high)
-		printf(" %s%s %u", prefix, opt, port_low);
-	else
-		printf(" %s%s %u:%u", prefix, opt, port_low, port_high);
-}
-
-static void
-conntrack_dump(const struct xt_conntrack_mtinfo3 *info, const char *prefix,
-               unsigned int family, bool numeric, bool v3)
-{
-	if (info->match_flags & XT_CONNTRACK_STATE) {
-		if (info->invert_flags & XT_CONNTRACK_STATE)
-			printf(" !");
-		printf(" %sctstate", prefix);
-		print_state(info->state_mask);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_PROTO) {
-		if (info->invert_flags & XT_CONNTRACK_PROTO)
-			printf(" !");
-		printf(" %sctproto %u", prefix, info->l4proto);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_ORIGSRC) {
-		if (info->invert_flags & XT_CONNTRACK_ORIGSRC)
-			printf(" !");
-		printf(" %sctorigsrc", prefix);
-		conntrack_dump_addr(&info->origsrc_addr, &info->origsrc_mask,
-		                    family, numeric);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_ORIGDST) {
-		if (info->invert_flags & XT_CONNTRACK_ORIGDST)
-			printf(" !");
-		printf(" %sctorigdst", prefix);
-		conntrack_dump_addr(&info->origdst_addr, &info->origdst_mask,
-		                    family, numeric);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_REPLSRC) {
-		if (info->invert_flags & XT_CONNTRACK_REPLSRC)
-			printf(" !");
-		printf(" %sctreplsrc", prefix);
-		conntrack_dump_addr(&info->replsrc_addr, &info->replsrc_mask,
-		                    family, numeric);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_REPLDST) {
-		if (info->invert_flags & XT_CONNTRACK_REPLDST)
-			printf(" !");
-		printf(" %sctrepldst", prefix);
-		conntrack_dump_addr(&info->repldst_addr, &info->repldst_mask,
-		                    family, numeric);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_ORIGSRC_PORT) {
-		if (info->invert_flags & XT_CONNTRACK_ORIGSRC_PORT)
-			printf(" !");
-		conntrack_dump_ports(prefix, "ctorigsrcport",
-				     v3 ? info->origsrc_port : ntohs(info->origsrc_port),
-				     v3 ? info->origsrc_port_high : 0);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_ORIGDST_PORT) {
-		if (info->invert_flags & XT_CONNTRACK_ORIGDST_PORT)
-			printf(" !");
-		conntrack_dump_ports(prefix, "ctorigdstport",
-				     v3 ? info->origdst_port : ntohs(info->origdst_port),
-				     v3 ? info->origdst_port_high : 0);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_REPLSRC_PORT) {
-		if (info->invert_flags & XT_CONNTRACK_REPLSRC_PORT)
-			printf(" !");
-		conntrack_dump_ports(prefix, "ctreplsrcport",
-				     v3 ? info->replsrc_port : ntohs(info->replsrc_port),
-				     v3 ? info->replsrc_port_high : 0);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_REPLDST_PORT) {
-		if (info->invert_flags & XT_CONNTRACK_REPLDST_PORT)
-			printf(" !");
-		conntrack_dump_ports(prefix, "ctrepldstport",
-				     v3 ? info->repldst_port : ntohs(info->repldst_port),
-				     v3 ? info->repldst_port_high : 0);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_STATUS) {
-		if (info->invert_flags & XT_CONNTRACK_STATUS)
-			printf(" !");
-		printf(" %sctstatus", prefix);
-		print_status(info->status_mask);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_EXPIRES) {
-		if (info->invert_flags & XT_CONNTRACK_EXPIRES)
-			printf(" !");
-		printf(" %sctexpire ", prefix);
-
-		if (info->expires_max == info->expires_min)
-			printf("%u", (unsigned int)info->expires_min);
-		else
-			printf("%u:%u", (unsigned int)info->expires_min,
-			       (unsigned int)info->expires_max);
-	}
-
-	if (info->match_flags & XT_CONNTRACK_DIRECTION) {
-		if (info->invert_flags & XT_CONNTRACK_DIRECTION)
-			printf(" %sctdir REPLY", prefix);
-		else
-			printf(" %sctdir ORIGINAL", prefix);
-	}
-}
-
-static void conntrack_print(const void *ip, const struct xt_entry_match *match,
-                            int numeric)
-{
-	matchinfo_print(ip, match, numeric, "");
-}
-
-static void
-conntrack1_mt4_print(const void *ip, const struct xt_entry_match *match,
-                     int numeric)
-{
-	const struct xt_conntrack_mtinfo1 *info = (void *)match->data;
-	struct xt_conntrack_mtinfo3 up;
-
-	cinfo_transform(&up, info);
-	conntrack_dump(&up, "", NFPROTO_IPV4, numeric, false);
-}
-
-static void
-conntrack1_mt6_print(const void *ip, const struct xt_entry_match *match,
-                     int numeric)
-{
-	const struct xt_conntrack_mtinfo1 *info = (void *)match->data;
-	struct xt_conntrack_mtinfo3 up;
-
-	cinfo_transform(&up, info);
-	conntrack_dump(&up, "", NFPROTO_IPV6, numeric, false);
-}
-
-static void
-conntrack2_mt_print(const void *ip, const struct xt_entry_match *match,
-                    int numeric)
-{
-	conntrack_dump((const void *)match->data, "", NFPROTO_IPV4, numeric, false);
-}
-
-static void
-conntrack2_mt6_print(const void *ip, const struct xt_entry_match *match,
-                     int numeric)
-{
-	conntrack_dump((const void *)match->data, "", NFPROTO_IPV6, numeric, false);
-}
-
-static void
-conntrack3_mt_print(const void *ip, const struct xt_entry_match *match,
-                    int numeric)
-{
-	conntrack_dump((const void *)match->data, "", NFPROTO_IPV4, numeric, true);
-}
-
-static void
-conntrack3_mt6_print(const void *ip, const struct xt_entry_match *match,
-                     int numeric)
-{
-	conntrack_dump((const void *)match->data, "", NFPROTO_IPV6, numeric, true);
-}
-
-static void conntrack_save(const void *ip, const struct xt_entry_match *match)
-{
-	matchinfo_print(ip, match, 1, "--");
-}
-
-static void conntrack3_mt_save(const void *ip,
-                               const struct xt_entry_match *match)
-{
-	conntrack_dump((const void *)match->data, "--", NFPROTO_IPV4, true, true);
-}
-
-static void conntrack3_mt6_save(const void *ip,
-                                const struct xt_entry_match *match)
-{
-	conntrack_dump((const void *)match->data, "--", NFPROTO_IPV6, true, true);
-}
-
-static void conntrack2_mt_save(const void *ip,
-                               const struct xt_entry_match *match)
-{
-	conntrack_dump((const void *)match->data, "--", NFPROTO_IPV4, true, false);
-}
-
-static void conntrack2_mt6_save(const void *ip,
-                                const struct xt_entry_match *match)
-{
-	conntrack_dump((const void *)match->data, "--", NFPROTO_IPV6, true, false);
-}
-
-static void
-conntrack1_mt4_save(const void *ip, const struct xt_entry_match *match)
-{
-	const struct xt_conntrack_mtinfo1 *info = (void *)match->data;
-	struct xt_conntrack_mtinfo3 up;
-
-	cinfo_transform(&up, info);
-	conntrack_dump(&up, "--", NFPROTO_IPV4, true, false);
-}
-
-static void
-conntrack1_mt6_save(const void *ip, const struct xt_entry_match *match)
-{
-	const struct xt_conntrack_mtinfo1 *info = (void *)match->data;
-	struct xt_conntrack_mtinfo3 up;
-
-	cinfo_transform(&up, info);
-	conntrack_dump(&up, "--", NFPROTO_IPV6, true, false);
-}
-
-static struct xtables_match conntrack_mt_reg[] = {
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 0,
-		.family        = NFPROTO_IPV4,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_info)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_info)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack_print,
-		.save          = conntrack_save,
-		.x6_options    = conntrack_mt_opts_v0,
-	},
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 1,
-		.family        = NFPROTO_IPV4,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack1_mt_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack1_mt4_print,
-		.save          = conntrack1_mt4_save,
-		.x6_options    = conntrack2_mt_opts,
-	},
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 1,
-		.family        = NFPROTO_IPV6,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack1_mt_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack1_mt6_print,
-		.save          = conntrack1_mt6_save,
-		.x6_options    = conntrack2_mt_opts,
-	},
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 2,
-		.family        = NFPROTO_IPV4,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack2_mt_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack2_mt_print,
-		.save          = conntrack2_mt_save,
-		.x6_options    = conntrack2_mt_opts,
-	},
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 2,
-		.family        = NFPROTO_IPV6,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack2_mt_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack2_mt6_print,
-		.save          = conntrack2_mt6_save,
-		.x6_options    = conntrack2_mt_opts,
-	},
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 3,
-		.family        = NFPROTO_IPV4,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack3_mt_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack3_mt_print,
-		.save          = conntrack3_mt_save,
-		.x6_options    = conntrack3_mt_opts,
-	},
-	{
-		.version       = XTABLES_VERSION,
-		.name          = "conntrack",
-		.revision      = 3,
-		.family        = NFPROTO_IPV6,
-		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
-		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
-		.help          = conntrack_mt_help,
-		.x6_parse      = conntrack3_mt_parse,
-		.x6_fcheck     = conntrack_mt_check,
-		.print         = conntrack3_mt6_print,
-		.save          = conntrack3_mt6_save,
-		.x6_options    = conntrack3_mt_opts,
-	},
-};
-
-void _init(void)
-{
-	xtables_register_matches(conntrack_mt_reg, ARRAY_SIZE(conntrack_mt_reg));
-}

=== removed directory '.pc/9004-argv-is-null.patch'
=== removed directory '.pc/9004-argv-is-null.patch/iptables'
=== removed file '.pc/9004-argv-is-null.patch/iptables/ip6tables-restore.c'
--- .pc/9004-argv-is-null.patch/iptables/ip6tables-restore.c	2012-07-20 15:45:01 +0000
+++ .pc/9004-argv-is-null.patch/iptables/ip6tables-restore.c	1970-01-01 00:00:00 +0000
@@ -1,465 +0,0 @@
-/* Code to restore the iptables state, from file by ip6tables-save.
- * Author:  Andras Kis-Szabo <[e-mail]>
- *
- * based on iptables-restore
- * Authors:
- *      Harald Welte <[e-mail]>
- *      Rusty Russell <[e-mail]>
- * This code is distributed under the terms of GNU GPL v2
- */
-
-#include <getopt.h>
-#include <sys/errno.h>
-#include <stdbool.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include "ip6tables.h"
-#include "xtables.h"
-#include "libiptc/libip6tc.h"
-#include "ip6tables-multi.h"
-
-#ifdef DEBUG
-#define DEBUGP(x, args...) fprintf(stderr, x, ## args)
-#else
-#define DEBUGP(x, args...)
-#endif
-
-static int binary = 0, counters = 0, verbose = 0, noflush = 0;
-
-/* Keeping track of external matches and targets.  */
-static const struct option options[] = {
-	{.name = "binary",   .has_arg = false, .val = 'b'},
-	{.name = "counters", .has_arg = false, .val = 'c'},
-	{.name = "verbose",  .has_arg = false, .val = 'v'},
-	{.name = "test",     .has_arg = false, .val = 't'},
-	{.name = "help",     .has_arg = false, .val = 'h'},
-	{.name = "noflush",  .has_arg = false, .val = 'n'},
-	{.name = "modprobe", .has_arg = true,  .val = 'M'},
-	{NULL},
-};
-
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
-static void print_usage(const char *name, const char *version)
-{
-	fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-t] [-h]\n"
-			"	   [ --binary ]\n"
-			"	   [ --counters ]\n"
-			"	   [ --verbose ]\n"
-			"	   [ --test ]\n"
-			"	   [ --help ]\n"
-			"	   [ --noflush ]\n"
-			"          [ --modprobe=<command>]\n", name);
-
-	exit(1);
-}
-
-static struct ip6tc_handle *create_handle(const char *tablename)
-{
-	struct ip6tc_handle *handle;
-
-	handle = ip6tc_init(tablename);
-
-	if (!handle) {
-		/* try to insmod the module if iptc_init failed */
-		xtables_load_ko(xtables_modprobe_program, false);
-		handle = ip6tc_init(tablename);
-	}
-
-	if (!handle) {
-		xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
-			"table '%s'\n", ip6tables_globals.program_name,
-			tablename);
-		exit(1);
-	}
-	return handle;
-}
-
-static int parse_counters(char *string, struct ip6t_counters *ctr)
-{
-	unsigned long long pcnt, bcnt;
-	int ret;
-
-	ret = sscanf(string, "[%llu:%llu]", &pcnt, &bcnt);
-	ctr->pcnt = pcnt;
-	ctr->bcnt = bcnt;
-	return ret == 2;
-}
-
-/* global new argv and argc */
-static char *newargv[255];
-static int newargc;
-
-/* function adding one argument to newargv, updating newargc
- * returns true if argument added, false otherwise */
-static int add_argv(char *what) {
-	DEBUGP("add_argv: %s\n", what);
-	if (what && newargc + 1 < ARRAY_SIZE(newargv)) {
-		newargv[newargc] = strdup(what);
-		newargc++;
-		return 1;
-	} else {
-		xtables_error(PARAMETER_PROBLEM,
-			"Parser cannot handle more arguments\n");
-		return 0;
-	}
-}
-
-static void free_argv(void) {
-	int i;
-
-	for (i = 0; i < newargc; i++)
-		free(newargv[i]);
-}
-
-#ifdef IPTABLES_MULTI
-int ip6tables_restore_main(int argc, char *argv[])
-#else
-int main(int argc, char *argv[])
-#endif
-{
-	struct ip6tc_handle *handle = NULL;
-	char buffer[10240];
-	int c;
-	char curtable[IP6T_TABLE_MAXNAMELEN + 1];
-	FILE *in;
-	int in_table = 0, testing = 0;
-
-	line = 0;
-
-	ip6tables_globals.program_name = "ip6tables-restore";
-	c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6);
-	if (c < 0) {
-		fprintf(stderr, "%s/%s Failed to initialize xtables\n",
-				ip6tables_globals.program_name,
-				ip6tables_globals.program_version);
-		exit(1);
-	}
-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-	init_extensions();
-	init_extensions6();
-#endif
-
-	while ((c = getopt_long(argc, argv, "bcvthnM:", options, NULL)) != -1) {
-		switch (c) {
-			case 'b':
-				binary = 1;
-				break;
-			case 'c':
-				counters = 1;
-				break;
-			case 'v':
-				verbose = 1;
-				break;
-			case 't':
-				testing = 1;
-				break;
-			case 'h':
-				print_usage("ip6tables-restore",
-					    IPTABLES_VERSION);
-				break;
-			case 'n':
-				noflush = 1;
-				break;
-			case 'M':
-				xtables_modprobe_program = optarg;
-				break;
-		}
-	}
-
-	if (optind == argc - 1) {
-		in = fopen(argv[optind], "re");
-		if (!in) {
-			fprintf(stderr, "Can't open %s: %s\n", argv[optind],
-				strerror(errno));
-			exit(1);
-		}
-	}
-	else if (optind < argc) {
-		fprintf(stderr, "Unknown arguments found on commandline\n");
-		exit(1);
-	}
-	else in = stdin;
-
-	/* Grab standard input. */
-	while (fgets(buffer, sizeof(buffer), in)) {
-		int ret = 0;
-
-		line++;
-		if (buffer[0] == '\n')
-			continue;
-		else if (buffer[0] == '#') {
-			if (verbose)
-				fputs(buffer, stdout);
-			continue;
-		} else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
-			if (!testing) {
-				DEBUGP("Calling commit\n");
-				ret = ip6tc_commit(handle);
-				ip6tc_free(handle);
-				handle = NULL;
-			} else {
-				DEBUGP("Not calling commit, testing\n");
-				ret = 1;
-			}
-			in_table = 0;
-		} else if ((buffer[0] == '*') && (!in_table)) {
-			/* New table */
-			char *table;
-
-			table = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, table '%s'\n", line, table);
-			if (!table) {
-				xtables_error(PARAMETER_PROBLEM,
-					"%s: line %u table name invalid\n",
-					ip6tables_globals.program_name,
-					line);
-				exit(1);
-			}
-			strncpy(curtable, table, IP6T_TABLE_MAXNAMELEN);
-			curtable[IP6T_TABLE_MAXNAMELEN] = '\0';
-
-			if (handle)
-				ip6tc_free(handle);
-
-			handle = create_handle(table);
-			if (noflush == 0) {
-				DEBUGP("Cleaning all chains of table '%s'\n",
-					table);
-				for_each_chain6(flush_entries6, verbose, 1,
-						handle);
-
-				DEBUGP("Deleting all user-defined chains "
-				       "of table '%s'\n", table);
-				for_each_chain6(delete_chain6, verbose, 0,
-						handle);
-			}
-
-			ret = 1;
-			in_table = 1;
-
-		} else if ((buffer[0] == ':') && (in_table)) {
-			/* New chain. */
-			char *policy, *chain;
-
-			chain = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, chain '%s'\n", line, chain);
-			if (!chain) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u chain name invalid\n",
-					   ip6tables_globals.program_name,
-					   line);
-				exit(1);
-			}
-
-			if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
-				xtables_error(PARAMETER_PROBLEM,
-					   "Invalid chain name `%s' "
-					   "(%u chars max)",
-					   chain, XT_EXTENSION_MAXNAMELEN - 1);
-
-			if (ip6tc_builtin(chain, handle) <= 0) {
-				if (noflush && ip6tc_is_chain(chain, handle)) {
-					DEBUGP("Flushing existing user defined chain '%s'\n", chain);
-					if (!ip6tc_flush_entries(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error flushing chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				} else {
