update iptables to 1.4.0 (2.6 kernels only), refresh kernel patches

SVN-Revision: 10843

14 files changed, 2037 insertions, 527 deletions

diff --git a/package/iptables/patches/008-chaostables.patch b/package/iptables/patches/008-chaostables.patch
deleted file mode 100644
index 60b077942a..0000000000
--- a/package/iptables/patches/008-chaostables.patch
+++ /dev/null
@@ -1,342 +0,0 @@
-Index: iptables-1.3.8/extensions/.CHAOS-test
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/.CHAOS-test	2007-07-31 15:27:57.000000000 -0500
-@@ -0,0 +1,2 @@
-+#!/bin/sh
-+[ -f "$KERNEL_DIR/include/linux/netfilter/xt_CHAOS.h" ] && echo "CHAOS";
-Index: iptables-1.3.8/extensions/.DELUDE-test
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/.DELUDE-test	2007-07-31 15:27:57.000000000 -0500
-@@ -0,0 +1,2 @@
-+#!/bin/sh
-+echo "DELUDE";
-Index: iptables-1.3.8/extensions/libipt_CHAOS.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_CHAOS.c	2007-07-31 15:27:57.000000000 -0500
-@@ -0,0 +1,111 @@
-+/*
-+    CHAOS target for iptables
-+
-+    Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
-+    released under the terms of the GNU General Public
-+    License version 2.x and only versions 2.x.
-+*/
-+#include <getopt.h>
-+#include <stdio.h>
-+#include <string.h>
-+
-+#include <iptables.h>
-+#include <linux/netfilter_ipv4/ip_tables.h>
-+#include <linux/netfilter/xt_CHAOS.h>
-+
-+static void libipt_chaos_help(void)
-+{
-+	printf(
-+		"CHAOS target v%s options:\n"
-+		"  --delude     Enable DELUDE processing for TCP\n"
-+		"  --tarpit     Enable TARPIT processing for TCP\n",
-+		IPTABLES_VERSION);
-+	return;
-+}
-+
-+static int libipt_chaos_parse(int c, char **argv, int invert,
-+    unsigned int *flags, const struct ipt_entry *entry,
-+    struct ipt_entry_target **target)
-+{
-+	struct xt_chaos_info *info = (void *)((*target)->data);
-+	switch(c) {
-+		case 'd':
-+			info->variant = XTCHAOS_DELUDE;
-+			*flags |= 0x02;
-+			return 1;
-+		case 't':
-+			info->variant = XTCHAOS_TARPIT;
-+			*flags |= 0x01;
-+			return 1;
-+	}
-+	return 0;
-+}
-+
-+static void libipt_chaos_check(unsigned int flags)
-+{
-+	if(flags != 0x03)
-+		return;
-+	/* If flags == 0x03, both were specified, which should not be. */
-+	exit_error(PARAMETER_PROBLEM,
-+	           "CHAOS: only one of --tarpit or --delude may be specified");
-+	return;
-+}
-+
-+static void libipt_chaos_print(const struct ipt_ip *ip,
-+    const struct ipt_entry_target *target, int numeric)
-+{
-+	const struct xt_chaos_info *info = (const void *)target->data;
-+	switch(info->variant) {
-+		case XTCHAOS_DELUDE:
-+			printf("DELUDE ");
-+			break;
-+		case XTCHAOS_TARPIT:
-+			printf("TARPIT ");
-+			break;
-+		default:
-+			break;
-+	}
-+	return;
-+}
-+
-+static void libipt_chaos_save(const struct ipt_ip *ip,
-+    const struct ipt_entry_target *target)
-+{
-+	const struct xt_chaos_info *info = (const void *)target->data;
-+	switch(info->variant) {
-+		case XTCHAOS_DELUDE:
-+			printf("--delude ");
-+			break;
-+		case XTCHAOS_TARPIT:
-+			printf("--tarpit ");
-+			break;
-+		default:
-+			break;
-+	}
-+	return;
-+}
-+
-+static struct option libipt_chaos_opts[] = {
-+	{"delude", 0, NULL, 'd'},
-+	{"tarpit", 0, NULL, 't'},
-+	{NULL},
-+};
-+
-+static struct iptables_target libipt_chaos_info = {
-+	.name          = "CHAOS",
-+	.version       = IPTABLES_VERSION,
-+	.size          = IPT_ALIGN(sizeof(struct xt_chaos_info)),
-+	.userspacesize = IPT_ALIGN(sizeof(struct xt_chaos_info)),
-+	.help          = libipt_chaos_help,
-+	.parse         = libipt_chaos_parse,
-+	.final_check   = libipt_chaos_check,
-+	.print         = libipt_chaos_print,
-+	.save          = libipt_chaos_save,
-+	.extra_opts    = libipt_chaos_opts,
-+};
-+
-+static __attribute__((constructor)) void libipt_chaos_init(void)
-+{
-+	register_target(&libipt_chaos_info);
-+	return;
-+}
-Index: iptables-1.3.8/extensions/libipt_DELUDE.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_DELUDE.c	2007-07-31 15:27:57.000000000 -0500
-@@ -0,0 +1,66 @@
-+/*
-+    DELUDE target for iptables
-+
-+    Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
-+    released under the terms of the GNU General Public
-+    License version 2.x and only versions 2.x.
-+*/
-+#include <getopt.h>
-+#include <stdio.h>
-+#include <string.h>
-+
-+#include <iptables.h>
-+#include <linux/netfilter_ipv4/ip_tables.h>
-+
-+static void libipt_delude_help(void)
-+{
-+	printf("DELUDE takes no options\n");
-+	return;
-+}
-+
-+static int libipt_delude_parse(int c, char **argv, int invert,
-+    unsigned int *flags, const struct ipt_entry *entry,
-+    struct ipt_entry_target **target)
-+{
-+	return 0;
-+}
-+
-+static void libipt_delude_check(unsigned int flags)
-+{
-+	return;
-+}
-+
-+static void libipt_delude_print(const struct ipt_ip *ip,
-+    const struct ipt_entry_target *target, int numeric)
-+{
-+	return;
-+}
-+
-+static void libipt_delude_save(const struct ipt_ip *ip,
-+    const struct ipt_entry_target *target)
-+{
-+	return;
-+}
-+
-+static struct option libipt_delude_opts[] = {
-+	{NULL},
-+};
-+
-+static struct iptables_target libipt_delude_info = {
-+	.name          = "DELUDE",
-+	.version       = IPTABLES_VERSION,
-+	.size          = IPT_ALIGN(0),
-+	.userspacesize = IPT_ALIGN(0),
-+	.help          = libipt_delude_help,
-+	.parse         = libipt_delude_parse,
-+	.final_check   = libipt_delude_check,
-+	.print         = libipt_delude_print,
-+	.save          = libipt_delude_save,
-+	.extra_opts    = libipt_delude_opts,
-+};
-+
-+static __attribute__((constructor)) void libipt_delude_init(void)
-+{
-+	register_target(&libipt_delude_info);
-+	return;
-+}
-Index: iptables-1.3.8/extensions/libipt_portscan.c
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_portscan.c	2007-07-31 15:27:57.000000000 -0500
-@@ -0,0 +1,129 @@
-+/*
-+    portscan match for iptables
-+
-+    Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
-+    released under the terms of the GNU General Public
-+    License version 2.x and only versions 2.x.