-					DEBUGP("Creating new chain '%s'\n", chain);
-					if (!ip6tc_create_chain(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error creating chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				}
-			}
-
-			policy = strtok(NULL, " \t\n");
-			DEBUGP("line %u, policy '%s'\n", line, policy);
-			if (!policy) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u policy invalid\n",
-					   ip6tables_globals.program_name,
-					   line);
-				exit(1);
-			}
-
-			if (strcmp(policy, "-") != 0) {
-				struct ip6t_counters count;
-
-				if (counters) {
-					char *ctrs;
-					ctrs = strtok(NULL, " \t\n");
-
-					if (!ctrs || !parse_counters(ctrs, &count))
-						xtables_error(PARAMETER_PROBLEM,
-							  "invalid policy counters "
-							  "for chain '%s'\n", chain);
-
-				} else {
-					memset(&count, 0,
-					       sizeof(struct ip6t_counters));
-				}
-
-				DEBUGP("Setting policy of chain %s to %s\n",
-					chain, policy);
-
-				if (!ip6tc_set_policy(chain, policy, &count,
-						     handle))
-					xtables_error(OTHER_PROBLEM,
-						"Can't set policy `%s'"
-						" on `%s' line %u: %s\n",
-						policy, chain, line,
-						ip6tc_strerror(errno));
-			}
-
-			ret = 1;
-
-		} else if (in_table) {
-			int a;
-			char *ptr = buffer;
-			char *pcnt = NULL;
-			char *bcnt = NULL;
-			char *parsestart;
-
-			/* the parser */
-			char *curchar;
-			int quote_open, escaped;
-			size_t param_len;
-
-			/* reset the newargv */
-			newargc = 0;
-
-			if (buffer[0] == '[') {
-				/* we have counters in our input */
-				ptr = strchr(buffer, ']');
-				if (!ptr)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				pcnt = strtok(buffer+1, ":");
-				if (!pcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need :\n",
-						   line);
-
-				bcnt = strtok(NULL, "]");
-				if (!bcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				/* start command parsing after counter */
-				parsestart = ptr + 1;
-			} else {
-				/* start command parsing at start of line */
-				parsestart = buffer;
-			}
-
-			add_argv(argv[0]);
-			add_argv("-t");
-			add_argv(curtable);
-
-			if (counters && pcnt && bcnt) {
-				add_argv("--set-counters");
-				add_argv((char *) pcnt);
-				add_argv((char *) bcnt);
-			}
-
-			/* After fighting with strtok enough, here's now
-			 * a 'real' parser. According to Rusty I'm now no
-			 * longer a real hacker, but I can live with that */
-
-			quote_open = 0;
-			escaped = 0;
-			param_len = 0;
-
-			for (curchar = parsestart; *curchar; curchar++) {
-				char param_buffer[1024];
-
-				if (quote_open) {
-					if (escaped) {
-						param_buffer[param_len++] = *curchar;
-						escaped = 0;
-						continue;
-					} else if (*curchar == '\\') {
-						escaped = 1;
-						continue;
-					} else if (*curchar == '"') {
-						quote_open = 0;
-						*curchar = ' ';
-					} else {
-						param_buffer[param_len++] = *curchar;
-						continue;
-					}
-				} else {
-					if (*curchar == '"') {
-						quote_open = 1;
-						continue;
-					}
-				}
-
-				if (*curchar == ' '
-				    || *curchar == '\t'
-				    || * curchar == '\n') {
-					if (!param_len) {
-						/* two spaces? */
-						continue;
-					}
-
-					param_buffer[param_len] = '\0';
-
-					/* check if table name specified */
-					if (!strncmp(param_buffer, "-t", 2)
-                                            || !strncmp(param_buffer, "--table", 8)) {
-						xtables_error(PARAMETER_PROBLEM,
-						   "Line %u seems to have a "
-						   "-t table option.\n", line);
-						exit(1);
-					}
-
-					add_argv(param_buffer);
-					param_len = 0;
-				} else {
-					/* regular character, copy to buffer */
-					param_buffer[param_len++] = *curchar;
-
-					if (param_len >= sizeof(param_buffer))
-						xtables_error(PARAMETER_PROBLEM,
-						   "Parameter too long!");
-				}
-			}
-
-			DEBUGP("calling do_command6(%u, argv, &%s, handle):\n",
-				newargc, curtable);
-
-			for (a = 0; a < newargc; a++)
-				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
-
-			ret = do_command6(newargc, newargv,
-					 &newargv[2], &handle);
-
-			free_argv();
-			fflush(stdout);
-		}
-		if (!ret) {
-			fprintf(stderr, "%s: line %u failed\n",
-					ip6tables_globals.program_name,
-					line);
-			exit(1);
-		}
-	}
-	if (in_table) {
-		fprintf(stderr, "%s: COMMIT expected at line %u\n",
-				ip6tables_globals.program_name,
-				line + 1);
-		exit(1);
-	}
-
-	fclose(in);
-	return 0;
-}

=== removed file '.pc/9004-argv-is-null.patch/iptables/iptables-restore.c'
--- .pc/9004-argv-is-null.patch/iptables/iptables-restore.c	2012-07-20 15:45:01 +0000
+++ .pc/9004-argv-is-null.patch/iptables/iptables-restore.c	1970-01-01 00:00:00 +0000
@@ -1,470 +0,0 @@
-/* Code to restore the iptables state, from file by iptables-save.
- * (C) 2000-2002 by Harald Welte <[e-mail]>
- * based on previous code from Rusty Russell <[e-mail]>
- *
- * This code is distributed under the terms of GNU GPL v2
- */
-
-#include <getopt.h>
-#include <sys/errno.h>
-#include <stdbool.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include "iptables.h"
-#include "xtables.h"
-#include "libiptc/libiptc.h"
-#include "iptables-multi.h"
-
-#ifdef DEBUG
-#define DEBUGP(x, args...) fprintf(stderr, x, ## args)
-#else
-#define DEBUGP(x, args...)
-#endif
-
-static int binary = 0, counters = 0, verbose = 0, noflush = 0;
-
-/* Keeping track of external matches and targets.  */
-static const struct option options[] = {
-	{.name = "binary",   .has_arg = false, .val = 'b'},
-	{.name = "counters", .has_arg = false, .val = 'c'},
-	{.name = "verbose",  .has_arg = false, .val = 'v'},
-	{.name = "test",     .has_arg = false, .val = 't'},
-	{.name = "help",     .has_arg = false, .val = 'h'},
-	{.name = "noflush",  .has_arg = false, .val = 'n'},
-	{.name = "modprobe", .has_arg = true,  .val = 'M'},
-	{.name = "table",    .has_arg = true,  .val = 'T'},
-	{NULL},
-};
-
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
-#define prog_name iptables_globals.program_name
-
-static void print_usage(const char *name, const char *version)
-{
-	fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-t] [-h]\n"
-			"	   [ --binary ]\n"
-			"	   [ --counters ]\n"
-			"	   [ --verbose ]\n"
-			"	   [ --test ]\n"
-			"	   [ --help ]\n"
-			"	   [ --noflush ]\n"
-			"	   [ --table=<TABLE> ]\n"
-			"          [ --modprobe=<command>]\n", name);
-
-	exit(1);
-}
-
-static struct iptc_handle *create_handle(const char *tablename)
-{
-	struct iptc_handle *handle;
-
-	handle = iptc_init(tablename);
-
-	if (!handle) {
-		/* try to insmod the module if iptc_init failed */
-		xtables_load_ko(xtables_modprobe_program, false);
-		handle = iptc_init(tablename);
-	}
-
-	if (!handle) {
-		xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
-			"table '%s'\n", prog_name, tablename);
-		exit(1);
-	}
-	return handle;
-}
-
-static int parse_counters(char *string, struct ipt_counters *ctr)
-{
-	unsigned long long pcnt, bcnt;
-	int ret;
-
-	ret = sscanf(string, "[%llu:%llu]", &pcnt, &bcnt);
-	ctr->pcnt = pcnt;
-	ctr->bcnt = bcnt;
-	return ret == 2;
-}
-
-/* global new argv and argc */
-static char *newargv[255];
-static int newargc;
-
-/* function adding one argument to newargv, updating newargc 
- * returns true if argument added, false otherwise */
-static int add_argv(char *what) {
-	DEBUGP("add_argv: %s\n", what);
-	if (what && newargc + 1 < ARRAY_SIZE(newargv)) {
-		newargv[newargc] = strdup(what);
-		newargc++;
-		return 1;
-	} else {
-		xtables_error(PARAMETER_PROBLEM,
-			"Parser cannot handle more arguments\n");
-		return 0;
-	}
-}
-
-static void free_argv(void) {
-	int i;
-
-	for (i = 0; i < newargc; i++)
-		free(newargv[i]);
-}
-
-#ifdef IPTABLES_MULTI
-int
-iptables_restore_main(int argc, char *argv[])
-#else
-int
-main(int argc, char *argv[])
-#endif
-{
-	struct iptc_handle *handle = NULL;
-	char buffer[10240];
-	int c;
-	char curtable[IPT_TABLE_MAXNAMELEN + 1];
-	FILE *in;
-	int in_table = 0, testing = 0;
-	const char *tablename = NULL;
-
-	line = 0;
-
-	iptables_globals.program_name = "iptables-restore";
-	c = xtables_init_all(&iptables_globals, NFPROTO_IPV4);
-	if (c < 0) {
-		fprintf(stderr, "%s/%s Failed to initialize xtables\n",
-				iptables_globals.program_name,
-				iptables_globals.program_version);
-		exit(1);
-	}
-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-	init_extensions();
-	init_extensions4();
-#endif
-
-	while ((c = getopt_long(argc, argv, "bcvthnM:T:", options, NULL)) != -1) {
-		switch (c) {
-			case 'b':
-				binary = 1;
-				break;
-			case 'c':
-				counters = 1;
-				break;
-			case 'v':
-				verbose = 1;
-				break;
-			case 't':
-				testing = 1;
-				break;
-			case 'h':
-				print_usage("iptables-restore",
-					    IPTABLES_VERSION);
-				break;
-			case 'n':
-				noflush = 1;
-				break;
-			case 'M':
-				xtables_modprobe_program = optarg;
-				break;
-			case 'T':
-				tablename = optarg;
-				break;
-		}
-	}
-
-	if (optind == argc - 1) {
-		in = fopen(argv[optind], "re");
-		if (!in) {
-			fprintf(stderr, "Can't open %s: %s\n", argv[optind],
-				strerror(errno));
-			exit(1);
-		}
-	}
-	else if (optind < argc) {
-		fprintf(stderr, "Unknown arguments found on commandline\n");
-		exit(1);
-	}
-	else in = stdin;
-
-	/* Grab standard input. */
-	while (fgets(buffer, sizeof(buffer), in)) {
-		int ret = 0;
-
-		line++;
-		if (buffer[0] == '\n')
-			continue;
-		else if (buffer[0] == '#') {
-			if (verbose)
-				fputs(buffer, stdout);
-			continue;
-		} else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
-			if (!testing) {
-				DEBUGP("Calling commit\n");
-				ret = iptc_commit(handle);
-				iptc_free(handle);
-				handle = NULL;
-			} else {
-				DEBUGP("Not calling commit, testing\n");
-				ret = 1;
-			}
-			in_table = 0;
-		} else if ((buffer[0] == '*') && (!in_table)) {
-			/* New table */
-			char *table;
-
-			table = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, table '%s'\n", line, table);
-			if (!table) {
-				xtables_error(PARAMETER_PROBLEM,
-					"%s: line %u table name invalid\n",
-					prog_name, line);
-				exit(1);
-			}
-			strncpy(curtable, table, IPT_TABLE_MAXNAMELEN);
-			curtable[IPT_TABLE_MAXNAMELEN] = '\0';
-
-			if (tablename && (strcmp(tablename, table) != 0))
-				continue;
-			if (handle)
-				iptc_free(handle);
-
-			handle = create_handle(table);
-			if (noflush == 0) {
-				DEBUGP("Cleaning all chains of table '%s'\n",
-					table);
-				for_each_chain4(flush_entries4, verbose, 1,
-						handle);
-
-				DEBUGP("Deleting all user-defined chains "
-				       "of table '%s'\n", table);
-				for_each_chain4(delete_chain4, verbose, 0,
-						handle);
-			}
-
-			ret = 1;
-			in_table = 1;
-
-		} else if ((buffer[0] == ':') && (in_table)) {
-			/* New chain. */
-			char *policy, *chain;
-
-			chain = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, chain '%s'\n", line, chain);
-			if (!chain) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u chain name invalid\n",
-					   prog_name, line);
-				exit(1);
-			}
-
-			if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
-				xtables_error(PARAMETER_PROBLEM,
-					   "Invalid chain name `%s' "
-					   "(%u chars max)",
-					   chain, XT_EXTENSION_MAXNAMELEN - 1);
-
-			if (iptc_builtin(chain, handle) <= 0) {
-				if (noflush && iptc_is_chain(chain, handle)) {
-					DEBUGP("Flushing existing user defined chain '%s'\n", chain);
-					if (!iptc_flush_entries(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error flushing chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				} else {
-					DEBUGP("Creating new chain '%s'\n", chain);
-					if (!iptc_create_chain(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error creating chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				}
-			}
-
-			policy = strtok(NULL, " \t\n");
-			DEBUGP("line %u, policy '%s'\n", line, policy);
-			if (!policy) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u policy invalid\n",
-					   prog_name, line);
-				exit(1);
-			}
-
-			if (strcmp(policy, "-") != 0) {
-				struct ipt_counters count;
-
-				if (counters) {
-					char *ctrs;
-					ctrs = strtok(NULL, " \t\n");
-
-					if (!ctrs || !parse_counters(ctrs, &count))
-						xtables_error(PARAMETER_PROBLEM,
-							   "invalid policy counters "
-							   "for chain '%s'\n", chain);
-
-				} else {
-					memset(&count, 0,
-					       sizeof(struct ipt_counters));
-				}
-
-				DEBUGP("Setting policy of chain %s to %s\n",
-					chain, policy);
-
-				if (!iptc_set_policy(chain, policy, &count,
-						     handle))
-					xtables_error(OTHER_PROBLEM,
-						"Can't set policy `%s'"
-						" on `%s' line %u: %s\n",
-						policy, chain, line,
-						iptc_strerror(errno));
-			}
-
-			ret = 1;
-
-		} else if (in_table) {
-			int a;
-			char *ptr = buffer;
-			char *pcnt = NULL;
-			char *bcnt = NULL;
-			char *parsestart;
-
-			/* the parser */
-			char *curchar;
-			int quote_open, escaped;
-			size_t param_len;
-
-			/* reset the newargv */
-			newargc = 0;
-
-			if (buffer[0] == '[') {
-				/* we have counters in our input */
-				ptr = strchr(buffer, ']');
-				if (!ptr)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				pcnt = strtok(buffer+1, ":");
-				if (!pcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need :\n",
-						   line);
-
-				bcnt = strtok(NULL, "]");
-				if (!bcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				/* start command parsing after counter */
-				parsestart = ptr + 1;
-			} else {
-				/* start command parsing at start of line */
-				parsestart = buffer;
-			}
-
-			add_argv(argv[0]);
-			add_argv("-t");
-			add_argv(curtable);
-
-			if (counters && pcnt && bcnt) {
-				add_argv("--set-counters");
-				add_argv((char *) pcnt);
-				add_argv((char *) bcnt);
-			}
-
-			/* After fighting with strtok enough, here's now
-			 * a 'real' parser. According to Rusty I'm now no
-			 * longer a real hacker, but I can live with that */
-
-			quote_open = 0;
-			escaped = 0;
-			param_len = 0;
-
-			for (curchar = parsestart; *curchar; curchar++) {
-				char param_buffer[1024];
-
-				if (quote_open) {
-					if (escaped) {
-						param_buffer[param_len++] = *curchar;
-						escaped = 0;
-						continue;
-					} else if (*curchar == '\\') {
-						escaped = 1;
-						continue;
-					} else if (*curchar == '"') {
-						quote_open = 0;
-						*curchar = ' ';
-					} else {
-						param_buffer[param_len++] = *curchar;
-						continue;
-					}
-				} else {
-					if (*curchar == '"') {
-						quote_open = 1;
-						continue;
-					}
-				}
-
-				if (*curchar == ' '
-				    || *curchar == '\t'
-				    || * curchar == '\n') {
-					if (!param_len) {
-						/* two spaces? */
-						continue;
-					}
-
-					param_buffer[param_len] = '\0';
-
-					/* check if table name specified */
-					if (!strncmp(param_buffer, "-t", 2)
-					    || !strncmp(param_buffer, "--table", 8)) {
-						xtables_error(PARAMETER_PROBLEM,
-						   "Line %u seems to have a "
-						   "-t table option.\n", line);
-						exit(1);
-					}
-
-					add_argv(param_buffer);
-					param_len = 0;
-				} else {
-					/* regular character, copy to buffer */
-					param_buffer[param_len++] = *curchar;
-
-					if (param_len >= sizeof(param_buffer))
-						xtables_error(PARAMETER_PROBLEM,
-						   "Parameter too long!");
-				}
-			}
-
-			DEBUGP("calling do_command4(%u, argv, &%s, handle):\n",
-				newargc, curtable);
-
-			for (a = 0; a < newargc; a++)
-				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
-
-			ret = do_command4(newargc, newargv,
-					 &newargv[2], &handle);
-
-			free_argv();
-			fflush(stdout);
-		}
-		if (tablename && (strcmp(tablename, curtable) != 0))
-			continue;
-		if (!ret) {
-			fprintf(stderr, "%s: line %u failed\n",
-					prog_name, line);
-			exit(1);
-		}
-	}
-	if (in_table) {
-		fprintf(stderr, "%s: COMMIT expected at line %u\n",
-				prog_name, line + 1);
-		exit(1);
-	}
-
-	fclose(in);
-	return 0;
-}

=== removed directory '.pc/9005-lp1027252-fixrestore.patch'
=== removed directory '.pc/9005-lp1027252-fixrestore.patch/iptables'
=== removed file '.pc/9005-lp1027252-fixrestore.patch/iptables/ip6tables-restore.c'
--- .pc/9005-lp1027252-fixrestore.patch/iptables/ip6tables-restore.c	2012-07-20 15:45:01 +0000
+++ .pc/9005-lp1027252-fixrestore.patch/iptables/ip6tables-restore.c	1970-01-01 00:00:00 +0000
@@ -1,465 +0,0 @@
-/* Code to restore the iptables state, from file by ip6tables-save.