-+*/
-+#include <stdio.h>
-+#include <string.h>
-+#include <stdlib.h>
-+#include <getopt.h>
-+
-+#include <iptables.h>
-+#include <linux/netfilter_ipv4/ip_tables.h>
-+#include <linux/netfilter/xt_portscan.h>
-+
-+static void libipt_portscan_help(void)
-+{
-+	printf(
-+		"portscan match v%s options:\n"
-+		"(Combining them will make them match by OR-logic)\n"
-+		"  --stealth    Match TCP Stealth packets\n"
-+		"  --synscan    Match TCP SYN scans\n"
-+		"  --cnscan     Match TCP Connect scans\n"
-+		"  --grscan     Match Banner Grabbing scans\n",
-+		IPTABLES_VERSION);
-+	return;
-+}
-+
-+static void libipt_portscan_mtinit(struct ipt_entry_match *match,
-+    unsigned int *nfcache)
-+{
-+	/* Cannot cache this */
-+	*nfcache |= NFC_UNKNOWN;
-+	return;
-+}
-+
-+static int libipt_portscan_parse(int c, char **argv, int invert,
-+    unsigned int *flags, const struct ipt_entry *entry, unsigned int *nfc,
-+    struct ipt_entry_match **match)
-+{
-+	struct xt_portscan_info *info = (void *)((*match)->data);
-+
-+	switch(c) {
-+		case 'c':
-+			info->match_cn = 1;
-+			return 1;
-+		case 'g':
-+			info->match_gr = 1;
-+			return 1;
-+		case 's':
-+			info->match_syn = 1;
-+			return 1;
-+		case 'x':
-+			info->match_stealth = 1;
-+			return 1;
-+		default:
-+			return 0;
-+	}
-+}
-+
-+static void libipt_portscan_check(unsigned int flags)
-+{
-+	return;
-+}
-+
-+static void libipt_portscan_print(const struct ipt_ip *ip,
-+    const struct ipt_entry_match *match, int numeric)
-+{
-+	const struct xt_portscan_info *info = (const void *)(match->data);
-+	const char *s = "";
-+
-+	printf("portscan ");
-+	if(info->match_stealth) {
-+		printf("STEALTH");
-+		s = ",";
-+	}
-+	if(info->match_syn) {
-+		printf("%sSYNSCAN", s);
-+		s = ",";
-+	}
-+	if(info->match_cn) {
-+		printf("%sCNSCAN", s);
-+		s = ",";
-+	}
-+	if(info->match_gr)
-+		printf("%sGRSCAN", s);
-+	printf(" ");
-+	return;
-+}
-+
-+static void libipt_portscan_save(const struct ipt_ip *ip,
-+    const struct ipt_entry_match *match)
-+{
-+	const struct xt_portscan_info *info = (const void *)(match->data);
-+	if(info->match_stealth)	printf("--stealth ");
-+	if(info->match_syn)	printf("--synscan ");
-+	if(info->match_cn)	printf("--cnscan ");
-+	if(info->match_gr)	printf("--grscan ");
-+	return;
-+}
-+
-+static struct option libipt_portscan_opts[] = {
-+	{"stealth", 0, NULL, 'x'},
-+	{"synscan", 0, NULL, 's'},
-+	{"cnscan",  0, NULL, 'c'},
-+	{"grscan",  0, NULL, 'g'},
-+	{NULL},
-+};
-+
-+static struct iptables_match libipt_portscan_info = {
-+	.name          = "portscan",
-+	.version       = IPTABLES_VERSION,
-+	.size          = IPT_ALIGN(sizeof(struct xt_portscan_info)),
-+	.userspacesize = IPT_ALIGN(sizeof(struct xt_portscan_info)),
-+	.help          = libipt_portscan_help,
-+	.init          = libipt_portscan_mtinit,
-+	.parse         = libipt_portscan_parse,
-+	.final_check   = libipt_portscan_check,
-+	.print         = libipt_portscan_print,
-+	.save          = libipt_portscan_save,
-+	.extra_opts    = libipt_portscan_opts,
-+};
-+
-+static __attribute__((constructor)) void libipt_portscan_init(void)
-+{
-+	register_match(&libipt_portscan_info);
-+	return;
-+}
-Index: iptables-1.3.8/extensions/.portscan-test
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/.portscan-test	2007-07-31 15:27:57.000000000 -0500
-@@ -0,0 +1,2 @@
-+#!/bin/sh
-+[ -f "$KERNEL_DIR/include/linux/netfilter/xt_portscan.h" ] && echo "portscan";
diff --git a/package/iptables/patches/009-tarpit-support.patch b/package/iptables/patches/009-tarpit-support.patch
deleted file mode 100644
index 3105379877..0000000000
--- a/package/iptables/patches/009-tarpit-support.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.c iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c
---- iptables-1.3.8-20070817/extensions/libipt_TARPIT.c	1969-12-31 19:00:00.000000000 -0500
-+++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.c	2007-08-18 14:49:25.000000000 -0400
-@@ -0,0 +1,58 @@
-+/* Shared library add-on to iptables for TARPIT support */
-+#include <stdio.h>
-+#include <getopt.h>
-+#include <iptables.h>
-+
-+static void
-+help(void)
-+{
-+	fputs(
-+"TARPIT takes no options\n"
-+"\n", stdout);
-+}
-+
-+static struct option opts[] = {
-+	{ 0 }
-+};
-+
-+static int
-+parse(int c, char **argv, int invert, unsigned int *flags,
-+      const struct ipt_entry *entry,
-+      struct ipt_entry_target **target)
-+{
-+	return 0;
-+}
-+
-+static void final_check(unsigned int flags)
-+{
-+}
-+
-+static void
-+print(const struct ipt_ip *ip,
-+      const struct ipt_entry_target *target,
-+      int numeric)
-+{
-+}
-+
-+static void save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
-+{
-+}
-+
-+static struct iptables_target tarpit = {
-+	.next		= NULL,
-+	.name		= "TARPIT",
-+	.version	= IPTABLES_VERSION,
-+	.size		= IPT_ALIGN(0),
-+	.userspacesize	= IPT_ALIGN(0),
-+	.help		= &help,
-+	.parse		= &parse,
-+	.final_check	= &final_check,
-+	.print		= &print,
-+	.save		= &save,
-+	.extra_opts	= opts
-+};
-+
-+void _init(void)
-+{
-+	register_target(&tarpit);
-+}
-diff -N -u -r iptables-1.3.8-20070817/extensions/libipt_TARPIT.man iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man
---- iptables-1.3.8-20070817/extensions/libipt_TARPIT.man	1969-12-31 19:00:00.000000000 -0500
-+++ iptables-1.3.8-20070817-nf/extensions/libipt_TARPIT.man	2007-08-18 14:49:25.000000000 -0400
-@@ -0,0 +1,34 @@
-+Captures and holds incoming TCP connections using no local
-+per-connection resources. Connections are accepted, but immediately
-+switched to the persist state (0 byte window), in which the remote
-+side stops sending data and asks to continue every 60-240 seconds.