- * Author:  Andras Kis-Szabo <[e-mail]>
- *
- * based on iptables-restore
- * Authors:
- *      Harald Welte <[e-mail]>
- *      Rusty Russell <[e-mail]>
- * This code is distributed under the terms of GNU GPL v2
- */
-
-#include <getopt.h>
-#include <sys/errno.h>
-#include <stdbool.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include "ip6tables.h"
-#include "xtables.h"
-#include "libiptc/libip6tc.h"
-#include "ip6tables-multi.h"
-
-#ifdef DEBUG
-#define DEBUGP(x, args...) fprintf(stderr, x, ## args)
-#else
-#define DEBUGP(x, args...)
-#endif
-
-static int binary = 0, counters = 0, verbose = 0, noflush = 0;
-
-/* Keeping track of external matches and targets.  */
-static const struct option options[] = {
-	{.name = "binary",   .has_arg = false, .val = 'b'},
-	{.name = "counters", .has_arg = false, .val = 'c'},
-	{.name = "verbose",  .has_arg = false, .val = 'v'},
-	{.name = "test",     .has_arg = false, .val = 't'},
-	{.name = "help",     .has_arg = false, .val = 'h'},
-	{.name = "noflush",  .has_arg = false, .val = 'n'},
-	{.name = "modprobe", .has_arg = true,  .val = 'M'},
-	{NULL},
-};
-
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
-static void print_usage(const char *name, const char *version)
-{
-	fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-t] [-h]\n"
-			"	   [ --binary ]\n"
-			"	   [ --counters ]\n"
-			"	   [ --verbose ]\n"
-			"	   [ --test ]\n"
-			"	   [ --help ]\n"
-			"	   [ --noflush ]\n"
-			"          [ --modprobe=<command>]\n", name);
-
-	exit(1);
-}
-
-static struct ip6tc_handle *create_handle(const char *tablename)
-{
-	struct ip6tc_handle *handle;
-
-	handle = ip6tc_init(tablename);
-
-	if (!handle) {
-		/* try to insmod the module if iptc_init failed */
-		xtables_load_ko(xtables_modprobe_program, false);
-		handle = ip6tc_init(tablename);
-	}
-
-	if (!handle) {
-		xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
-			"table '%s'\n", ip6tables_globals.program_name,
-			tablename);
-		exit(1);
-	}
-	return handle;
-}
-
-static int parse_counters(char *string, struct ip6t_counters *ctr)
-{
-	unsigned long long pcnt, bcnt;
-	int ret;
-
-	ret = sscanf(string, "[%llu:%llu]", &pcnt, &bcnt);
-	ctr->pcnt = pcnt;
-	ctr->bcnt = bcnt;
-	return ret == 2;
-}
-
-/* global new argv and argc */
-static char *newargv[255];
-static int newargc;
-
-/* function adding one argument to newargv, updating newargc
- * returns true if argument added, false otherwise */
-static int add_argv(char *what) {
-	DEBUGP("add_argv: %s\n", what);
-	if (what && newargc + 1 < ARRAY_SIZE(newargv)) {
-		newargv[newargc] = strdup(what);
-		newargv[++newargc] = NULL;
-		return 1;
-	} else {
-		xtables_error(PARAMETER_PROBLEM,
-			"Parser cannot handle more arguments\n");
-		return 0;
-	}
-}
-
-static void free_argv(void) {
-	int i;
-
-	for (i = 0; i < newargc; i++)
-		free(newargv[i]);
-}
-
-#ifdef IPTABLES_MULTI
-int ip6tables_restore_main(int argc, char *argv[])
-#else
-int main(int argc, char *argv[])
-#endif
-{
-	struct ip6tc_handle *handle = NULL;
-	char buffer[10240];
-	int c;
-	char curtable[IP6T_TABLE_MAXNAMELEN + 1];
-	FILE *in;
-	int in_table = 0, testing = 0;
-
-	line = 0;
-
-	ip6tables_globals.program_name = "ip6tables-restore";
-	c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6);
-	if (c < 0) {
-		fprintf(stderr, "%s/%s Failed to initialize xtables\n",
-				ip6tables_globals.program_name,
-				ip6tables_globals.program_version);
-		exit(1);
-	}
-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-	init_extensions();
-	init_extensions6();
-#endif
-
-	while ((c = getopt_long(argc, argv, "bcvthnM:", options, NULL)) != -1) {
-		switch (c) {
-			case 'b':
-				binary = 1;
-				break;
-			case 'c':
-				counters = 1;
-				break;
-			case 'v':
-				verbose = 1;
-				break;
-			case 't':
-				testing = 1;
-				break;
-			case 'h':
-				print_usage("ip6tables-restore",
-					    IPTABLES_VERSION);
-				break;
-			case 'n':
-				noflush = 1;
-				break;
-			case 'M':
-				xtables_modprobe_program = optarg;
-				break;
-		}
-	}
-
-	if (optind == argc - 1) {
-		in = fopen(argv[optind], "re");
-		if (!in) {
-			fprintf(stderr, "Can't open %s: %s\n", argv[optind],
-				strerror(errno));
-			exit(1);
-		}
-	}
-	else if (optind < argc) {
-		fprintf(stderr, "Unknown arguments found on commandline\n");
-		exit(1);
-	}
-	else in = stdin;
-
-	/* Grab standard input. */
-	while (fgets(buffer, sizeof(buffer), in)) {
-		int ret = 0;
-
-		line++;
-		if (buffer[0] == '\n')
-			continue;
-		else if (buffer[0] == '#') {
-			if (verbose)
-				fputs(buffer, stdout);
-			continue;
-		} else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
-			if (!testing) {
-				DEBUGP("Calling commit\n");
-				ret = ip6tc_commit(handle);
-				ip6tc_free(handle);
-				handle = NULL;
-			} else {
-				DEBUGP("Not calling commit, testing\n");
-				ret = 1;
-			}
-			in_table = 0;
-		} else if ((buffer[0] == '*') && (!in_table)) {
-			/* New table */
-			char *table;
-
-			table = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, table '%s'\n", line, table);
-			if (!table) {
-				xtables_error(PARAMETER_PROBLEM,
-					"%s: line %u table name invalid\n",
-					ip6tables_globals.program_name,
-					line);
-				exit(1);
-			}
-			strncpy(curtable, table, IP6T_TABLE_MAXNAMELEN);
-			curtable[IP6T_TABLE_MAXNAMELEN] = '\0';
-
-			if (handle)
-				ip6tc_free(handle);
-
-			handle = create_handle(table);
-			if (noflush == 0) {
-				DEBUGP("Cleaning all chains of table '%s'\n",
-					table);
-				for_each_chain6(flush_entries6, verbose, 1,
-						handle);
-
-				DEBUGP("Deleting all user-defined chains "
-				       "of table '%s'\n", table);
-				for_each_chain6(delete_chain6, verbose, 0,
-						handle);
-			}
-
-			ret = 1;
-			in_table = 1;
-
-		} else if ((buffer[0] == ':') && (in_table)) {
-			/* New chain. */
-			char *policy, *chain;
-
-			chain = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, chain '%s'\n", line, chain);
-			if (!chain) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u chain name invalid\n",
-					   ip6tables_globals.program_name,
-					   line);
-				exit(1);
-			}
-
-			if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
-				xtables_error(PARAMETER_PROBLEM,
-					   "Invalid chain name `%s' "
-					   "(%u chars max)",
-					   chain, XT_EXTENSION_MAXNAMELEN - 1);
-
-			if (ip6tc_builtin(chain, handle) <= 0) {
-				if (noflush && ip6tc_is_chain(chain, handle)) {
-					DEBUGP("Flushing existing user defined chain '%s'\n", chain);
-					if (!ip6tc_flush_entries(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error flushing chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				} else {
-					DEBUGP("Creating new chain '%s'\n", chain);
-					if (!ip6tc_create_chain(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error creating chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				}
-			}
-
-			policy = strtok(NULL, " \t\n");
-			DEBUGP("line %u, policy '%s'\n", line, policy);
-			if (!policy) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u policy invalid\n",
-					   ip6tables_globals.program_name,
-					   line);
-				exit(1);
-			}
-
-			if (strcmp(policy, "-") != 0) {
-				struct ip6t_counters count;
-
-				if (counters) {
-					char *ctrs;
-					ctrs = strtok(NULL, " \t\n");
-
-					if (!ctrs || !parse_counters(ctrs, &count))
-						xtables_error(PARAMETER_PROBLEM,
-							  "invalid policy counters "
-							  "for chain '%s'\n", chain);
-
-				} else {
-					memset(&count, 0,
-					       sizeof(struct ip6t_counters));
-				}
-
-				DEBUGP("Setting policy of chain %s to %s\n",
-					chain, policy);
-
-				if (!ip6tc_set_policy(chain, policy, &count,
-						     handle))
-					xtables_error(OTHER_PROBLEM,
-						"Can't set policy `%s'"
-						" on `%s' line %u: %s\n",
-						policy, chain, line,
-						ip6tc_strerror(errno));
-			}
-
-			ret = 1;
-
-		} else if (in_table) {
-			int a;
-			char *ptr = buffer;
-			char *pcnt = NULL;
-			char *bcnt = NULL;
-			char *parsestart;
-
-			/* the parser */
-			char *curchar;
-			int quote_open, escaped;
-			size_t param_len;
-
-			/* reset the newargv */
-			newargc = 0;
-
-			if (buffer[0] == '[') {
-				/* we have counters in our input */
-				ptr = strchr(buffer, ']');
-				if (!ptr)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				pcnt = strtok(buffer+1, ":");
-				if (!pcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need :\n",
-						   line);
-
-				bcnt = strtok(NULL, "]");
-				if (!bcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				/* start command parsing after counter */
-				parsestart = ptr + 1;
-			} else {
-				/* start command parsing at start of line */
-				parsestart = buffer;
-			}
-
-			add_argv(argv[0]);
-			add_argv("-t");
-			add_argv(curtable);
-
-			if (counters && pcnt && bcnt) {
-				add_argv("--set-counters");
-				add_argv((char *) pcnt);
-				add_argv((char *) bcnt);
-			}
-
-			/* After fighting with strtok enough, here's now
-			 * a 'real' parser. According to Rusty I'm now no
-			 * longer a real hacker, but I can live with that */
-
-			quote_open = 0;
-			escaped = 0;
-			param_len = 0;
-
-			for (curchar = parsestart; *curchar; curchar++) {
-				char param_buffer[1024];
-
-				if (quote_open) {
-					if (escaped) {
-						param_buffer[param_len++] = *curchar;
-						escaped = 0;
-						continue;
-					} else if (*curchar == '\\') {
-						escaped = 1;
-						continue;
-					} else if (*curchar == '"') {
-						quote_open = 0;
-						*curchar = ' ';
-					} else {
-						param_buffer[param_len++] = *curchar;
-						continue;
-					}
-				} else {
-					if (*curchar == '"') {
-						quote_open = 1;
-						continue;
-					}
-				}
-
-				if (*curchar == ' '
-				    || *curchar == '\t'
-				    || * curchar == '\n') {
-					if (!param_len) {
-						/* two spaces? */
-						continue;
-					}
-
-					param_buffer[param_len] = '\0';
-
-					/* check if table name specified */
-					if (!strncmp(param_buffer, "-t", 2)
-                                            || !strncmp(param_buffer, "--table", 8)) {
-						xtables_error(PARAMETER_PROBLEM,
-						   "Line %u seems to have a "
-						   "-t table option.\n", line);
-						exit(1);
-					}
-
-					add_argv(param_buffer);
-					param_len = 0;
-				} else {
-					/* regular character, copy to buffer */
-					param_buffer[param_len++] = *curchar;
-
-					if (param_len >= sizeof(param_buffer))
-						xtables_error(PARAMETER_PROBLEM,
-						   "Parameter too long!");
-				}
-			}
-
-			DEBUGP("calling do_command6(%u, argv, &%s, handle):\n",
-				newargc, curtable);
-
-			for (a = 0; a < newargc; a++)
-				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
-
-			ret = do_command6(newargc, newargv,
-					 &newargv[2], &handle);
-
-			free_argv();
-			fflush(stdout);
-		}
-		if (!ret) {
-			fprintf(stderr, "%s: line %u failed\n",
-					ip6tables_globals.program_name,
-					line);
-			exit(1);
-		}
-	}
-	if (in_table) {
-		fprintf(stderr, "%s: COMMIT expected at line %u\n",
-				ip6tables_globals.program_name,
-				line + 1);
-		exit(1);
-	}
-
-	fclose(in);
-	return 0;
-}

=== removed file '.pc/9005-lp1027252-fixrestore.patch/iptables/iptables-restore.c'
--- .pc/9005-lp1027252-fixrestore.patch/iptables/iptables-restore.c	2012-07-20 15:45:01 +0000
+++ .pc/9005-lp1027252-fixrestore.patch/iptables/iptables-restore.c	1970-01-01 00:00:00 +0000
@@ -1,470 +0,0 @@
-/* Code to restore the iptables state, from file by iptables-save.