-+Attempts to close the connection are ignored, forcing the remote side
-+to time out the connection in 12-24 minutes.
-+
-+This offers similar functionality to LaBrea
-+<http://www.hackbusters.net/LaBrea/> but doesn't require dedicated
-+hardware or IPs. Any TCP port that you would normally DROP or REJECT
-+can instead become a tarpit.
-+
-+To tarpit connections to TCP port 80 destined for the current machine:
-+.IP
-+iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT
-+.P
-+To significantly slow down Code Red/Nimda-style scans of unused address
-+space, forward unused ip addresses to a Linux box not acting as a router
-+(e.g. "ip route 10.0.0.0 255.0.0.0 ip.of.linux.box" on a Cisco), enable IP
-+forwarding on the Linux box, and add:
-+.IP
-+iptables -A FORWARD -p tcp -j TARPIT
-+.IP
-+iptables -A FORWARD -j DROP
-+.TP
-+NOTE:
-+If you use the conntrack module while you are using TARPIT, you should
-+also use the NOTRACK target, or the kernel will unnecessarily allocate
-+resources for each TARPITted connection. To TARPIT incoming
-+connections to the standard IRC port while using conntrack, you could:
-+.IP
-+iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
-+.IP
-+iptables -A INPUT -p tcp --dport 6667 -j TARPIT
-diff -N -u -r iptables-1.3.8-20070817/extensions/.TARPIT-test iptables-1.3.8-20070817-nf/extensions/.TARPIT-test
---- iptables-1.3.8-20070817/extensions/.TARPIT-test	1969-12-31 19:00:00.000000000 -0500
-+++ iptables-1.3.8-20070817-nf/extensions/.TARPIT-test	2007-08-18 14:49:25.000000000 -0400
-@@ -0,0 +1,2 @@
-+#! /bin/sh
-+[ -f $KERNEL_DIR/net/netfilter/xt_TARPIT.c ] && echo TARPIT
diff --git a/package/iptables/patches/001-ipp2p-0.8.1rc1.patch b/package/iptables/patches/1.3.8/001-ipp2p_0.8.1rc1.patch
index 7ca62d2140..e8c82c2155 100644
--- a/package/iptables/patches/001-ipp2p-0.8.1rc1.patch
+++ b/package/iptables/patches/1.3.8/001-ipp2p_0.8.1rc1.patch
@@ -1,8 +1,8 @@
 Index: iptables-1.3.8/extensions/Makefile
 ===================================================================
---- iptables-1.3.8.orig/extensions/Makefile	2007-07-31 15:27:55.000000000 -0500
-+++ iptables-1.3.8/extensions/Makefile	2007-07-31 15:27:55.000000000 -0500
-@@ -13,6 +13,10 @@
+--- iptables-1.3.8.orig/extensions/Makefile
++++ iptables-1.3.8/extensions/Makefile
+@@ -13,6 +13,10 @@ PF_EXT_SE_SLIB:=SECMARK CONNSECMARK
  PF6_EXT_SE_SLIB:=SECMARK CONNSECMARK
  endif
  
@@ -15,8 +15,8 @@ Index: iptables-1.3.8/extensions/Makefile
  PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
 Index: iptables-1.3.8/extensions/libipt_ipp2p.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_ipp2p.c	2007-07-31 15:27:55.000000000 -0500
+--- /dev/null
++++ iptables-1.3.8/extensions/libipt_ipp2p.c
 @@ -0,0 +1,401 @@
 +
 +#include <stdio.h>
@@ -421,8 +421,8 @@ Index: iptables-1.3.8/extensions/libipt_ipp2p.c
 +
 Index: iptables-1.3.8/include/linux/netfilter_ipv4/ipt_ipp2p.h
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/include/linux/netfilter_ipv4/ipt_ipp2p.h	2007-07-31 15:27:55.000000000 -0500
+--- /dev/null
++++ iptables-1.3.8/include/linux/netfilter_ipv4/ipt_ipp2p.h
 @@ -0,0 +1,31 @@
 +#ifndef __IPT_IPP2P_H
 +#define __IPT_IPP2P_H
diff --git a/package/iptables/patches/002-layer7-1.5nbd.patch b/package/iptables/patches/1.3.8/002-layer7_2.17.patch
index ef80c8f0cc..68da741e00 100644
--- a/package/iptables/patches/002-layer7-1.5nbd.patch
+++ b/package/iptables/patches/1.3.8/002-layer7_2.17.patch
@@ -1,48 +1,15 @@
 Index: iptables-1.3.8/extensions/.layer7-test
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/.layer7-test	2007-07-31 15:27:56.000000000 -0500
-@@ -0,0 +1,3 @@
+--- /dev/null
++++ iptables-1.3.8/extensions/.layer7-test
+@@ -0,0 +1,2 @@
 +#! /bin/sh
 +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_layer7.h ] && echo layer7
-+[ -f $KERNEL_DIR/include/linux/netfilter/xt_layer7.h ] && echo layer7
-Index: iptables-1.3.8/extensions/ipt_layer7.h
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/ipt_layer7.h	2007-07-31 15:27:56.000000000 -0500
-@@ -0,0 +1,27 @@
-+/* 
-+  By Matthew Strait <quadong@users.sf.net>, Dec 2003.
-+  http://l7-filter.sf.net
-+
-+  This program is free software; you can redistribute it and/or
-+  modify it under the terms of the GNU General Public License
-+  as published by the Free Software Foundation; either version
-+  2 of the License, or (at your option) any later version.
-+  http://www.gnu.org/licenses/gpl.txt
-+*/
-+
-+#ifndef _IPT_LAYER7_H
-+#define _IPT_LAYER7_H
-+
-+#define MAX_PATTERN_LEN 8192
-+#define MAX_PROTOCOL_LEN 256
-+
-+typedef char *(*proc_ipt_search) (char *, char, char *);
-+
-+struct ipt_layer7_info {
-+    char protocol[MAX_PROTOCOL_LEN];
-+    char invert:1;
-+    char pattern[MAX_PATTERN_LEN];
-+	char pkt;
-+};
-+
-+#endif /* _IPT_LAYER7_H */
 Index: iptables-1.3.8/extensions/libipt_layer7.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_layer7.c	2007-07-31 15:27:56.000000000 -0500
-@@ -0,0 +1,358 @@
+--- /dev/null
++++ iptables-1.3.8/extensions/libipt_layer7.c
+@@ -0,0 +1,394 @@
 +/* 
 +   Shared library add-on to iptables to add layer 7 matching support. 
 +  
@@ -69,7 +36,7 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +#include <dirent.h>
 +
 +#include <iptables.h>
-+#include "ipt_layer7.h"
++#include <linux/netfilter_ipv4/ipt_layer7.h>
 +
 +#define MAX_FN_LEN 256
 +
@@ -82,8 +49,7 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +	"LAYER7 match v%s options:\n"
 +	"--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
 +	"                       (--l7dir must be specified before --l7proto if used!)\n"
-+	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n"
-+	"--l7pkt              : Skip connection tracking and match individual packets\n",
++	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
 +	IPTABLES_VERSION);
 +	fputc('\n', stdout);
 +}
@@ -91,7 +57,6 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +static struct option opts[] = {
 +	{ .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
 +	{ .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
-+	{ .name = "l7pkt",   .has_arg = 0, .flag = 0, .val = '3' },
 +	{ .name = 0 }
 +};
 +
@@ -120,10 +85,25 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +
 +		if(datatype == protocol)
 +		{
++			/* Ignore everything on the line beginning with the 
++			first space or tab . For instance, this allows the 
++			protocol line in http.pat to be "http " (or 
++			"http I am so cool") instead of just "http". */
++			if(strchr(line, ' ')){
++				char * space = strchr(line, ' ');
++				space[0] = '\0';
++			}
++			if(strchr(line, '\t')){
++				char * space = strchr(line, '\t');
++				space[0] = '\0';
++			}
++
++			/* sanity check.  First non-comment non-blank 
++			line must be the same as the file name. */
 +			if(strcmp(line, protoname))
 +				exit_error(OTHER_PROBLEM, 
 +					"Protocol name (%s) doesn't match file name (%s).  Bailing out\n",
-+					protoname, filename);
++					line, filename);
 +
 +			if(strlen(line) >= MAX_PROTOCOL_LEN)
 +				 exit_error(PARAMETER_PROBLEM, 
@@ -191,6 +171,35 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +                        /* carefully remember to call tolower here... */
 +                        result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
 +                                                  hex2dec(s[sindex + 3] ) );
++
++			switch ( result[rindex] )
++			{
++			case 0x24:
++			case 0x28:
++			case 0x29:
++			case 0x2a:
++			case 0x2b:
++			case 0x2e:
++			case 0x3f:
++			case 0x5b:
++			case 0x5c:
++			case 0x5d:
++			case 0x5e:
++			case 0x7c:
++				fprintf(stderr, 
++					"Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n"
++					"I recommend that you write this as %c or \\%c, depending on what you meant.\n",
++					result[rindex], s[sindex + 2], s[sindex + 3], result[rindex], result[rindex]);
++				break;
++			case 0x00:
++				fprintf(stderr, 
++					"Warning: null (\\x00) in layer7 regexp.  A null terminates the regexp string!\n");
++				break;
++			default:
++				break;
++			}
++
++
 +                        sindex += 3; /* 4 total */
 +                }
 +                else
@@ -336,9 +345,6 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +
 +		*flags = 1;
 +		break;
-+	case '3':
-+		layer7info->pkt = 1;
-+		break;
 +
 +	default:
 +		return 0;
@@ -347,12 +353,12 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +	return 1;
 +}
 +
-+/* Final check; must have specified --pattern. */
++/* Final check; must have specified --l7proto */
 +static void final_check(unsigned int flags)
 +{
 +	if (!flags)
 +		exit_error(PARAMETER_PROBLEM,
-+			   "LAYER7 match: You must specify `--pattern'");
++			   "LAYER7 match: You must specify `--l7proto'");
 +}
 +
 +static void print_protocol(char s[], int invert, int numeric)
@@ -371,9 +377,6 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +
 +	print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
 +		  ((struct ipt_layer7_info *)match->data)->invert, numeric);
-+
-+	if (((struct ipt_layer7_info *)match->data)->pkt)
-+		printf("l7pkt ");
 +}
 +/* Saves the union ipt_matchinfo in parsable form to stdout. */
 +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
@@ -403,9 +406,9 @@ Index: iptables-1.3.8/extensions/libipt_layer7.c
 +}
 Index: iptables-1.3.8/extensions/libipt_layer7.man
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_layer7.man	2007-07-31 15:27:56.000000000 -0500
-@@ -0,0 +1,13 @@
+--- /dev/null
++++ iptables-1.3.8/extensions/libipt_layer7.man
+@@ -0,0 +1,14 @@
 +This module matches packets based on the application layer data of 
 +their connections.  It uses regular expression matching to compare 
 +the application layer data to regular expressions found it the layer7 
@@ -414,8 +417,9 @@ Index: iptables-1.3.8/extensions/libipt_layer7.man
 +.TP
 +.BI "--l7proto " "\fIprotocol\fP"
 +Match the specified protocol.  The protocol name must match a file 
-+name in /etc/l7-protocols/
++name in /etc/l7-protocols/ or one of its first-level child directories.
 +.TP
 +.BI "--l7dir " "\fIdirectory\fP"
-+Use \fIdirectory\fP instead of /etc/l7-protocols/
++Use \fIdirectory\fP instead of /etc/l7-protocols/.  This option must be 
++specified before --l7proto.
 +
diff --git a/package/iptables/patches/1.3.8/003-layer7_2.17_pktmatch.patch b/package/iptables/patches/1.3.8/003-layer7_2.17_pktmatch.patch
new file mode 100644
index 0000000000..c88f759630
--- /dev/null
+++ b/package/iptables/patches/1.3.8/003-layer7_2.17_pktmatch.patch
@@ -0,0 +1,42 @@
+Index: iptables-1.3.8/extensions/libipt_layer7.c
+===================================================================
+--- iptables-1.3.8.orig/extensions/libipt_layer7.c
++++ iptables-1.3.8/extensions/libipt_layer7.c
+@@ -37,7 +37,8 @@ static void help(void)
+ 	"LAYER7 match v%s options:\n"
+ 	"--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
+ 	"                       (--l7dir must be specified before --l7proto if used!)\n"
+-	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
++	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n"
++	"--l7pkt              : Skip connection tracking and match individual packets\n",
+ 	IPTABLES_VERSION);
+ 	fputc('\n', stdout);
+ }
+@@ -45,6 +46,7 @@ static void help(void)
+ static struct option opts[] = {
+ 	{ .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
+ 	{ .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
++	{ .name = "l7pkt",   .has_arg = 0, .flag = 0, .val = '3' },
+ 	{ .name = 0 }
+ };
+ 
+@@ -333,6 +335,9 @@ static int parse(int c, char **argv, int
+ 
+ 		*flags = 1;
+ 		break;
++	case '3':
++		layer7info->pkt = 1;
++		break;
+ 
+ 	default:
+ 		return 0;
+@@ -365,6 +370,9 @@ static void print(const struct ipt_ip *i
+ 
+ 	print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