- * (C) 2000-2002 by Harald Welte <[e-mail]>
- * based on previous code from Rusty Russell <[e-mail]>
- *
- * This code is distributed under the terms of GNU GPL v2
- */
-
-#include <getopt.h>
-#include <sys/errno.h>
-#include <stdbool.h>
-#include <string.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include "iptables.h"
-#include "xtables.h"
-#include "libiptc/libiptc.h"
-#include "iptables-multi.h"
-
-#ifdef DEBUG
-#define DEBUGP(x, args...) fprintf(stderr, x, ## args)
-#else
-#define DEBUGP(x, args...)
-#endif
-
-static int binary = 0, counters = 0, verbose = 0, noflush = 0;
-
-/* Keeping track of external matches and targets.  */
-static const struct option options[] = {
-	{.name = "binary",   .has_arg = false, .val = 'b'},
-	{.name = "counters", .has_arg = false, .val = 'c'},
-	{.name = "verbose",  .has_arg = false, .val = 'v'},
-	{.name = "test",     .has_arg = false, .val = 't'},
-	{.name = "help",     .has_arg = false, .val = 'h'},
-	{.name = "noflush",  .has_arg = false, .val = 'n'},
-	{.name = "modprobe", .has_arg = true,  .val = 'M'},
-	{.name = "table",    .has_arg = true,  .val = 'T'},
-	{NULL},
-};
-
-static void print_usage(const char *name, const char *version) __attribute__((noreturn));
-
-#define prog_name iptables_globals.program_name
-
-static void print_usage(const char *name, const char *version)
-{
-	fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-t] [-h]\n"
-			"	   [ --binary ]\n"
-			"	   [ --counters ]\n"
-			"	   [ --verbose ]\n"
-			"	   [ --test ]\n"
-			"	   [ --help ]\n"
-			"	   [ --noflush ]\n"
-			"	   [ --table=<TABLE> ]\n"
-			"          [ --modprobe=<command>]\n", name);
-
-	exit(1);
-}
-
-static struct iptc_handle *create_handle(const char *tablename)
-{
-	struct iptc_handle *handle;
-
-	handle = iptc_init(tablename);
-
-	if (!handle) {
-		/* try to insmod the module if iptc_init failed */
-		xtables_load_ko(xtables_modprobe_program, false);
-		handle = iptc_init(tablename);
-	}
-
-	if (!handle) {
-		xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
-			"table '%s'\n", prog_name, tablename);
-		exit(1);
-	}
-	return handle;
-}
-
-static int parse_counters(char *string, struct ipt_counters *ctr)
-{
-	unsigned long long pcnt, bcnt;
-	int ret;
-
-	ret = sscanf(string, "[%llu:%llu]", &pcnt, &bcnt);
-	ctr->pcnt = pcnt;
-	ctr->bcnt = bcnt;
-	return ret == 2;
-}
-
-/* global new argv and argc */
-static char *newargv[255];
-static int newargc;
-
-/* function adding one argument to newargv, updating newargc 
- * returns true if argument added, false otherwise */
-static int add_argv(char *what) {
-	DEBUGP("add_argv: %s\n", what);
-	if (what && newargc + 1 < ARRAY_SIZE(newargv)) {
-		newargv[newargc] = strdup(what);
-		newargv[++newargc] = NULL;
-		return 1;
-	} else {
-		xtables_error(PARAMETER_PROBLEM,
-			"Parser cannot handle more arguments\n");
-		return 0;
-	}
-}
-
-static void free_argv(void) {
-	int i;
-
-	for (i = 0; i < newargc; i++)
-		free(newargv[i]);
-}
-
-#ifdef IPTABLES_MULTI
-int
-iptables_restore_main(int argc, char *argv[])
-#else
-int
-main(int argc, char *argv[])
-#endif
-{
-	struct iptc_handle *handle = NULL;
-	char buffer[10240];
-	int c;
-	char curtable[IPT_TABLE_MAXNAMELEN + 1];
-	FILE *in;
-	int in_table = 0, testing = 0;
-	const char *tablename = NULL;
-
-	line = 0;
-
-	iptables_globals.program_name = "iptables-restore";
-	c = xtables_init_all(&iptables_globals, NFPROTO_IPV4);
-	if (c < 0) {
-		fprintf(stderr, "%s/%s Failed to initialize xtables\n",
-				iptables_globals.program_name,
-				iptables_globals.program_version);
-		exit(1);
-	}
-#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
-	init_extensions();
-	init_extensions4();
-#endif
-
-	while ((c = getopt_long(argc, argv, "bcvthnM:T:", options, NULL)) != -1) {
-		switch (c) {
-			case 'b':
-				binary = 1;
-				break;
-			case 'c':
-				counters = 1;
-				break;
-			case 'v':
-				verbose = 1;
-				break;
-			case 't':
-				testing = 1;
-				break;
-			case 'h':
-				print_usage("iptables-restore",
-					    IPTABLES_VERSION);
-				break;
-			case 'n':
-				noflush = 1;
-				break;
-			case 'M':
-				xtables_modprobe_program = optarg;
-				break;
-			case 'T':
-				tablename = optarg;
-				break;
-		}
-	}
-
-	if (optind == argc - 1) {
-		in = fopen(argv[optind], "re");
-		if (!in) {
-			fprintf(stderr, "Can't open %s: %s\n", argv[optind],
-				strerror(errno));
-			exit(1);
-		}
-	}
-	else if (optind < argc) {
-		fprintf(stderr, "Unknown arguments found on commandline\n");
-		exit(1);
-	}
-	else in = stdin;
-
-	/* Grab standard input. */
-	while (fgets(buffer, sizeof(buffer), in)) {
-		int ret = 0;
-
-		line++;
-		if (buffer[0] == '\n')
-			continue;
-		else if (buffer[0] == '#') {
-			if (verbose)
-				fputs(buffer, stdout);
-			continue;
-		} else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
-			if (!testing) {
-				DEBUGP("Calling commit\n");
-				ret = iptc_commit(handle);
-				iptc_free(handle);
-				handle = NULL;
-			} else {
-				DEBUGP("Not calling commit, testing\n");
-				ret = 1;
-			}
-			in_table = 0;
-		} else if ((buffer[0] == '*') && (!in_table)) {
-			/* New table */
-			char *table;
-
-			table = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, table '%s'\n", line, table);
-			if (!table) {
-				xtables_error(PARAMETER_PROBLEM,
-					"%s: line %u table name invalid\n",
-					prog_name, line);
-				exit(1);
-			}
-			strncpy(curtable, table, IPT_TABLE_MAXNAMELEN);
-			curtable[IPT_TABLE_MAXNAMELEN] = '\0';
-
-			if (tablename && (strcmp(tablename, table) != 0))
-				continue;
-			if (handle)
-				iptc_free(handle);
-
-			handle = create_handle(table);
-			if (noflush == 0) {
-				DEBUGP("Cleaning all chains of table '%s'\n",
-					table);
-				for_each_chain4(flush_entries4, verbose, 1,
-						handle);
-
-				DEBUGP("Deleting all user-defined chains "
-				       "of table '%s'\n", table);
-				for_each_chain4(delete_chain4, verbose, 0,
-						handle);
-			}
-
-			ret = 1;
-			in_table = 1;
-
-		} else if ((buffer[0] == ':') && (in_table)) {
-			/* New chain. */
-			char *policy, *chain;
-
-			chain = strtok(buffer+1, " \t\n");
-			DEBUGP("line %u, chain '%s'\n", line, chain);
-			if (!chain) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u chain name invalid\n",
-					   prog_name, line);
-				exit(1);
-			}
-
-			if (strlen(chain) >= XT_EXTENSION_MAXNAMELEN)
-				xtables_error(PARAMETER_PROBLEM,
-					   "Invalid chain name `%s' "
-					   "(%u chars max)",
-					   chain, XT_EXTENSION_MAXNAMELEN - 1);
-
-			if (iptc_builtin(chain, handle) <= 0) {
-				if (noflush && iptc_is_chain(chain, handle)) {
-					DEBUGP("Flushing existing user defined chain '%s'\n", chain);
-					if (!iptc_flush_entries(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error flushing chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				} else {
-					DEBUGP("Creating new chain '%s'\n", chain);
-					if (!iptc_create_chain(chain, handle))
-						xtables_error(PARAMETER_PROBLEM,
-							   "error creating chain "
-							   "'%s':%s\n", chain,
-							   strerror(errno));
-				}
-			}
-
-			policy = strtok(NULL, " \t\n");
-			DEBUGP("line %u, policy '%s'\n", line, policy);
-			if (!policy) {
-				xtables_error(PARAMETER_PROBLEM,
-					   "%s: line %u policy invalid\n",
-					   prog_name, line);
-				exit(1);
-			}
-
-			if (strcmp(policy, "-") != 0) {
-				struct ipt_counters count;
-
-				if (counters) {
-					char *ctrs;
-					ctrs = strtok(NULL, " \t\n");
-
-					if (!ctrs || !parse_counters(ctrs, &count))
-						xtables_error(PARAMETER_PROBLEM,
-							   "invalid policy counters "
-							   "for chain '%s'\n", chain);
-
-				} else {
-					memset(&count, 0,
-					       sizeof(struct ipt_counters));
-				}
-
-				DEBUGP("Setting policy of chain %s to %s\n",
-					chain, policy);
-
-				if (!iptc_set_policy(chain, policy, &count,
-						     handle))
-					xtables_error(OTHER_PROBLEM,
-						"Can't set policy `%s'"
-						" on `%s' line %u: %s\n",
-						policy, chain, line,
-						iptc_strerror(errno));
-			}
-
-			ret = 1;
-
-		} else if (in_table) {
-			int a;
-			char *ptr = buffer;
-			char *pcnt = NULL;
-			char *bcnt = NULL;
-			char *parsestart;
-
-			/* the parser */
-			char *curchar;
-			int quote_open, escaped;
-			size_t param_len;
-
-			/* reset the newargv */
-			newargc = 0;
-
-			if (buffer[0] == '[') {
-				/* we have counters in our input */
-				ptr = strchr(buffer, ']');
-				if (!ptr)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				pcnt = strtok(buffer+1, ":");
-				if (!pcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need :\n",
-						   line);
-
-				bcnt = strtok(NULL, "]");
-				if (!bcnt)
-					xtables_error(PARAMETER_PROBLEM,
-						   "Bad line %u: need ]\n",
-						   line);
-
-				/* start command parsing after counter */
-				parsestart = ptr + 1;
-			} else {
-				/* start command parsing at start of line */
-				parsestart = buffer;
-			}
-
-			add_argv(argv[0]);
-			add_argv("-t");
-			add_argv(curtable);
-
-			if (counters && pcnt && bcnt) {
-				add_argv("--set-counters");
-				add_argv((char *) pcnt);
-				add_argv((char *) bcnt);
-			}
-
-			/* After fighting with strtok enough, here's now
-			 * a 'real' parser. According to Rusty I'm now no
-			 * longer a real hacker, but I can live with that */
-
-			quote_open = 0;
-			escaped = 0;
-			param_len = 0;
-
-			for (curchar = parsestart; *curchar; curchar++) {
-				char param_buffer[1024];
-
-				if (quote_open) {
-					if (escaped) {
-						param_buffer[param_len++] = *curchar;
-						escaped = 0;
-						continue;
-					} else if (*curchar == '\\') {
-						escaped = 1;
-						continue;
-					} else if (*curchar == '"') {
-						quote_open = 0;
-						*curchar = ' ';
-					} else {
-						param_buffer[param_len++] = *curchar;
-						continue;
-					}
-				} else {
-					if (*curchar == '"') {
-						quote_open = 1;
-						continue;
-					}
-				}
-
-				if (*curchar == ' '
-				    || *curchar == '\t'
-				    || * curchar == '\n') {
-					if (!param_len) {
-						/* two spaces? */
-						continue;
-					}
-
-					param_buffer[param_len] = '\0';
-
-					/* check if table name specified */
-					if (!strncmp(param_buffer, "-t", 2)
-					    || !strncmp(param_buffer, "--table", 8)) {
-						xtables_error(PARAMETER_PROBLEM,
-						   "Line %u seems to have a "
-						   "-t table option.\n", line);
-						exit(1);
-					}
-
-					add_argv(param_buffer);
-					param_len = 0;
-				} else {
-					/* regular character, copy to buffer */
-					param_buffer[param_len++] = *curchar;
-
-					if (param_len >= sizeof(param_buffer))
-						xtables_error(PARAMETER_PROBLEM,
-						   "Parameter too long!");
-				}
-			}
-
-			DEBUGP("calling do_command4(%u, argv, &%s, handle):\n",
-				newargc, curtable);
-
-			for (a = 0; a < newargc; a++)
-				DEBUGP("argv[%u]: %s\n", a, newargv[a]);
-
-			ret = do_command4(newargc, newargv,
-					 &newargv[2], &handle);
-
-			free_argv();
-			fflush(stdout);
-		}
-		if (tablename && (strcmp(tablename, curtable) != 0))
-			continue;
-		if (!ret) {
-			fprintf(stderr, "%s: line %u failed\n",
-					prog_name, line);
-			exit(1);
-		}
-	}
-	if (in_table) {
-		fprintf(stderr, "%s: COMMIT expected at line %u\n",
-				prog_name, line + 1);
-		exit(1);
-	}
-
-	fclose(in);
-	return 0;
-}

=== removed directory '.pc/9006-lp1042260-fix-inverted-physdev.patch'
=== removed directory '.pc/9006-lp1042260-fix-inverted-physdev.patch/extensions'
=== removed file '.pc/9006-lp1042260-fix-inverted-physdev.patch/extensions/libxt_physdev.c'
--- .pc/9006-lp1042260-fix-inverted-physdev.patch/extensions/libxt_physdev.c	2012-09-17 17:10:24 +0000
+++ .pc/9006-lp1042260-fix-inverted-physdev.patch/extensions/libxt_physdev.c	1970-01-01 00:00:00 +0000
@@ -1,148 +0,0 @@
-#include <stdio.h>
-#include <xtables.h>
-#include <linux/netfilter/xt_physdev.h>
-
-enum {
-	O_PHYSDEV_IN = 0,
-	O_PHYSDEV_OUT,
-	O_PHYSDEV_IS_IN,
-	O_PHYSDEV_IS_OUT,
-	O_PHYSDEV_IS_BRIDGED,
-};
-
-static void physdev_help(void)
-{
-	printf(
-"physdev match options:\n"
-" [!] --physdev-in inputname[+]		bridge port name ([+] for wildcard)\n"
-" [!] --physdev-out outputname[+]	bridge port name ([+] for wildcard)\n"
-" [!] --physdev-is-in			arrived on a bridge device\n"
-" [!] --physdev-is-out			will leave on a bridge device\n"
-" [!] --physdev-is-bridged		it's a bridged packet\n");
-}
-
-#define s struct xt_physdev_info
-static const struct xt_option_entry physdev_opts[] = {
-	{.name = "physdev-in", .id = O_PHYSDEV_IN, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, physindev)},
-	{.name = "physdev-out", .id = O_PHYSDEV_OUT, .type = XTTYPE_STRING,
-	 .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, physoutdev)},
-	{.name = "physdev-is-in", .id = O_PHYSDEV_IS_IN, .type = XTTYPE_NONE},
-	{.name = "physdev-is-out", .id = O_PHYSDEV_IS_OUT,
-	 .type = XTTYPE_NONE},
-	{.name = "physdev-is-bridged", .id = O_PHYSDEV_IS_BRIDGED,
-	 .type = XTTYPE_NONE},
-	XTOPT_TABLEEND,
-};
-#undef s
-
-static void physdev_parse(struct xt_option_call *cb)
-{
-	struct xt_physdev_info *info = cb->data;
-
-	xtables_option_parse(cb);
-	switch (cb->entry->id) {
-	case O_PHYSDEV_IN:
-		xtables_parse_interface(cb->arg, info->physindev,
-				(unsigned char *)info->in_mask);
-		if (cb->invert)
-			info->invert |= XT_PHYSDEV_OP_IN;
-		info->bitmask |= XT_PHYSDEV_OP_IN;
-		break;
-	case O_PHYSDEV_OUT:
-		xtables_parse_interface(cb->arg, info->physoutdev,
-				(unsigned char *)info->out_mask);
-		if (cb->invert)
-			info->invert |= XT_PHYSDEV_OP_OUT;
-		info->bitmask |= XT_PHYSDEV_OP_OUT;
-		break;
-	case O_PHYSDEV_IS_IN:
-		info->bitmask |= XT_PHYSDEV_OP_ISIN;
-		if (cb->invert)
-			info->invert |= XT_PHYSDEV_OP_ISIN;
-		break;
-	case O_PHYSDEV_IS_OUT:
-		info->bitmask |= XT_PHYSDEV_OP_ISOUT;
-		if (cb->invert)
-			info->invert |= XT_PHYSDEV_OP_ISOUT;
-		break;
-	case O_PHYSDEV_IS_BRIDGED:
-		if (cb->invert)
-			info->invert |= XT_PHYSDEV_OP_BRIDGED;
-		info->bitmask |= XT_PHYSDEV_OP_BRIDGED;
-		break;
-	}
-}
-
-static void physdev_check(struct xt_fcheck_call *cb)
-{
-	if (cb->xflags == 0)
-		xtables_error(PARAMETER_PROBLEM, "PHYSDEV: no physdev option specified");
-}
-
-static void
-physdev_print(const void *ip, const struct xt_entry_match *match, int numeric)
-{
-	const struct xt_physdev_info *info = (const void *)match->data;
-
-	printf(" PHYSDEV match");
-	if (info->bitmask & XT_PHYSDEV_OP_ISIN)
-		printf("%s --physdev-is-in",
-		       info->invert & XT_PHYSDEV_OP_ISIN ? " !":"");
-	if (info->bitmask & XT_PHYSDEV_OP_IN)
-		printf("%s --physdev-in %s",
-		(info->invert & XT_PHYSDEV_OP_IN) ? " !":"", info->physindev);
-
-	if (info->bitmask & XT_PHYSDEV_OP_ISOUT)
-		printf("%s --physdev-is-out",
-		       info->invert & XT_PHYSDEV_OP_ISOUT ? " !":"");
-	if (info->bitmask & XT_PHYSDEV_OP_OUT)
-		printf("%s --physdev-out %s",
-		(info->invert & XT_PHYSDEV_OP_OUT) ? " !":"", info->physoutdev);
-	if (info->bitmask & XT_PHYSDEV_OP_BRIDGED)
-		printf("%s --physdev-is-bridged",
-		       info->invert & XT_PHYSDEV_OP_BRIDGED ? " !":"");
-}
-
-static void physdev_save(const void *ip, const struct xt_entry_match *match)
-{
-	const struct xt_physdev_info *info = (const void *)match->data;