+ 		  ((struct ipt_layer7_info *)match->data)->invert, numeric);
++
++	if (((struct ipt_layer7_info *)match->data)->pkt)
++		printf("l7pkt ");
+ }
+ /* Saves the union ipt_matchinfo in parsable form to stdout. */
+ static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
diff --git a/package/iptables/patches/004-multiport_v1.patch b/package/iptables/patches/1.3.8/004-drop_multiport_v0_support.patch
index 1acfe24848..e5cbeb6f34 100644
--- a/package/iptables/patches/004-multiport_v1.patch
+++ b/package/iptables/patches/1.3.8/004-drop_multiport_v0_support.patch
@@ -1,7 +1,7 @@
 Index: iptables-1.3.8/extensions/libipt_multiport.c
 ===================================================================
---- iptables-1.3.8.orig/extensions/libipt_multiport.c	2007-07-31 15:27:55.000000000 -0500
-+++ iptables-1.3.8/extensions/libipt_multiport.c	2007-07-31 15:27:56.000000000 -0500
+--- iptables-1.3.8.orig/extensions/libipt_multiport.c
++++ iptables-1.3.8/extensions/libipt_multiport.c
 @@ -8,24 +8,6 @@
  /* To ensure that iptables compiles with an old kernel */
  #include "../include/linux/netfilter_ipv4/ipt_multiport.h"
@@ -27,7 +27,7 @@ Index: iptables-1.3.8/extensions/libipt_multiport.c
  static void
  help_v1(void)
  {
-@@ -70,26 +52,6 @@
+@@ -70,26 +52,6 @@ proto_to_name(u_int8_t proto)
  	}
  }
  
@@ -54,7 +54,7 @@ Index: iptables-1.3.8/extensions/libipt_multiport.c
  static void
  parse_multi_ports_v1(const char *portstring, 
  		     struct ipt_multiport_v1 *multiinfo,
-@@ -156,58 +118,6 @@
+@@ -156,58 +118,6 @@ check_proto(const struct ipt_entry *entr
  			   "multiport only works with TCP, UDP, UDPLITE, SCTP and DCCP");
  }
  
@@ -113,7 +113,7 @@ Index: iptables-1.3.8/extensions/libipt_multiport.c
  static int
  parse_v1(int c, char **argv, int invert, unsigned int *flags,
  	 const struct ipt_entry *entry,
-@@ -284,43 +194,6 @@
+@@ -284,43 +194,6 @@ print_port(u_int16_t port, u_int8_t prot
  		printf("%s", service);
  }
  
@@ -157,7 +157,7 @@ Index: iptables-1.3.8/extensions/libipt_multiport.c
  static void
  print_v1(const struct ipt_ip *ip,
  	 const struct ipt_entry_match *match,
-@@ -364,34 +237,6 @@
+@@ -364,34 +237,6 @@ print_v1(const struct ipt_ip *ip,
  	printf(" ");
  }
  
@@ -192,7 +192,7 @@ Index: iptables-1.3.8/extensions/libipt_multiport.c
  static void save_v1(const struct ipt_ip *ip, 
  		    const struct ipt_entry_match *match)
  {
-@@ -427,19 +272,20 @@
+@@ -427,19 +272,20 @@ static void save_v1(const struct ipt_ip 
  	printf(" ");
  }
  
diff --git a/package/iptables/patches/005-imq1.patch b/package/iptables/patches/1.3.8/005-imq1.patch
index a3741959cf..f17ddeafd6 100644
--- a/package/iptables/patches/005-imq1.patch
+++ b/package/iptables/patches/1.3.8/005-imq1.patch
@@ -1,15 +1,15 @@
 Index: iptables-1.3.8/extensions/.IMQ-test6
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/.IMQ-test6	2007-07-31 15:27:56.000000000 -0500
+--- /dev/null
++++ iptables-1.3.8/extensions/.IMQ-test6
 @@ -0,0 +1,3 @@
 +#!/bin/sh
 +# True if IMQ target patch is applied.
 +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_IMQ.c ] && echo IMQ
 Index: iptables-1.3.8/extensions/libip6t_IMQ.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libip6t_IMQ.c	2007-07-31 15:27:56.000000000 -0500
+--- /dev/null
++++ iptables-1.3.8/extensions/libip6t_IMQ.c
 @@ -0,0 +1,101 @@
 +/* Shared library add-on to iptables to add IMQ target support. */
 +#include <stdio.h>
@@ -114,16 +114,16 @@ Index: iptables-1.3.8/extensions/libip6t_IMQ.c
 +}
 Index: iptables-1.3.8/extensions/.IMQ-test
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/.IMQ-test	2007-07-31 15:27:56.000000000 -0500
+--- /dev/null
++++ iptables-1.3.8/extensions/.IMQ-test
 @@ -0,0 +1,3 @@
 +#!/bin/sh
 +# True if IMQ target patch is applied.
 +[ -f $KERNEL_DIR/net/ipv4/netfilter/ipt_IMQ.c ] && echo IMQ
 Index: iptables-1.3.8/extensions/libipt_IMQ.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ iptables-1.3.8/extensions/libipt_IMQ.c	2007-07-31 15:27:56.000000000 -0500
+--- /dev/null
++++ iptables-1.3.8/extensions/libipt_IMQ.c
 @@ -0,0 +1,101 @@
 +/* Shared library add-on to iptables to add IMQ target support. */
 +#include <stdio.h>
diff --git a/package/iptables/patches/1.4.0/001-ipp2p-0.8.1rc1.patch b/package/iptables/patches/1.4.0/001-ipp2p-0.8.1rc1.patch
new file mode 100644
index 0000000000..3b32b948b3
--- /dev/null
+++ b/package/iptables/patches/1.4.0/001-ipp2p-0.8.1rc1.patch
@@ -0,0 +1,454 @@
+Index: iptables-1.4.0/extensions/Makefile
+===================================================================
+--- iptables-1.4.0.orig/extensions/Makefile
++++ iptables-1.4.0/extensions/Makefile
+@@ -19,6 +19,10 @@ PF6_EXT_SE_SLIB:=$(PF6_EXT_SELINUX_SLIB)
+ PFX_EXT_SE_SLIB:=$(PFX_EXT_SELINUX_SLIB)
+ endif
+ 
++
++# ipp2p
++PF_EXT_SLIB += ipp2p
++
+ # Optionals
+ PF_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
+ PF6_EXT_SLIB_OPTS:=$(foreach T,$(wildcard extensions/.*-test6),$(shell KERNEL_DIR=$(KERNEL_DIR) $(T)))
+Index: iptables-1.4.0/extensions/libipt_ipp2p.c
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libipt_ipp2p.c
+@@ -0,0 +1,398 @@
++
++#include <stdio.h>
++#include <netdb.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++#include <ctype.h>
++
++#include <iptables.h>
++
++#include <linux/netfilter_ipv4/ipt_ipp2p.h>
++
++static void
++help(void)
++{
++    printf(
++    "IPP2P v%s options:\n"
++    " --ipp2p	Grab all known p2p packets\n"
++    " --edk		[TCP&UDP]	All known eDonkey/eMule/Overnet packets\n"
++    " --dc		[TCP] 		All known Direct Connect packets\n"
++    " --kazaa	[TCP&UDP] 	All known KaZaA packets\n"
++    " --gnu		[TCP&UDP]	All known Gnutella packets\n"
++    " --bit		[TCP&UDP]	All known BitTorrent packets\n"
++    " --apple	[TCP] 		All known AppleJuice packets\n"
++    " --winmx	[TCP] 		All known WinMX\n"
++    " --soul		[TCP] 		All known SoulSeek\n"
++    " --ares		[TCP] 		All known Ares\n\n"
++    " EXPERIMENTAL protocols (please send feedback to: ipp2p@ipp2p.org) :\n"
++    " --mute		[TCP]		All known Mute packets\n"
++    " --waste	[TCP]		All known Waste packets\n"
++    " --xdcc		[TCP]		All known XDCC packets (only xdcc login)\n\n"
++    " DEBUG SUPPPORT, use only if you know why\n"
++    " --debug		Generate kernel debug output, THIS WILL SLOW DOWN THE FILTER\n"
++    "\nNote that the follwing options will have the same meaning:\n"
++    " '--ipp2p' is equal to '--edk --dc --kazaa --gnu --bit --apple --winmx --soul --ares'\n"
++    "\nIPP2P was intended for TCP only. Due to increasing usage of UDP we needed to change this.\n"
++    "You can now use -p udp to search UDP packets only or without -p switch to search UDP and TCP packets.\n"