-
-	if (info->bitmask & XT_PHYSDEV_OP_ISIN)
-		printf("%s --physdev-is-in",
-		       (info->invert & XT_PHYSDEV_OP_ISIN) ? " !" : "");
-	if (info->bitmask & XT_PHYSDEV_OP_IN)
-		printf("%s --physdev-in %s",
-		       (info->invert & XT_PHYSDEV_OP_IN) ? " !" : "",
-		       info->physindev);
-
-	if (info->bitmask & XT_PHYSDEV_OP_ISOUT)
-		printf("%s --physdev-is-out",
-		       (info->invert & XT_PHYSDEV_OP_ISOUT) ? " !" : "");
-	if (info->bitmask & XT_PHYSDEV_OP_OUT)
-		printf("%s --physdev-out %s",
-		       (info->invert & XT_PHYSDEV_OP_OUT) ? " !" : "",
-		       info->physoutdev);
-	if (info->bitmask & XT_PHYSDEV_OP_BRIDGED)
-		printf("%s --physdev-is-bridged",
-		       (info->invert & XT_PHYSDEV_OP_BRIDGED) ? " !" : "");
-}
-
-static struct xtables_match physdev_match = {
-	.family		= NFPROTO_UNSPEC,
-	.name		= "physdev",
-	.version	= XTABLES_VERSION,
-	.size		= XT_ALIGN(sizeof(struct xt_physdev_info)),
-	.userspacesize	= XT_ALIGN(sizeof(struct xt_physdev_info)),
-	.help		= physdev_help,
-	.print		= physdev_print,
-	.save		= physdev_save,
-	.x6_parse	= physdev_parse,
-	.x6_fcheck	= physdev_check,
-	.x6_options	= physdev_opts,
-};
-
-void _init(void)
-{
-	xtables_register_match(&physdev_match);
-}

=== removed directory '.pc/9006-lp1042260-fix-inverted-physdev.patch/tests'
=== removed file '.pc/9006-lp1042260-fix-inverted-physdev.patch/tests/options-most.rules'
--- .pc/9006-lp1042260-fix-inverted-physdev.patch/tests/options-most.rules	2012-09-17 17:10:24 +0000
+++ .pc/9006-lp1042260-fix-inverted-physdev.patch/tests/options-most.rules	1970-01-01 00:00:00 +0000
@@ -1,193 +0,0 @@
-*filter
-:INPUT ACCEPT [0:0]
-:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
-:matches - -
-:ntarg - -
-:zmatches - -
--A INPUT -j matches
--A INPUT -m u32 --u32 "0x0=0x0&&0x0=0x1" -j ntarg
--A INPUT -j zmatches
--A INPUT -m conntrack --ctstate INVALID --ctproto 6 --ctorigsrc fe80::/64 --ctorigdst fe80::/64 --ctreplsrc fe80::/64 --ctrepldst fe80::/64 --ctorigsrcport 12 --ctorigdstport 13 --ctreplsrcport 14 --ctrepldstport 15 --ctstatus EXPECTED --ctexpire 1:2 --ctdir REPLY 
--A INPUT -p tcp -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 2 --cluster-hash-seed 0x00000001 -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 2 --cluster-hash-seed 0x00000001 -m comment --comment foo -m connbytes --connbytes 1:2 --connbytes-mode packets --connbytes-dir both -m connlimit --connlimit-upto 1 --connlimit-mask 8 --connlimit-saddr -m connlimit --connlimit-above 1 --connlimit-mask 9 --connlimit-daddr -m connmark --mark 0x99 -m conntrack --ctstate INVALID --ctproto 6 --ctorigsrc fe80::/64 --ctorigdst fe80::/64 --ctreplsrc fe80::/64 --ctrepldst fe80::/64 --ctorigsrcport 12 --ctorigdstport 13 --ctreplsrcport 14 --ctrepldstport 15 --ctstatus EXPECTED --ctexpire 1:2 --ctdir REPLY -m cpu --cpu 2 -m dscp --dscp 0x04 -m dscp --dscp 0x00 -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstip --hashlimit-name f1 --hashlimit-htable-size 64 --hashlimit-htable-max 128 --hashlimit-htable-gcinterval 60 --hashlimit-htable-expire 120 --hashlimit-srcmask 24 --hashlimit-dstmask 24 -m hashlimit --hashlimit-above 5/sec --hashlimit-burst 5 --hashlimit-name f1 -m helper --helper ftp -m iprange --src-range ::1-::2 --dst-range ::1-::2 -m ipvs --vaddr fe80::/64 --vport 1 --vdir REPLY --vmethod GATE --vportctl 21 -m length --length 1:2 -m limit --limit 1/sec -m mac --mac-source 01:02:03:04:05:06 -m mark --mark 0x1 -m physdev --physdev-in eth0 -m pkttype --pkt-type unicast -m policy --dir in --pol ipsec --strict --reqid 1 --spi 0x1 --proto esp --mode tunnel --tunnel-dst fe80::/64 --tunnel-src fe80::/64 --next --reqid 2 -m quota --quota 0 -m recent --rcheck --name DEFAULT --rsource -m socket --transparent -m string --string "foobar" --algo kmp --from 1 --to 2 --icase -m time --timestart 01:02:03 --timestop 03:04:05 --monthdays 1,2,3,4,5 --weekdays Mon,Fri,Sun --datestart 2001-02-03T04:05:06 --datestop 2012-09-08T09:06:05 --utc -m tos --tos 0xff/0x01 -m u32 --u32 "0x0=0x0" -m u32 --u32 "0x0=0x0" -m hbh -m hbh -m hl --hl-eq 1
--A INPUT -m ipv6header --header hop-by-hop --soft
--A INPUT -p tcp -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 2 --cluster-hash-seed 0x00000001
--A INPUT -p tcp -m cluster --cluster-local-nodemask 0x00000001 --cluster-total-nodes 2 --cluster-hash-seed 0x00000001
--A INPUT -p tcp -m comment --comment foo
--A INPUT -p tcp -m connbytes --connbytes 1:2 --connbytes-mode packets --connbytes-dir both
--A INPUT -p tcp -m connlimit --connlimit-upto 1 --connlimit-mask 8 --connlimit-saddr
--A INPUT -p tcp -m connlimit --connlimit-above 1 --connlimit-mask 9 --connlimit-daddr
--A INPUT -p tcp -m connmark --mark 0x99
--A INPUT -p tcp -m conntrack --ctstate INVALID --ctproto 6 --ctorigsrc fe80::/64 --ctorigdst fe80::/64 --ctreplsrc fe80::/64 --ctrepldst fe80::/64 --ctorigsrcport 12 --ctorigdstport 13 --ctreplsrcport 14 --ctrepldstport 15 --ctstatus EXPECTED --ctexpire 1:2 --ctdir REPLY
--A INPUT -p tcp -m cpu --cpu 2
--A INPUT -p tcp -m dscp --dscp 0x04
--A INPUT -p tcp -m dscp --dscp 0x00
--A INPUT -p tcp -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 5 --hashlimit-mode srcip,dstip --hashlimit-name f1 --hashlimit-htable-size 64 --hashlimit-htable-max 128 --hashlimit-htable-gcinterval 60 --hashlimit-htable-expire 120 --hashlimit-srcmask 24 --hashlimit-dstmask 24
--A INPUT -p tcp -m hashlimit --hashlimit-above 5/sec --hashlimit-burst 5 --hashlimit-name f1
--A INPUT -p tcp -m helper --helper ftp
--A INPUT -p tcp -m iprange --src-range ::1-::2 --dst-range ::1-::2
--A INPUT -p tcp -m length --length 1:2
--A INPUT -p tcp -m limit --limit 1/sec
--A INPUT -p tcp -m mac --mac-source 01:02:03:04:05:06
--A INPUT -p tcp -m mark --mark 0x1
--A INPUT -p tcp -m physdev --physdev-in eth0
--A INPUT -p tcp -m pkttype --pkt-type unicast
--A INPUT -p tcp -m policy --dir in --pol ipsec --strict --reqid 1 --spi 0x1 --proto esp --mode tunnel --tunnel-dst fe80::/64 --tunnel-src fe80::/64 --next --reqid 2
--A INPUT -p tcp -m quota --quota 0
--A INPUT -p tcp -m recent --rcheck --name DEFAULT --rsource
--A INPUT -p tcp -m socket --transparent
--A INPUT -p tcp -m string --string "foobar" --algo kmp --from 1 --to 2 --icase
--A INPUT -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN
--A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN
--A INPUT -p tcp -m tos --tos 0xff/0x01
--A INPUT -p tcp -m u32 --u32 "0x0=0x0" -m u32 --u32 "0x0=0x0"
--A INPUT -p tcp -m hbh -m hbh -m hl --hl-eq 1 -m ipv6header --header hop-by-hop --soft
--A INPUT -m ipv6header --header hop-by-hop --soft -m rt --rt-type 2 --rt-segsleft 2 --rt-len 5 -m rt --rt-type 0 --rt-segsleft 2 --rt-len 5 --rt-0-res --rt-0-addrs ::1 --rt-0-not-strict -m rt --rt-type 0 --rt-segsleft 2 --rt-len 5 --rt-0-res --rt-0-addrs ::1,::2 --rt-0-not-strict
--A INPUT -p tcp -m cpu --cpu 1 -m tcp --sport 1:2 --dport 1:2 --tcp-option 1 --tcp-flags FIN,SYN,RST,ACK SYN -m cpu --cpu 1
--A INPUT -p dccp -m cpu --cpu 1 -m dccp --sport 1:2 --dport 3:4 -m cpu --cpu 1
--A INPUT -p udp -m cpu --cpu 1 -m udp --sport 1:2 --dport 3:4 -m cpu --cpu 1
--A INPUT -p sctp -m cpu --cpu 1 -m sctp --sport 1:2 --dport 3:4 --chunk-types all INIT,SACK -m cpu --cpu 1
--A INPUT -p esp -m esp --espspi 1:2
--A INPUT -p tcp -m multiport --dports 1,2 -m multiport --dports 1,2
--A INPUT -p tcp -m tcpmss --mss 1:2 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN
--A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 4/0
--A INPUT
--A INPUT -p mobility
--A INPUT -p mobility -m mh --mh-type 3
--A OUTPUT -m owner --socket-exists --uid-owner 1-2 --gid-owner 2-3
--A matches -m connbytes --connbytes 1 --connbytes-mode bytes --connbytes-dir both
--A matches
--A matches -m connbytes --connbytes :2 --connbytes-mode bytes --connbytes-dir both
--A matches
--A matches -m connbytes --connbytes 0:3 --connbytes-mode bytes --connbytes-dir both
--A matches
--A matches -m connbytes --connbytes 4: --connbytes-mode bytes --connbytes-dir both
--A matches
--A matches -m connbytes --connbytes 5:18446744073709551615 --connbytes-mode bytes --connbytes-dir both
--A matches
--A matches -m conntrack --ctexpire 1
--A matches
--A matches -m conntrack --ctexpire :2
--A matches
--A matches -m conntrack --ctexpire 0:3
--A matches
--A matches -m conntrack --ctexpire 4:
--A matches
--A matches -m conntrack --ctexpire 5:4294967295
--A matches
--A matches -m conntrack ! --ctstate NEW ! --ctproto tcp ! --ctorigsrc ::1/127 ! --ctorigdst ::2/127 ! --ctreplsrc ::2/127 ! --ctrepldst ::2/127 ! --ctorigsrcport 3 ! --ctorigdstport 4 ! --ctreplsrcport 5 ! --ctrepldstport 6 ! --ctstatus ASSURED ! --ctexpire 8:9
--A matches
--A matches -p esp -m esp --espspi 1
--A matches
--A matches -p esp -m esp --espspi :2
--A matches
--A matches -p esp -m esp --espspi 0:3
--A matches
--A matches -p esp -m esp --espspi 4:
--A matches
--A matches -p esp -m esp --espspi 5:4294967295
--A matches
--A matches -m hashlimit --hashlimit-upto 1/sec --hashlimit-burst 1 --hashlimit-name mini1
--A matches -m hashlimit --hashlimit-upto 1/min --hashlimit-burst 1 --hashlimit-name mini2
--A matches -m hashlimit --hashlimit-upto 1/hour --hashlimit-burst 1 --hashlimit-name mini3
--A matches -m hashlimit --hashlimit-upto 1/day --hashlimit-burst 1 --hashlimit-name mini4
--A matches
--A matches -m ipvs --vaddr fe80::/64 --vport 1 --vdir REPLY --vmethod GATE --vportctl 21
--A matches
--A matches -m length --length 1
--A matches
--A matches -m length --length :2
--A matches
--A matches -m length --length 0:3
--A matches
--A matches -m length --length 4:
--A matches
--A matches -m length --length 5:65535
--A matches
--A matches -p tcp -m tcpmss --mss 1
--A matches
--A matches -p tcp -m tcpmss --mss :2
--A matches
--A matches -p tcp -m tcpmss --mss 0:3
--A matches
--A matches -p tcp -m tcpmss --mss 4:
--A matches
--A matches -p tcp -m tcpmss --mss 5:65535
--A matches
--A matches -m time --timestart 01:02:03 --timestop 04:05:06 --monthdays 1,2,3,4,5 --weekdays Mon,Fri,Sun --datestart 2001-02-03T04:05:06 --datestop 2012-09-08T09:06:05 --localtz
--A matches
--A matches -m time --timestart 01:02:03 --timestop 04:05:06 --monthdays 1,2,3,4,5 --weekdays Mon,Fri,Sun --datestart 2001-02-03T04:05:06 --datestop 2012-09-08T09:06:05 --kerneltz
--A matches
--A matches -m time --timestart 01:02:03 --timestop 04:05:06 --monthdays 1,2,3,4,5 --weekdays Mon,Fri,Sun --datestart 2001-02-03T04:05:06 --datestop 2012-09-08T09:06:05
--A matches
--A matches -m time --timestart 02:00:00 --timestop 03:00:00 --datestart 1970-01-01T02:00:00 --datestop 1970-01-01T03:00:00
--A matches
--A matches -m ah --ahspi 1
--A matches
--A matches -m ah --ahspi :2
--A matches
--A matches -m ah --ahspi 0:3
--A matches
--A matches -m ah --ahspi 4:
--A matches
--A matches -m ah --ahspi 5:4294967295
--A matches
--A matches -m frag --fragid 1
--A matches
--A matches -m frag --fragid :2
--A matches
--A matches -m frag --fragid 0:3
--A matches
--A matches -m frag --fragid 4:
--A matches
--A matches -m frag --fragid 5:4294967295
--A matches
--A matches -m rt --rt-segsleft 1
--A matches
--A matches -m rt --rt-segsleft :2
--A matches
--A matches -m rt --rt-segsleft 0:3
--A matches
--A matches -m rt --rt-segsleft 4:
--A matches
--A matches -m rt --rt-segsleft 5:4294967295
--A matches
--A ntarg -j LOG --log-tcp-sequence --log-tcp-options --log-ip-options
--A ntarg
--A ntarg -j NFQUEUE --queue-num 1
--A ntarg
--A ntarg -j NFQUEUE --queue-balance 8:99
--A ntarg
--A ntarg -j RATEEST --rateest-name RE1 --rateest-interval 250.0ms --rateest-ewmalog 500.0ms
--A ntarg
--A ntarg -j RATEEST --rateest-name RE2 --rateest-interval 250.0ms --rateest-ewmalog 500.0ms
--A ntarg
-#-A zmatches -m rateest --rateest RE1 --rateest-lt --rateest-bps 8bit
-#-A zmatches -m rateest --rateest RE1 --rateest-eq --rateest-bps 8bit
-#-A zmatches -m rateest --rateest RE1 --rateest-gt --rateest-bps 8bit
-#-A zmatches -m rateest --rateest RE1 --rateest-lt --rateest-pps 5
-#-A zmatches -m rateest --rateest RE1 --rateest-eq --rateest-pps 5
-#-A zmatches -m rateest --rateest RE1 --rateest-gt --rateest-pps 5
-#-A zmatches -m rateest --rateest-delta --rateest RE1 --rateest-bps1 8bit --rateest-lt --rateest-bps2 16bit
-#-A zmatches -m rateest --rateest1 RE1 --rateest-lt --rateest2 RE2 --bytes
-#-A zmatches -m rateest --rateest1 RE1 --rateest-lt --rateest2 RE2 --packets
-#-A zmatches -m rateest --rateest-delta --rateest RE1 --rateest-bps1 8bit --rateest-eq --rateest-bps2 16bit
-#-A zmatches -m rateest --rateest-delta --rateest RE1 --rateest-bps1 8bit --rateest-gt --rateest-bps2 16bit
-#-A zmatches -m rateest --rateest-delta --rateest RE1 --rateest-pps1 8 --rateest-lt --rateest-pps2 9
-#-A zmatches -m rateest --rateest-delta --rateest RE1 --rateest-pps1 8 --rateest-eq --rateest-pps2 9
-#-A zmatches -m rateest --rateest-delta --rateest RE1 --rateest-pps1 8 --rateest-gt --rateest-pps2 9
-COMMIT
-*mangle
-:PREROUTING ACCEPT [0:0]
-:INPUT ACCEPT [0:0]
-:FORWARD ACCEPT [0:0]
-:OUTPUT ACCEPT [0:0]
-:POSTROUTING ACCEPT [0:0]
-:matches - -
-:ntarg - -
-:zmatches - -
--A INPUT -m u32 --u32 "0x0=0x0&&0x0=0x1" -j ntarg
--A ntarg -j HL --hl-inc 1
--A ntarg -j HL --hl-dec 1
--A ntarg
-COMMIT

=== removed file '.pc/applied-patches'
--- .pc/applied-patches	2012-09-17 17:10:24 +0000
+++ .pc/applied-patches	1970-01-01 00:00:00 +0000
@@ -1,8 +0,0 @@
-0101-changelog.patch
-9000-howtos.patch
-9001-Fixed-FTBS-by-copying-linux-types.h-from-linux-3.2.patch
-9002-libxt_recent-Add-support-for-reap-option.patch
-9003-lp1020490.patch
-9004-argv-is-null.patch
-9005-lp1027252-fixrestore.patch
-9006-lp1042260-fix-inverted-physdev.patch

=== removed file 'Changelog'
--- Changelog	2012-07-20 15:45:01 +0000
+++ Changelog	1970-01-01 00:00:00 +0000
@@ -1,2992 +0,0 @@
-iptables v1.4.12 Changelog:
-======================================================================
-Changes from 1.4.11.1:
-
-
-
-Fernando Luis Vazquez Cao (1):
-      doc: document IPv6 TOS mangling bug in old Linux kernels
-
-Jakub Zawadzki (1):
-      doc: fix group range in libxt_NFLOG's man
-
-Jan Engelhardt (23):
-      doc: include matches/targets in manpage again
-      libipt_LOG: fix ignoring all but last flags
-      libxt_RATEEST: use guided option parser
-      iptables: consolidate target/match init call
-      extensions: support for per-extension instance "global" variable space
-      libxt_rateest: abolish global variables
-      libxt_RATEEST: abolish global variables
-      libip6t_HL: fix option names from ttl -> hl
-      libxt_state: fix regression about inversion of main option
-      libxt_hashlimit: use a more obvious expiry value by default
-      build: bump soversion for recent data structure change
-      build: attempt to fix building under Linux 2.4
-      doc: mention multiple verbosity flags
-      build: install modules in arch-dependent location
-      doc: fix version string in ip6tables.8
-      doc: the -m option cannot be inverted
-      iptables: restore negation for -f
-      libxtables: properly reject empty hostnames
-      libxtables: ignore whitespace in the multiaddress argument parser
-      option: remove last traces of intrapositional negation
-      libxtables: set clone's initial data to NULL
-      libxt_conntrack: restore network-byte order for v1,v2
-      libxt_conntrack: move more data into the xt_option_entry
-
-Jiri Popelka (5):
-      iptables: Coverity: DEADCODE
-      iptables: Coverity: NEGATIVE_RETURNS
-      iptables: Coverity: REVERSE_INULL
-      iptables: Coverity: VARARGS
-      iptables: Coverity: RESOURCE_LEAK
-
-Martin F. Krafft (1):
-      iptables-apply: select default rule file depending on call name
-
-Massimo Maggi (1):
-      libxt_RATEEST: fix userspacesize field
-
-Patrick McHardy (4):
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Bump version to 1.4.12
-
-
-iptables v1.4.11.1 Changelog:
-======================================================================
-Changes from 1.4.11:
-
-
-Elie De Brauwer (1):
-      doc: fix trivial typo in libipt_SNAT
-
-Jan Engelhardt (13):
-      libxt_owner: restore inversion support
-      build: remove dead code parts
-      build: fix installation of symlinks
-      build: fix absence of xml translator in IPv6-only builds
-      doc: update GPL license text
-      doc: iptables-xml should be in manpage section 1
-      build: move basic preprocessor flags to regular_CPPFLAGS
-      build: move kinclude's preprocessor flags to kinclude_CPPFLAGS
-      src: move all libiptc pieces into its directory
-      src: move all iptables pieces into a separate directory
-      tests: add some sample rulesets to test save-restore cycle
-      option: fix ignored negation before implicit extension loading
-      build: re-add missing CPPFLAGS for libiptc
-
-Maciej Żenczykowski (1):
-      xtables-multi: fix absence of xml translator in IPv6-only builds
-
-Mike Frysinger (1):
-      build: move remaining preprocessor flags to CPPFLAGS
-
-Patrick McHardy (1):
-      Bump version to 1.4.11.1
-
-Vlad Dogaru (1):
-      doc: fix MASQUERADE section of man page
-
-
-
-iptables v1.4.11 Changelog:
-======================================================================
-Changes from 1.4.10:
-
-
-Changli Gao (1):
-      iptables: fix the dead loop when meeting unknown options
-
-Florian Westphal (3):
-      libxt_conntrack: fix --ctdir save/dump output format
-      libxt_time: fix random --datestart skips
-      extensions: libxt_NFQUEUE: add v2 revision with --queue-bypass option
-
-JP Abgrall (1):
-      libxt_quota: make sure uint64 is not truncated
-
-Jan Engelhardt (218):
-      libxtables: change option precedence order to be intuitive
-      libxt_TOS: avoid an undesired overflowing computation
-      iptables: fix longopt reecognition and workaround getopt(3) behavior
-      Revert "Revert "libxtables: change option precedence order to be intuitive""
-      Merge branch 'master' of git://dev.medozas.de/iptables into m2
-      iptables: reset options at the start of each command
-      iptables: do not emit orig_opts twice
-      include: update files with headers from Linux 2.6.37-rc1
-      TPROXY: add support for revision 1
-      socket: add support for revision 1
-      build: fix globbing of extensions in other locales
-      libxt_owner: output numeric IDs when save is requested
-      Merge commit 'v1.4.10'
-      build: stop on error in subcommand
-      src: const annotations
-      xt_comment: remove redundant cast
-      src: use C99/POSIX types
-      iptables: abort on empty interface specification
-      xtables: reorder num_old substraction for clarity
-      ip[6]tables: only call match's parse function when option char is in range
-      ip[6]tables: only call target's parse function when option char is in range
-      extensions: remove no longer necessary default: cases
-      libxt_sctp: fix a typo
-      libipt_CLUSTERIP: const annotations
-      libxtables: do some option structure checking
-      libxt_quota: print negation when it has been selected
-      libxt_connlimit: reword help text to say prefix length
-      libxt_connlimit: add a --connlimit-upto option
-      libxt_connlimit: support for dstaddr-supporting revision 1
-      libxt_connlimit: remove duplicate member that caused size change
-      libxt_quota: clarifications on matching
-      iptables: improve error reporting with extension loading troubles
-      libxt_u32: enclose argument in quotes
-      xtables: set custom opts to NULL on free
-      iptables: warn when parameter limit is exceeded
-      iptables: remove bogus address-of
-      iptables: remove more redundant casts
-      iptables: do not print trailing whitespaces
-      src: collect do_command variables in a struct
-      src: move large default: block from do_command6 into its own function
-      src: share iptables_command_state across the two programs
-      src: deduplicate find_proto function
-      src: move OPT_FRAGMENT to the end so the list can be shared
-      src: put shared option flags into xshared
-      src: deduplicate and simplify implicit protocol extension loading
-      src: unclutter command_default function
-      src: move jump option handling from do_command6 into its own function
-      src: move match option handling from do_command6 into its own functions
-      iptables: fix error message for unknown options
-      iptables: fix segfault target option parsing
-      ip6tables: spacing fixes for -o argument
-      libxt_devgroup: option whitespace update following v1.4.10-49-g7386635
-      extensions: fix indent of vtable
-      doc: fix wrong sentence about negation in xt_limit
-      doc: fix misspelling of "field"
-      extensions: remove redundant init functions
-      Remove unused CVS expanded keywords
-      libip6t_dst: remove unimplemented --dst-not-strict
-      libip6t_hbh: remove unimplemented --hbh-not-strict
-      extensions: add missing checks for specific flags
-      libipt_ECN: set proper option flags
-      doc: mention other possible nf_loggers for TRACE
-      doc: fix odd partial sentence in libipt_TTL
-      libxt_quota: require --quota to be specified
-      doc: rateest options can be optional
-      libxtables: fix memory scribble beyond end of array
-      iptables: fix an inversion
-      doc: add VERSION section to manpages
-      extensions: add missing checks for specific flags (2)
-      libxtables: guided option parser
-      libxt_CHECKSUM: use guided option parser
-      libxt_socket: use guided option parser
-      libxtables: provide better final_check
-      libxt_CONNSECMARK: use guided option parser
-      libxtables: XTTYPE_UINT32 support
-      libxt_cpu: use guided option parser
-      libxtables: min-max option support
-      libxt_cluster: use guided option parser
-      libxtables: XTTYPE_UINT8 support
-      libip[6]t_HL: use guided option parser
-      libip[6]t_hl: use guided option parser
-      libxtables: XTTYPE_UINT32RC support
-      libip[6]t_ah: use guided option parser
-      libip6t_frag: use guided option parser
-      libxt_esp: use guided option parser
-      libxtables: XTTYPE_STRING support
-      libip[6]t_REJECT: use guided option parser
-      libip6t_dst: use guided option parser
-      libip6t_hbh: use guided option parser
-      libip[6]t_icmp: use guided option parser
-      libip6t_ipv6header: use guided option parser
-      libipt_ECN: use guided option parser
-      libipt_addrtype: use guided option parser
-      libxt_AUDIT: use guided option parser
-      libxt_CLASSIFY: use guided option parser
-      libxt_DSCP: use guided option parser
-      libxt_LED: use guided option parser
-      libxt_SECMARK: use guided option parser
-      libxt_TCPOPTSTRIP: use guided option parser
-      libxt_comment: use guided option parser
-      libxt_helper: use guided option parser
-      libxt_physdev: use guided option parser
-      libxt_pkttype: use guided option parser
-      libxt_state: use guided option parser
-      libxt_time: use guided option parser
-      libxt_u32: use guided option parser
-      doc: avoid duplicate entries in manpage
-      libxtables: XTTYPE_MARKMASK32 support
-      libxt_MARK: use guided option parser
-      libxt_CONNMARK: use guided option parser
-      libxtables: XTTYPE_UINT64 support
-      libxt_quota: use guided option parser
-      libxtables: linked-list name<->id map
-      libxt_devgroup: use guided option parser
-      libipt_realm: use guided option parser
-      libxtables: XTTYPE_UINT16RC support
-      libxt_length: use guided option parser
-      libxt_tcpmss: use guided option parser
-      libxtables: XTTYPE_UINT8RC support
-      libxtables: XTTYPE_UINT64RC support
-      libxt_connbytes: use guided option parser
-      libxtables: XTTYPE_UINT16 support
-      libxt_CT: use guided option parser
-      libxt_NFQUEUE: use guided option parser
-      libxt_TCPMSS: use guided option parser
-      libxtables: pass struct xt_entry_{match,target} to x6 parser
-      libxt_string: use guided option parser
-      libxtables: XTTYPE_SYSLOGLEVEL support
-      libip[6]t_LOG: use guided option parser
-      libxtables: XTTYPE_ONEHOST support
-      libxtables: XTTYPE_PORT support
-      libxt_TPROXY: use guided option parser
-      libipt_ULOG: use guided option parser
-      build: bump libxtables ABI version
-      libxt_TEE: use guided option parser
-      xtoptions: respect return value in xtables_getportbyname
-      libxt_TOS: use guided option parser
-      libxt_tos: use guided option parser
-      extensions: remove unused TOS code
-      libxtables: XTTYPE_PORTRC support
-      libxt_udp: use guided option parser
-      libxt_dccp: use guided option parser
-      libxt_tos: add inversion support back again
-      libxtables: fix assignment in wrong offset (XTTYPE_UINT*RC)
-      libxt_u32: add missing call to xtables_option_parse
-      extensions: remove bogus use of XT_GETOPT_TABLEEND
-      libxt_owner: remove ifdef IPT_COMM_OWNER
-      libxtables: output name of extension on rev detect failure
-      extensions: const annotations
-      libxt_statistic: streamline and document possible placement of negation
-      libxt_statistic: increase precision on create and dump
-      libxtables: XTTYPE_DOUBLE support
-      libxt_statistic: use guided option parser
-      libxt_IDLETIMER: use guided option parser
-      libxt_NFLOG: use guided option parser
-      libxtables: support for XTTYPE_PLENMASK
-      libxt_connlimit: use guided option parser
-      libxt_recent: use guided option parser
-      libxtables: do not overlay addr and mask parts, and cleanup
-      libxtables: flag invalid uses of XTOPT_PUT
-      libxtables: XTTYPE_PLEN support
-      libxt_hashlimit: use guided option parser
-      libxtables: XTTYPE_HOSTMASK support
-      libxt_policy: use guided option parser
-      libxt_owner: use guided option parser
-      libxt_osf: use guided option parser
-      libxt_multiport: use guided option parser
-      libipt_NETMAP: use guided option parser
-      libxt_limit: use guided option parser
-      libxtables: XTTYPE_PROTOCOL support
-      libxt_ipvs: use guided option parser
-      doc: S/DNAT allows to omit IP addresses
-      libxt_conntrack: use guided option parser
-      libip6t_mh: use guided option parser
-      libip6t_rt: use guided option parser
-      libxtables: XTTYPE_ETHERMAC support
-      libxt_mac: use guided option parser
-      libipt_CLUSTERIP: use guided option parser
-      libxt_iprange: use guided option parser
-      libipt_DNAT: use guided option parser
-      libipt_SNAT: use guided option parser
-      libipt_MASQUERADE: use guided option parser
-      libipt_REDIRECT: use guided option parser
-      libipt_SAME: use guided option parser
-      src: replace old IP*T_ALIGN macros
-      src: combine default_command functions
-      libxt_policy: option table fixes, improved error tracking
-      libxtables: avoid running into .also checks when option not used
-      libxt_policy: use XTTYPE_PROTOCOL type
-      libxtables: collapse double protocol parsing
-      libipt_[SD]NAT: flag up module name on error
-      libipt_[SD]NAT: avoid false error about multiple destinations specified
-      libxt_conntrack: correct printed module name
-      libxt_conntrack: fix assignment to wrong member
-      libxt_conntrack: resolve erroneous rev-2 port range message
-      libip6t_rt: rt-0-not-strict should take no arg
-      libxtables: retract _NE types and use a flag instead
-      libxt_quota: readd missing XTOPT_PUT request
-      libxtables: check for negative numbers in xtables_strtou*
-      libxt_rateest: streamline case display of units
-      doc: add some coded option examples to libxt_hashlimit
-      doc: make usage of libxt_rateest more obvious
-      doc: clarify that -p all is a special keyword only
-      doc: use .IP list for TCPMSS
-      doc: remove redundant .IP calls in libxt_time
-      libxt_ipvs: restore network-byte order
-      libxt_u32: --u32 option is required
-      libip6t_rt: restore --rt-type storing
-      libxtables: more detailed error message on multi-int parsing
-      libxtables: use uintmax for xtables_strtoul
-      libxtables: make multiint parser have greater range
-      libxtables: unclutter xtopt_parse_mint
-      libxtables: have xtopt_parse_mint interpret partially-spec'd ranges
-      libxt_NFQUEUE: avoid double attempt at parsing
-      libxt_NFQUEUE: add mutual exclusion between qnum and qbal
-      libxt_time: always ignore libc timezone
-      libxt_time: --utc and --localtz are mutually exclusive
-      libxt_time: deprecate --localtz option, document kernel TZ caveats
-
-Jozsef Kadlecsik (3):
-      Fix listing/saving the new revision of the SET target
-      Fix set match/target direction parser
-      SET target revision 2 added
-
-Li Yewang (1):
-      xtables: fix typo in error message of xtables_register_match()
-
-Lutz Jaenicke (2):
-      libipt_REDIRECT: "--to-ports" is not mandatory
-      libxt_devgroup: actually set XT_DEVGROUP_OPT_???GROUP flags
-
-Maciej Zenczykowski (20):
-      man pages: allow underscores in match and target names
-      mark newly opened fds as FD_CLOEXEC (close on exec)
-      xtables_ip6addr_to_numeric: fix typo in comment
-      xtables: delay (statically built) match/target initialization
-      v4: rename init_extensions() to init_extensions4()
-      v6: rename init_extensions() to init_extensions6()
-      xtables.h: init_extensions() no longer exists
-      v4: rename for_each_chain() to for_each_chain4()
-      v6: rename for_each_chain() to for_each_chain6()
-      v4: rename flush_entries() to flush_entries4()
-      v6: rename flush_entries() to flush_entries6()
-      v4: rename delete_chain() to delete_chain4()
-      v6: rename delete_chain() to delete_chain6()
-      v4: rename print_rule() to print_rule4()
-      v6: rename print_rule() to print_rule6()
-      v4: rename do_command() to do_command4()
-      v6: rename do_command() to do_command6()
-      move 'int line' definition from ip6?tables.c into xtables.c
-      convert ip6?tables-multi to actually use their own header files
-      Don't load ip6?_tables module when already loaded
-
-Maciej Żenczykowski (3):
-      Add --ipv4/-4 and --ipv6/-6 support to ip6?tables{,-restore}.