++    "\nSee README included with this package for more details or visit http://www.ipp2p.org\n"
++    "\nExamples:\n"
++    " iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01\n"
++    " iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP\n"
++    " iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP\n\n"
++    , IPP2P_VERSION);
++}
++
++static struct option opts[] = {
++        { "ipp2p", 0, 0, '1' },
++        { "edk", 0, 0, '2' },	
++	{ "dc", 0, 0, '7' },
++	{ "gnu", 0, 0, '9' },
++	{ "kazaa", 0, 0, 'a' },
++	{ "bit", 0, 0, 'b' },
++	{ "apple", 0, 0, 'c' },	
++	{ "soul", 0, 0, 'd' },	
++	{ "winmx", 0, 0, 'e' },	
++	{ "ares", 0, 0, 'f' },
++	{ "mute", 0, 0, 'g' },
++	{ "waste", 0, 0, 'h' },
++	{ "xdcc", 0, 0, 'i' },
++	{ "debug", 0, 0, 'j' },
++        {0}
++};
++
++	
++
++static void
++init(struct xt_entry_match *m)
++{
++    struct ipt_p2p_info *info = (struct ipt_p2p_info *)m->data;
++
++    /*init the module with default values*/
++    info->cmd = 0;
++    info->debug = 0;
++
++}
++	
++
++static int
++parse(int c, char **argv, int invert, unsigned int *flags,
++	const void *entry,
++	struct xt_entry_match **match)
++{
++    struct ipt_p2p_info *info = (struct ipt_p2p_info *)(*match)->data;
++    
++    switch (c) {
++	case '1':		/*cmd: ipp2p*/
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified once!");
++/*	    if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p-data' may only be "
++				"specified alone!");*/
++	    if ((*flags) != 0)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++	    *flags += SHORT_HAND_IPP2P;
++	    info->cmd = *flags;
++	    break;
++	    
++	case '2':		/*cmd: edk*/
++	    if ((*flags & IPP2P_EDK) == IPP2P_EDK)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--edk' may only be "
++				"specified once");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++/*	    if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p-data' may only be "
++				"specified alone!");*/
++            if ((*flags & IPP2P_DATA_EDK) == IPP2P_DATA_EDK)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: use `--edk' OR `--edk-data' but not both of them!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++	    *flags += IPP2P_EDK;
++	    info->cmd = *flags;	    
++	    break;
++
++
++	case '7':		/*cmd: dc*/
++            if ((*flags & IPP2P_DC) == IPP2P_DC)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--dc' may only be "
++                                "specified once!");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++/*	    if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p-data' may only be "
++				"specified alone!");*/
++            if ((*flags & IPP2P_DATA_DC) == IPP2P_DATA_DC)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: use `--dc' OR `--dc-data' but not both of them!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_DC;
++	    info->cmd = *flags;
++	    break;
++
++
++	case '9':		/*cmd: gnu*/
++            if ((*flags & IPP2P_GNU) == IPP2P_GNU)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--gnu' may only be "
++                                "specified once!");
++/*	    if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p-data' may only be "
++				"specified alone!");*/
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++            if ((*flags & IPP2P_DATA_GNU) == IPP2P_DATA_GNU)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: use `--gnu' OR `--gnu-data' but not both of them!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_GNU;
++	    info->cmd = *flags;
++	    break;
++
++	case 'a':		/*cmd: kazaa*/
++            if ((*flags & IPP2P_KAZAA) == IPP2P_KAZAA)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--kazaa' may only be "
++                                "specified once!");
++/*	    if ((*flags & SHORT_HAND_DATA) == SHORT_HAND_DATA)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p-data' may only be "
++				"specified alone!");*/
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++            if ((*flags & IPP2P_DATA_KAZAA) == IPP2P_DATA_KAZAA)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: use `--kazaa' OR `--kazaa-data' but not both of them!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_KAZAA;
++	    info->cmd = *flags;
++	    break;																											
++
++	case 'b':		/*cmd: bit*/
++            if ((*flags & IPP2P_BIT) == IPP2P_BIT)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--bit' may only be "
++                                "specified once!");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_BIT;
++	    info->cmd = *flags;
++	    break;																											
++
++	case 'c':		/*cmd: apple*/
++            if ((*flags & IPP2P_APPLE) == IPP2P_APPLE)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--apple' may only be "
++                                "specified once!");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_APPLE;
++	    info->cmd = *flags;
++	    break;																											
++
++
++	case 'd':		/*cmd: soul*/
++            if ((*flags & IPP2P_SOUL) == IPP2P_SOUL)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--soul' may only be "
++                                "specified once!");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_SOUL;
++	    info->cmd = *flags;
++	    break;																											
++
++
++	case 'e':		/*cmd: winmx*/
++            if ((*flags & IPP2P_WINMX) == IPP2P_WINMX)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--winmx' may only be "
++                                "specified once!");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_WINMX;
++	    info->cmd = *flags;
++	    break;																											
++
++	case 'f':		/*cmd: ares*/
++            if ((*flags & IPP2P_ARES) == IPP2P_ARES)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--ares' may only be "
++                                "specified once!");
++	    if ((*flags & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P)
++		    exit_error(PARAMETER_PROBLEM,
++				"ipp2p: `--ipp2p' may only be "
++				"specified alone!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_ARES;
++	    info->cmd = *flags;
++	    break;																											
++	
++	case 'g':		/*cmd: mute*/
++            if ((*flags & IPP2P_MUTE) == IPP2P_MUTE)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--mute' may only be "
++                                "specified once!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_MUTE;
++	    info->cmd = *flags;
++	    break;																											
++	case 'h':		/*cmd: waste*/