-      Move common parts of libext{4,6}.a into libext.a
-      combine ip6?tables-multi into xtables-multi
-
-Mark Montague (1):
-      iptables: documentation for iptables and ip6tables "security" tables
-
-Max Kellerman (1):
-      xtables: use strspn() to check if string needs to be quoted
-
-Pablo Neira Ayuso (1):
-      libxt_cluster: fix inversion in the cluster match
-
-Patrick McHardy (16):
-      Revert "libxtables: change option precedence order to be intuitive"
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      extensions: libxt_conntrack: add support for specifying port ranges
-      extensions: add extension for devgroup match
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
-      Merge branch 'opts' of git://dev.medozas.de/iptables
-      Merge branch 'opts' of git://dev.medozas.de/iptables
-      Merge branch 'floating/opts' of git://dev.medozas.de/iptables
-      Merge branch 'opts' of git://dev.medozas.de/iptables
-      Merge branch 'opts' of git://dev.medozas.de/iptables
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'opts' of git://dev.medozas.de/iptables
-      Merge branch 'floating/opts' of git://dev.medozas.de/iptables
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Bump version to 1.4.11
-
-Rob Leslie (1):
-      iptables-restore: resolve confusing policy error message
-
-Stefan Tomanek (2):
-      ip(6)tables-multi: unify subcommand handling
-      iptables: add -C to check for existing rules
-
-Stephen Beahm (1):
-      libipt_REDIRECT: avoid dereference of uninitialized pointer
-
-Thomas Graf (2):
-      libxt_AUDIT: add AUDIT target
-      iptables: add manual page section for AUDIT target
-
-Wes Campaigne (4):
-      libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6
-      xtables: fix excessive memory allocation in host_to_ipaddr
-      xtables: fix the broken detection/removal of redundant addresses
-      xtables: use all IPv6 addresses resolved from a hostname
-
-
-
-iptables v1.4.10 Changelog:
-======================================================================
-Changes from 1.4.9:
-
-
-Changli Gao (1):
-      libxt_quota: don't ignore the quota value on deletion
-
-Eric Dumazet (2):
-      extensions: REDIRECT: add random help
-      extension: add xt_cpu match
-
-Hannes Eder (1):
-      libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
-
-Jan Engelhardt (11):
-      doc: let man(1) autoalign the text in xt_cpu
-      doc: remove extra empty line from xt_cpu
-      doc: minimal spelling updates to xt_cpu
-      all: consistent syntax use in struct option
-      doc: consistent use of markup
-      xtables: remove unnecessary cast
-      build: fix static linking
-      iptables-xml: resolve compiler warnings
-      iptables: limit chain name length to be consistent with targets
-      libiptc: build with -Wl,--no-as-needed
-      libiptc: add Libs.private to pkgconfig files
-
-Luciano Coelho (2):
-      extensions: add idletimer xt target extension
-      extensions: libxt_IDLETIMER: use xtables_param_act when checking options
-
-Michael S. Tsirkin (1):
-      extensions: libxt_CHECKSUM extension
-
-Patrick McHardy (6):
-      extensions: libipt_LOG/libip6t_LOG: support macdecode option
-      extensions: fix compilation of the new CHECKSUM target
-      Merge branch 'master' into iptables-next
-      Merge branch 'master' into iptables-next
-      Merge branch 'iptables-next'
-      Bump version to 1.4.10
-
-
-
-iptables v1.4.9 Changelog:
-======================================================================
-Changes from 1.4.8:
-
-
-Adam Nielsen (1):
-      extensions: add the LED target
-
-Eric Dumazet (1):
-      extensions: REDIRECT: add random help
-
-Jan Engelhardt (10):
-      utils: add missing include flags to Makefile
-      doc: xt_string: correct copy-and-pasting in manpage
-      doc: xt_hashlimit: fix a typo
-      doc: xt_LED: nroff formatting requirements
-      includes: sync header files from Linux 2.6.35-rc1
-      xtables: another try at chain name length checking
-      xtables: remove xtables_set_revision function
-      libxt_hashlimit: always print burst value
-      libxt_conntrack: do print netmask
-      xt_quota: also document negation
-
-Jozsef Kadlecsik (1):
-      libxt_set: new revision added
-
-Luciano Coelho (2):
-      extensions: libxt_rateest: fix typo in the man page
-      extensions: libxt_rateest: fix bps options for iptables-save
-
-Patrick McHardy (5):
-      Revert "Revert "Merge branch 'iptables-next'""
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
-      Bump version to 1.4.9
-
-Samuel Ortiz (1):
-      extensions: libxt_quota.c: Support option negation
-
-Shan Wei (2):
-      xt_sctp: Trace DATA chunk that supports SACK-IMMEDIATELY extension
-      xt_sctp: support FORWARD_TSN chunk type
-
-
-
-iptables v1.4.8 Changelog:
-======================================================================
-Changes from 1.4.7:
-
-
-Dmitry V. Levin (3):
-      extensions: REDIRECT: fix --to-ports parser
-      iptables: add noreturn attribute to exit_tryhelp()
-      extensions: MASQUERADE: fix --to-ports parser
-
-Jan Engelhardt (9):
-      libxt_comment: avoid use of IPv4-specific examples
-      libxt_CT: add a manpage
-      iptables: correctly check for too-long chain/target/match names
-      doc: libxt_MARK: no longer restricted to mangle table
-      doc: remove claim that TCPMSS is limited to mangle
-      libxt_recent: add a missing space in output
-      doc: add manpage for libxt_osf
-      libxt_osf: import nfnl_osf program
-      extensions: add support for xt_TEE
-
-Karl Hiramoto (1):
-      iptables: optionally disable largefile support
-
-Pablo Neira Ayuso (1):
-      CT: fix --ctevents parsing
-
-Patrick McHardy (7):
-      extensions: add CT extension
-      libxt_CT: print conntrack zone in ->print/->save
-      Merge branch 'master' of git://dev.medozas.de/iptables into iptables-next
-      xtables: fix compilation when debugging is enabled
-      Merge branch 'iptables-next'
-      Revert "Merge branch 'iptables-next'"
-      Bump version to 1.4.8
-
-Simon Lodal (1):
-      libxt_conntrack: document --ctstate UNTRACKED
-
-Vincent Bernat (1):
-      iprange: fix xt_iprange v0 parsing
-
-
-
-iptables v1.4.7 Changelog:
-======================================================================
-Changes from 1.4.6:
-
-
-Dmitry V. Levin (1):
-      libip4tc: Add static qualifier to dump_entry()
-
-Jan Engelhardt (8):
-      libipq: build as shared library
-      recent: reorder cases in code (cosmetic cleanup)
-      doc: fix recent manpage to reflect actual supported syntax
-      doc: fix limit manpage to reflect actual supported syntax
-      doc: mention requirement of additional packages for ipset
-      policy: fix error message showing wrong option
-      includes: header updates
-      Lift restrictions on interface names
-
-Patrick McHardy (1):
-      iptables 1.4.7
-
-
-
-iptables v1.4.6 Changelog:
-======================================================================
-Changes from 1.4.5:
-
-
-Jan Engelhardt (20):
-      iptables: manpage updates for augmented -Z syntax
-      doc: mention maximum mark size in manpages
-      Support for nommu arches
-      realm: remove static initializations
-      libiptc: remove unused functions
-      libiptc: avoid strict-aliasing warnings
-      iprange: do accept non-ranges for xt_iprange v1
-      iprange: warn on reverse range
-      iprange: roll address parsing into a loop
-      iprange: do accept non-ranges for xt_iprange v1 (log)
-      iprange: warn on reverse range (log)
-      libiptc: fix wrong maptype of base chain counters on restore
-      iptables: fix undersized deletion mask creation
-      style: reduce indent in xtables_check_inverse
-      libxtables: hand argv to xtables_check_inverse
-      iptables/extensions: make bundled options work again
-      CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
-      iptables: take masks into consideration for replace command
-      doc: explain experienced --hitcount limit
-      doc: name resolution clarification
-
-Mohit Mehta (1):
-      iptables: expose option to zero packet/byte counters for a specific rule
-
-Olaf Rempel (1):
-      build: restore --disable-ipv6 functionality on system w/o v6 headers
-
-Patrick McHardy (7):
-      Merge branch 'zero' of git://dev.medozas.de/iptables
-      MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
-      DNAT: fix incorrect check during parsing
-      extensions: add osf extension
-      conntrack: fix --expires parsing
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Bump version to v1.4.6
-
-Tim Small (1):
-      doc: update TCPMSS manpage with Linux 2.6.25 changes
-
-sobtwmxt (1):
-      doc: fix typo in length manpage
-
-
-
-iptables v1.4.5 Changelog:
-======================================================================
-Changes from 1.4.4:
-
-
-Florian Westphal (1):
-      libxt_NFQUEUE: add new v1 version with queue-balance option
-
-Jan Engelhardt (18):
-      xt_conntrack: revision 2 for enlarged state_mask member
-      libxt_helper: fix invalid passed option to check_inverse
-      libiptc: split v4 and v6
-      extensions: collapse registration structures
-      iptables: allow for parse-less extensions
-      iptables: allow for help-less extensions
-      extensions: remove empty help and parse functions
-      xtables: add multi-registration functions
-      extensions: collapse data variables to use multi-reg calls
-      xtables: warn of missing version identifier in extensions
-      COMMIT_NOTES: notice to check for soversion bumps
-      build: order of dependent libs is sensitive
-      multi binary: allow subcommand via argv[1]
-      build: fix struct size mismatch
-      build: combine iptables-multi and iptables-static
-      build: build only iptables-multi
-      Merge branch 'stable'
-      manpages: more fixes to minuses, hyphens, dashes
-
-Laurence J. Lane (1):
-      manpage: fix lintian warnings
-
-Michael Granzow (1):
-      iptables: accept multiple IP address specifications for -s, -d
-
-Patrick McHardy (2):
-      man: fix incorrect plural in libipt_set.man
-      Bump version number to 1.4.5
-
-Trent W. Buck (1):
-      ipt_set: fix a typo in the manpage
-
-
-iptables v1.4.4 Changelog:
-======================================================================
-Changes from 1.4.3.2:
-
-
-Frank Tobin (1):
-      libxt_tcp: fix a manpage syntax typo
-
-Ian Bruce (1):
-      libxt_tcp: manpage corrections and suggestions
-
-Jan Engelhardt (15):
-      Add new COMMIT_NOTES document
-      xtables: use extern "C"
-      extensions: add const qualifiers in print/save functions
-      iptables: replace open-coded sizeof by ARRAY_SIZE
-      addrtype: fix one manpage type
-      manpages: do not include v4-only modules in ip6tables manpage
-      libip6t_policy: remove redundant functions
-      policy: use direct xt_policy_info instead of ipt/ip6t
-      policy: merge ipv6 and ipv4 variant
-      build: fix manpage collection
-      extensions: use NFPROTO_UNSPEC for .family field
-      DNAT/SNAT: add manpage documentation for --persistent flag
-      extensions: remove redundant casts
-      iptables: close open file descriptors
-      manpages: markup corrections
-
-Jozsef Kadlecsik (1):
-      Updated set/SET match and target to support multiple ipset protocols.