++            if ((*flags & IPP2P_WASTE) == IPP2P_WASTE)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--waste' may only be "
++                                "specified once!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_WASTE;
++	    info->cmd = *flags;
++	    break;																											
++	case 'i':		/*cmd: xdcc*/
++            if ((*flags & IPP2P_XDCC) == IPP2P_XDCC)
++            exit_error(PARAMETER_PROBLEM,
++                                "ipp2p: `--ares' may only be "
++                                "specified once!");
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++            *flags += IPP2P_XDCC;
++	    info->cmd = *flags;
++	    break;																											
++
++	case 'j':		/*cmd: debug*/
++	    if (invert) exit_error(PARAMETER_PROBLEM, "ipp2p: invert [!] is not allowed!");
++	    info->debug = 1;
++	    break;																											
++
++	default:
++//            exit_error(PARAMETER_PROBLEM,
++//	    "\nipp2p-parameter problem: for ipp2p usage type: iptables -m ipp2p --help\n");
++	    return 0;
++    }
++    return 1;
++}
++
++
++static void
++final_check(unsigned int flags)
++{
++    if (!flags)
++            exit_error(PARAMETER_PROBLEM,
++	    "\nipp2p-parameter problem: for ipp2p usage type: iptables -m ipp2p --help\n");
++}
++
++
++
++static void
++print(const void *ip,
++        const struct xt_entry_match *match,
++	int numeric)
++{
++    struct ipt_p2p_info *info = (struct ipt_p2p_info *)match->data;
++    
++    printf("ipp2p v%s", IPP2P_VERSION);
++    if ((info->cmd & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P) printf(" --ipp2p");
++//    if ((info->cmd & SHORT_HAND_DATA) == SHORT_HAND_DATA) printf(" --ipp2p-data");
++    if ((info->cmd & IPP2P_KAZAA) == IPP2P_KAZAA) printf(" --kazaa");
++//    if ((info->cmd & IPP2P_DATA_KAZAA) == IPP2P_DATA_KAZAA) printf(" --kazaa-data");
++//    if ((info->cmd & IPP2P_DATA_GNU) == IPP2P_DATA_GNU) printf(" --gnu-data");
++    if ((info->cmd & IPP2P_GNU) == IPP2P_GNU) printf(" --gnu");
++    if ((info->cmd & IPP2P_EDK) == IPP2P_EDK) printf(" --edk");
++//    if ((info->cmd & IPP2P_DATA_EDK) == IPP2P_DATA_EDK) printf(" --edk-data");
++//    if ((info->cmd & IPP2P_DATA_DC) == IPP2P_DATA_DC) printf(" --dc-data");
++    if ((info->cmd & IPP2P_DC) == IPP2P_DC) printf(" --dc");
++    if ((info->cmd & IPP2P_BIT) == IPP2P_BIT) printf(" --bit");
++    if ((info->cmd & IPP2P_APPLE) == IPP2P_APPLE) printf(" --apple");
++    if ((info->cmd & IPP2P_SOUL) == IPP2P_SOUL) printf(" --soul");
++    if ((info->cmd & IPP2P_WINMX) == IPP2P_WINMX) printf(" --winmx");
++    if ((info->cmd & IPP2P_ARES) == IPP2P_ARES) printf(" --ares");
++    if ((info->cmd & IPP2P_MUTE) == IPP2P_MUTE) printf(" --mute");
++    if ((info->cmd & IPP2P_WASTE) == IPP2P_WASTE) printf(" --waste");
++    if ((info->cmd & IPP2P_XDCC) == IPP2P_XDCC) printf(" --xdcc");
++    if (info->debug != 0) printf(" --debug");
++    printf(" ");
++}
++			    						   
++
++
++static void
++save(const void *ip, const struct xt_entry_match *match)
++{
++    struct ipt_p2p_info *info = (struct ipt_p2p_info *)match->data;
++    
++    if ((info->cmd & SHORT_HAND_IPP2P) == SHORT_HAND_IPP2P) printf("--ipp2p ");
++//    if ((info->cmd & SHORT_HAND_DATA) == SHORT_HAND_DATA) printf("--ipp2p-data ");
++    if ((info->cmd & IPP2P_KAZAA) == IPP2P_KAZAA) printf("--kazaa ");
++//    if ((info->cmd & IPP2P_DATA_KAZAA) == IPP2P_DATA_KAZAA) printf("--kazaa-data ");
++//    if ((info->cmd & IPP2P_DATA_GNU) == IPP2P_DATA_GNU) printf("--gnu-data ");
++    if ((info->cmd & IPP2P_GNU) == IPP2P_GNU) printf("--gnu ");
++    if ((info->cmd & IPP2P_EDK) == IPP2P_EDK) printf("--edk ");
++//    if ((info->cmd & IPP2P_DATA_EDK) == IPP2P_DATA_EDK) printf("--edk-data ");
++//    if ((info->cmd & IPP2P_DATA_DC) == IPP2P_DATA_DC) printf("--dc-data ");
++    if ((info->cmd & IPP2P_DC) == IPP2P_DC) printf("--dc ");
++    if ((info->cmd & IPP2P_BIT) == IPP2P_BIT) printf("--bit ");
++    if ((info->cmd & IPP2P_APPLE) == IPP2P_APPLE) printf("--apple ");
++    if ((info->cmd & IPP2P_SOUL) == IPP2P_SOUL) printf("--soul ");
++    if ((info->cmd & IPP2P_WINMX) == IPP2P_WINMX) printf("--winmx ");
++    if ((info->cmd & IPP2P_ARES) == IPP2P_ARES) printf("--ares ");
++    if ((info->cmd & IPP2P_MUTE) == IPP2P_MUTE) printf(" --mute");
++    if ((info->cmd & IPP2P_WASTE) == IPP2P_WASTE) printf(" --waste");
++    if ((info->cmd & IPP2P_XDCC) == IPP2P_XDCC) printf(" --xdcc");
++    if (info->debug != 0) printf("--debug ");
++}
++
++		
++
++
++static 
++struct iptables_match ipp2p= 
++{ 
++    .family         = AF_INET,	
++    .name           = "ipp2p",
++    .version        = IPTABLES_VERSION,
++    .size           = IPT_ALIGN(sizeof(struct ipt_p2p_info)),
++    .userspacesize  = IPT_ALIGN(sizeof(struct ipt_p2p_info)),
++    .help           = help,
++    .init           = init,
++    .parse          = parse,
++    .final_check    = final_check,
++    .print          = print,
++    .save           = save,
++    .extra_opts     = opts
++};
++					    
++
++
++void _init(void)
++{
++    register_match(&ipp2p);
++}
++
+Index: iptables-1.4.0/include/linux/netfilter_ipv4/ipt_ipp2p.h
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/include/linux/netfilter_ipv4/ipt_ipp2p.h
+@@ -0,0 +1,31 @@
++#ifndef __IPT_IPP2P_H
++#define __IPT_IPP2P_H
++#define IPP2P_VERSION "0.8.1_rc1"
++
++struct ipt_p2p_info {
++    int cmd;
++    int debug;
++};
++
++#endif //__IPT_IPP2P_H
++
++#define SHORT_HAND_IPP2P	1 /* --ipp2p switch*/
++//#define SHORT_HAND_DATA		4 /* --ipp2p-data switch*/
++#define SHORT_HAND_NONE		5 /* no short hand*/
++
++#define IPP2P_EDK		(1 << 1)
++#define IPP2P_DATA_KAZAA	(1 << 2)
++#define IPP2P_DATA_EDK		(1 << 3)
++#define IPP2P_DATA_DC		(1 << 4)
++#define IPP2P_DC		(1 << 5)
++#define IPP2P_DATA_GNU		(1 << 6)
++#define IPP2P_GNU		(1 << 7)
++#define IPP2P_KAZAA		(1 << 8)
++#define IPP2P_BIT		(1 << 9)
++#define IPP2P_APPLE		(1 << 10)
++#define IPP2P_SOUL		(1 << 11)
++#define IPP2P_WINMX		(1 << 12)
++#define IPP2P_ARES		(1 << 13)
++#define IPP2P_MUTE		(1 << 14)
++#define IPP2P_WASTE		(1 << 15)
++#define IPP2P_XDCC		(1 << 16)
diff --git a/package/iptables/patches/1.4.0/002-layer7_2.17.patch b/package/iptables/patches/1.4.0/002-layer7_2.17.patch
new file mode 100644
index 0000000000..ed19118b09
--- /dev/null
+++ b/package/iptables/patches/1.4.0/002-layer7_2.17.patch
@@ -0,0 +1,418 @@
+--- iptables-1.4.0rc1/extensions/libipt_layer7.c	1969-12-31 18:00:00.000000000 -0600
++++ iptables-1.4.0rc1-layer7/extensions/libipt_layer7.c	2007-11-19 06:06:56.000000000 -0600
+@@ -0,0 +1,393 @@
++/* 
++   Shared library add-on to iptables to add layer 7 matching support. 