-
-Pablo Neira Ayuso (2):
-      extensions: add `cluster' match support
-      xtables: fix segfault if incorrect protocol name is used
-
-Patrick McHardy (3):
-      SNAT/DNAT: add support for persistent multi-range NAT mappings
-      Merge branch 'stable' of git://dev.medozas.de/iptables
-      Bump version
-
-kd6lvw (1):
-      libxt_connlimit: initialize v6_mask
-
-
-
-iptables v1.4.3.2 Changelog:
-======================================================================
-Changes from 1.4.3.1:
-
-
-Jan Engelhardt (12):
-      libxt_tcpmss: fix an inversion while parsing --mss
-      iptables-multi: support "iptables-static" as a callable name
-      libxtables: reorder .version member
-      build: do not run ldconfig for DESTDIR installations
-      build: add configure option to disable ip6tables
-      build: add configure option to disable ipv4 iptables
-      libxtables: provide IPv6 zero address variable
-      iptables: print negation extrapositioned
-      Merge commit 'v1.4.3'
-      Merge branch 'plus'
-      CLASSIFY: document non-standard interpretation behavior
-      libxt_conntrack: properly output negation symbol
-
-Pablo Neira Ayuso (1):
-      build: bump version to 1.4.3.2
-
-
-iptables v1.4.3.1 Changelog:
-======================================================================
-Changes from 1.4.3:
-
-
-Jan Engelhardt (2):
-      iptables-save: minor corrections to the manpage markup
-      libxt_hashlimit: add missing space for iptables-save output
-
-Pablo Neira Ayuso (2):
-      build: bump version to 1.4.3.1
-      iptables: refer to dmesg if we hit EINVAL
-
-Peter Volkov (2):
-      libxtables: fix compile error due to incomplete change
-      build: fix linker issue when LDFLAGS contains --as-needed
-
-
-
-iptables v1.4.3 Changelog:
-======================================================================
-Changes from 1.4.2:
-
-
-Bart De Schuymer (1):
-      man: fix physdev manpage
-
-Christian Perle (1):
-      libxt_policy: cannot set spi/reqid numbers higher than 0x7fffffff
-
-Christoph Paasch (1):
-      libiptc: avoid compile warnings for iptc_insert_chain
-
-Daniel Drake (1):
-      libxt_owner: add more spaces to output
-
-Eric Leblond (1):
-      xt_NFLOG: Set default NFLOG qthreshold to 0
-
-Jamal Hadi Salim (12):
-      libxtables: Introduce global params structuring
-      libxtables: define xtables_free_opts()
-      libxtables: Add exit_error cb to xtables_globals
-      libxtables: Make ip6tables, iptables and iptables-xml use xtables_globals
-      libxtables: Replace direct exit_error() calls inside libxtables
-      libxtables: simple aliasing macro for exit_error
-      libxtables: set names of programs
-      libxtables: add xtables_set_revision
-      libxtables: make iptables and ip6tables use xtables_free_opts
-      libxtables: consolidate merge_options into xtables_merge_options
-      libxtables: consolidate init calls into one function
-      libxtables: general follow-up cleanup
-
-Jan Engelhardt (84):
-      Move libipt_recent to libxt_recent
-      libxt_recent: add IPv6 support
-      manpage: use separate paragraphs for command syntax
-      manpage: explain what rule-specification is
-      libiptc: remove typedef indirection
-      libiptc: remove indirections
-      libiptc: remove unused iptc_get_raw_socket and iptc_check_packet
-      libiptc: use hex output for hookmask
-      libxt_conntrack: respect -n option during ruledump
-      libiptc: make sockfd a per-handle thing
-      libxt_conntrack: dump ctdir
-      src: reuse the global modprobe_program variable
-      src: use NFPROTO_ constants
-      src: remove inclusion of iptables.h
-      doc: fix a typo in libip6t_REJECT.man
-      libiptc: guard chain index allocation for different malloc implementations
-      src: remove unused include files
-      iptables-save: output ! in position according to manpage
-      rateest: guard against segfault
-      env: augment deprecation notice
-      build: resolve autotools suggestions
-      doc: put iptables version into manpage
-      doc: resynchronize markup in iptables,ip6tables.8.in
-      doc: escape minus sign in manpages
-      build: use regular = assignments in Makefile
-      build: remove non-portable rule
-      doc: escape minus sign in manpage (2)
-      doc: augment ICMP manpage by type/code syntax
-      src: remove redundant returns at end of void-returning functions
-      src: remove redundant casts
-      libxt_owner: use correct UID/GID boundaries
-      extensions: use UINT_MAX constants over open-coded bits (1/2)
-      extensions: use UINT_MAX constants over open-coded numbers (2/2)
-      libxtables: prefix/order - fw_xalloc
-      libxtables: prefix/order - modprobe and xtables.ko loading
-      libxtables: prefix/order - match/target loading
-      libxtables: prefix/order - libdir
-      libxtables: prefix/order - strtoui
-      libxtables: prefix/order - program_name
-      libxtables: prefix/order - param_act
-      libxtables: prefix/order - ipaddr/ipmask to ascii output
-      libxtables: prefix/order - ascii to ipaddr/ipmask input
-      libxtables: prefix - misc functions
-      libxtables: prefix - parse and escaped output func
-      libxtables: prefix/order - move check_inverse to xtables.c
-      libxtables: prefix/order - move parse_protocol to xtables.c
-      libbxtables: prefix names and order it #1
-      libxtables: prefix names and order it #2
-      libxtables: prefix names and order #3
-      libxtables: move afinfo around
-      Merge branch 'origin/master'
-      libxtables: recognize IP6TABLES_LIB_DIR old-style environment variable
-      build: move -ldl to proper LDADD
-      libxtables: remove unused XT_LIB_DIR macro
-      libxtables: decouple non-xtables parts from header
-      src: remove iptables_rule_match indirection macro
-      src: remove unused ipt_tryload macro
-      libxtables: move compat defines to xtables.c
-      src: consolidate duplicate code in iptables/internal.h
-      libxtables: use const for vars holding literals
-      libxt_string: fix undefined behavior/incorrect patlen calculation
-      libxtables: flush before fork
-      libipq: add missing doc for NF_ values
-      build: restructure Makefile for include/ directory
-      libipq: fix compile error
-      build: remove unneeded -ldl from iptables_xml_LDADD
-      libiptc: make library available as a shared library
-      build: trigger reconfigure when extensions/GNUmakefile.in changes
-      doc: do not put IPv4 doc into ip6tables.8
-      doc: resynchronize manpage with in-code help
-      libxtables: inline and remove unused OPTION_OFFSET macro
-      libxtables: prefix exit_error to xtables_error
-      extensions: remove unwanted/add needed includes for IPv6 exts
-      extensions: remove unwanted/add needed includes for IPv4 exts
-      libxt_policy: use bounded strtoui
-      include: resynchronize headers with 2.6.29-rc5
-      extensions: add missing limits.h include
-      iptables: turn deprecation warning into enforcing mode
-      Merge commit 'nf/master'
-      libxt_connbytes: minor manpage adustments
-      libxt_connbytes: document nf_ct_acct behavior
-      libxtables: add -I/-L flags to pkgconfig files
-      libxt_comment: output quotes must be escaped in
-      iptables-save: module loading corrections
-
-Jesper Dangaard Brouer (3):
-      libiptc: fix chain rename bug in libiptc
-      libiptc: fix whitespaces and typos
-      libiptc: give credits to my self
-
-Jirí Moravec (1):
-      libxt_TOS: fix compilation error
-
-KOVACS Krisztian (2):
-      Add iptables support for the TPROXY target
-      Add iptables support for the socket match
-
-Marc Fournier (1):
-      doc: fix option typo in libxt_multiport
-
-Pablo Neira Ayuso (5):
-      iptables: fix error reporting with wrong/missing arguments
-      state: report spaces in the state list parsing
-      iptables: refer to dmesg when we hit error
-      string: fix wrong pattern length calculation
-      iptables: fix broken options-merging during libxtables rework
-
-Patrick McHardy (5):
-      Add SCTP/DCCP support to NAT targets
-      Bump version to 1.4.3-rc1
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Merge branch 'master' of git://dev.medozas.de/iptables
-      Bump version to 1.4.3
-
-Shaul Karl (1):
-      doc: fix one layout issue in iptables-restore.8
-
-Stephen Hemminger (1):
-      iptables: Add limits.h to get INT_MIN, INT_MAX, ...
-
-Thomas Jarosch (2):
-      Fix compile error in libxt_iprange.c using gcc 4.3.2
-      Fix compile warnings using gcc 4.3.2
-
-
-iptables v1.4.2 Changelog:
-======================================================================
-Changes from 1.4.2-rc1:
-
-Jan Engelhard (1):
-	build: fix iptables-static build
-
-Jan Engelhardt (26):
-	build: do not install ip{,6}tables.h
-	Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
-	manpages: name and markup fixes
-	src: remove dependency on libiptc headers
-	src: drop libiptc from installation
-	iptables-restore: fix segmentation fault with -tanything
-	libxt_recent: do not allow both --set and --rttl
-	Put xtables.c into its own library, libxtables.so
-	manpages: correct erroneous markup
-	physdev: remove extra space in output
-	Warn about use of DROP in nat table
-	Synchronize invert flag order with manpages
-	build: fix dependency tracking for xtables.h.in
-	build: fix initext.c dependency
-	manpages: add missing --rsource,--rdest options to libxt_recent.man
-	manpages: add missing rateest documentation
-	manpages: add missing rateest match documentation
-	libxt_mac: flatten casts in libxt_mac
-	libxt_iprange: fix option names
-	src: use regular includes
-	src: Update comments
-	build: prepare make tarball for git 1.6.0
-	libxt_recent: do allow --rttl for --update
-	src: update comments part II
-	build: run ldconfig on `make install`
-	doc: remove mentions of NAT in ip6tables manpage
-
-Jesper Dangaard Brouer (1):
-	libiptc: remove old fixme
-
-Pablo Sebastian Greco (1):
-	mark: fix invalid iptables-save output
-
-Patrick McHardy (2):
-	manpages: fix another typo in tcp manpage
-	v1.4.2
-
-Phil Oester (3):
-	iptables-save: fix hashlimit output
-	libxt_dscp: fix save of negated dscp match rules
-	src: Missing limits.h includes
-
-WANG Cong (1):
-	manpages: Fix a typo in tcp man page
-
-
-
-iptables v1.4.1-rc1 Changelog:
-======================================================================
-Changes from 1.4.0:
-
-Peter Warasin:
-	Fix CONNMARK mask initialisation
-
-Jesper Dangaard Brouer:
-	Inline functions iptcc_is_builtin() and set_changed()
-	Introduce a counter for number of user defined chains
-	Solving scalability issue: for chain list "name" searching
-
-Patrick McHardy:
-	Add RATEEST target extension
-	Add rateest match extension
-	Remove obsolete file
-	Add netfilter.h
-	Remove compiler.h inclusions
-	Retry ruleset dump when kernel returns EAGAIN
-
-Pablo Neira Ayuso:
-	Cleanup several code wraparounds
-	Check for malloc() return value in merge_opts()
-	Check for merge_opts() return value
-
-Jan Engelhardt:
-	Converts the iptables build infrastructure to autotools
-	Introduce strtonum()
-	Introduce common error messages
-	Add libxt_owner
-	Add libxt_tos
-	Add libxt_TOS
-	Add libxt_MARK r2
-	Add libxt_connmark r1
-	Print warning when dlopen fails
-	Add libxt_conntrack r0
-	Bunch o' renames
-	Rename overlapping function names
-	Add more libxt_hashlimit checks
-	Add libxt_mark r1
-	Add libxt_iprange r0
-	Add libxt_iprange r1
-	Give preference to iptables header files
-	Build adjustments
-	Add libxt_CONNMARK revision 1
-	Add libxt_conntrack revision 1
-	libxt_owner: UID/GID range support
-	Fix compilation of iptables-static build
-	Correct the family member value of libxt_mark revision 1
-	Makefile: add a "tarball" target
-	Drop -W from CFLAGS and some tiny code cleanups
-	Fix -Wshadow warnings and clean up xt_sctp.h
-	Update the libxt_owner manpage with the UID/GID-range feature
-	Fix all remaining warnings (missing declarations, missing prototypes)
-	xtables.h: move non-exported parts to internal.h
-	Add support for xt_hashlimit match revision 1
-	Combine IP{,6}T_LIB_DIR into XTABLES_LIBDIR
-	manpages: fix broken markup (missing close tags)
-	manpages: grammar and spelling
-	manpages: update to reflect fine-grained control
-	configure: split --enable-libipq from --enable-devel
-	Import iptables-apply
-	Add all necessary header files - compilation fix for various cases
-	Install libiptc header files because xtables.h depends on it
-	iptables: use C99 lists for struct options
-	RATEEST: add manpage
-	Implement AF_UNSPEC as a wildcard for extensions
-	Combine ipt and ip6t manpages
-	Resolve warnings on 64-bit compile
-	Wrap dlopen code into NO_SHARED_LIBS
-	Remove support for compilation of conditional extensions
-	Resolve libipt_set warnings
-	Update documentation about building the package
-	configure.ac: AC_SUBST must be separate
-	Dynamically create xtables.h.in with version
-	configure.ac: remove already-defined variables
-	Remove old functions, constants
-	Properly initialize revision for ip6tables targets
-	Makefile.am: use PACKAGE_TARNAME
-	iptables out-of-tree build directory
-
-Sven Schnelle:
-	Add libxt_TCPOPTSTRIP
-
-Max Kellermann:
-	Fix REDIRECT manpage
-	Whitespace cleanup
-	Use size_t
-	Escape strings
-	Unescape parameters
-	Allow empty strings in argument parser
-	Fix gcc warnings
-
-Naohiro Ooiwa:
-	Fix define value of SCTP chunk type
-
-Filippo Zangheri:
-	Remove useless white spaces from iptables-xml manpages
-
-James King:
-	libxt_iprange: Fix IP validation logic
-
-Shan Wei:
-	iptables-save: remove unnecessary code
-
-Henrik Nordstrom:
-	Make iptables-restore usable over a pipe
-	Add support for --set-counters to iptables -P
-	iptables --list-rules command
-	iptables --list chain rulenum
-	Make --set-counters (-c) accept comma separated counters
-
-Jamie Strandboge:
-	Fix ip6tables dest address printing
-
-
-
-iptables v1.4.1.1 Changelog
-=====================================================================
-
-Henrik Nordstrom (1):
-	iptables: fix printing of line numbers with --line-numbers arg
-
-Jan Engelhardt (3):
-	ip6tables: fix printing of ipv6 network masks
-	build: fix `make install` when --disable-shared is used
-	iprange: kernel flags were not set
-
-Patrick McHardy (1):
-	v1.4.1.1
-
-
-
-iptables v1.4.1 Changelog
-======================================================================
-
-Filippo Zangheri (1):
-	removes useless white spaces from iptables-xml manpages.
-
-Gáspár Lajos (1):
-	iptables: use C99 lists for struct options
-
-Henrik Nordstrom (5):
-	Make iptables-restore usable over a pipe
-	Add support for --set-counters to iptables -P
-	iptables --list-rules command
-	iptables --list chain rulenum
-	Make --set-counters (-c) accept comma separated counters
-
-James King (1):
-	[IPTABLES]: libxt_iprange: Fix IP validation logic
-
-Jamie Strandboge (1):
-	fix ip6tables dest address printing
-
-Jan Engelhardt (55):
-	Converts the iptables build infrastructure to autotools.
-	Introduce strtonum(), which works like string_to_number(), but passes
-	common error messages
-	libxt_owner
-	libxt_tos
-	libxt_TOS
-	libxt_MARK r2
-	libxt_connmark r1
-	print warning when dlopen fails
-	libxt_conntrack r0
-	bunch o' renames
-	rename overlapping function names
-	libxt_hashlimit checks
-	libxt_mark r1
-	libxt_iprange r0
-	libxt_iprange r1
-	Give preference to iptables header files
-	Build adjustments
-	libxt_CONNMARK revision 1
-	[IPTABLES]: libxt_conntrack revision 1
-	[IPTABLES]: libxt_owner: UID/GID range support
-	Fix compilation of iptables-static build
-	Correct the family member value of libxt_mark revision 1
-	Makefile: add a "tarball" target
-	Drop -W from CFLAGS and some tiny code cleanups
-	Fix -Wshadow warnings and clean up xt_sctp.h
-	Update the libxt_owner manpage with the UID/GID-range feature
-	Fix all remaining warnings (missing declarations, missing prototypes)
-	xtables.h: move non-exported parts to internal.h
-	Add support for xt_hashlimit match revision 1
-	Combine IP{,6}T_LIB_DIR into XTABLES_LIBDIR
-	manpages: fix broken markup (missing close tags)
-	manpages: grammar and spelling
-	manpages: update to reflect fine-grained control
-	configure: split --enable-libipq from --enable-devel
-	Add all necessary header files - compilation fix for various cases
-	Install libiptc header files because xtables.h depends on it
-	RATEEST: add manpage
-	Implement AF_UNSPEC as a wildcard for extensions
-	Combine ipt and ip6t manpages
-	Resolve warnings on 64-bit compile
-	Wrap dlopen code into NO_SHARED_LIBS
-	Remove support for compilation of conditional extensions
-	Resolve libipt_set warnings
-	Update documentation about building the package
-	configure.ac: AC_SUBST must be separate