++  
++   By Matthew Strait <quadong@users.sf.net>, Oct 2003.
++
++   http://l7-filter.sf.net 
++
++   This program is free software; you can redistribute it and/or
++   modify it under the terms of the GNU General Public License
++   as published by the Free Software Foundation; either version
++   2 of the License, or (at your option) any later version.
++   http://www.gnu.org/licenses/gpl.txt
++
++   Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
++*/
++
++#define _GNU_SOURCE
++#include <stdio.h>
++#include <netdb.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++#include <ctype.h>
++#include <dirent.h>
++
++#include <iptables.h>
++#include <linux/netfilter/xt_layer7.h>
++
++#define MAX_FN_LEN 256
++
++static char l7dir[MAX_FN_LEN] = "\0";
++
++/* Function which prints out usage message. */
++static void help(void)
++{
++	printf(
++	"LAYER7 match v%s options:\n"
++	"--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
++	"                       (--l7dir must be specified before --l7proto if used!)\n"
++	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
++	IPTABLES_VERSION);
++	fputc('\n', stdout);
++}
++
++static struct option opts[] = {
++	{ .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
++	{ .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
++	{ .name = 0 }
++};
++
++/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
++int parse_protocol_file(char * filename, const char * protoname, struct xt_layer7_info *info)
++{
++	FILE * f;
++	char * line = NULL;
++	size_t len = 0;
++
++	enum { protocol, pattern, done } datatype = protocol;
++
++	f = fopen(filename, "r");
++
++	if(!f)
++		return 0;
++
++	while(getline(&line, &len, f) != -1)
++	{
++		if(strlen(line) < 2 || line[0] == '#')
++			continue;
++
++		/* strip the pesky newline... */
++		if(line[strlen(line) - 1] == '\n')
++			line[strlen(line) - 1] = '\0';
++
++		if(datatype == protocol)
++		{
++			/* Ignore everything on the line beginning with the 
++			first space or tab . For instance, this allows the 
++			protocol line in http.pat to be "http " (or 
++			"http I am so cool") instead of just "http". */
++			if(strchr(line, ' ')){
++				char * space = strchr(line, ' ');
++				space[0] = '\0';
++			}
++			if(strchr(line, '\t')){
++				char * space = strchr(line, '\t');
++				space[0] = '\0';
++			}
++
++			/* sanity check.  First non-comment non-blank 
++			line must be the same as the file name. */
++			if(strcmp(line, protoname))
++				exit_error(OTHER_PROBLEM, 
++					"Protocol name (%s) doesn't match file name (%s).  Bailing out\n",
++					line, filename);
++
++			if(strlen(line) >= MAX_PROTOCOL_LEN)
++				 exit_error(PARAMETER_PROBLEM, 
++					"Protocol name in %s too long!", filename);
++			strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
++
++			datatype = pattern; 
++		}
++		else if(datatype == pattern)
++		{
++			if(strlen(line) >= MAX_PATTERN_LEN)
++				 exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
++			strncpy(info->pattern, line, MAX_PATTERN_LEN);
++			
++			datatype = done;			
++			break;
++		}
++		else
++			exit_error(OTHER_PROBLEM, "Internal error");
++	}
++
++	if(datatype != done)
++		exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
++
++	if(line) free(line);
++	fclose(f);
++
++	return 1;
++
++/*
++	fprintf(stderr, "protocol: %s\npattern: %s\n\n", 
++			info->protocol,
++			info->pattern);
++*/
++}
++
++static int hex2dec(char c)
++{
++        switch (c)
++        {
++                case '0' ... '9':
++                        return c - '0';
++                case 'a' ... 'f':
++                        return c - 'a' + 10;
++                case 'A' ... 'F':
++                        return c - 'A' + 10;
++                default:
++                        exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
++                        return 0;
++        }
++}
++
++/* takes a string with \xHH escapes and returns one with the characters 
++they stand for */
++static char * pre_process(char * s)
++{
++	char * result = malloc(strlen(s) + 1);
++	int sindex = 0, rindex = 0;
++        while( sindex < strlen(s) )
++        {
++            if( sindex + 3 < strlen(s) &&
++                s[sindex] == '\\' && s[sindex+1] == 'x' && 
++                isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) ) 
++                {
++                        /* carefully remember to call tolower here... */
++                        result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
++                                                  hex2dec(s[sindex + 3] ) );
++
++			switch ( result[rindex] )
++			{
++			case 0x24:
++			case 0x28:
++			case 0x29:
++			case 0x2a:
++			case 0x2b:
++			case 0x2e:
++			case 0x3f:
++			case 0x5b:
++			case 0x5c:
++			case 0x5d:
++			case 0x5e:
++			case 0x7c:
++				fprintf(stderr, 
++					"Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n"
++					"I recommend that you write this as %c or \\%c, depending on what you meant.\n",
++					result[rindex], s[sindex + 2], s[sindex + 3], result[rindex], result[rindex]);
++				break;
++			case 0x00:
++				fprintf(stderr, 
++					"Warning: null (\\x00) in layer7 regexp.  A null terminates the regexp string!\n");
++				break;
++			default:
++				break;
++			}
++
++
++                        sindex += 3; /* 4 total */
++                }
++                else
++                        result[rindex] = tolower(s[sindex]);
++
++		sindex++; 
++		rindex++;
++        }
++	result[rindex] = '\0';
++
++	return result;
++}
++
++#define MAX_SUBDIRS 128
++char ** readl7dir(char * dirname)
++{
++        DIR             * scratchdir;
++        struct dirent   ** namelist;
++	char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
++
++        int n, d = 1;
++	subdirs[0] = "";
++
++        n = scandir(dirname, &namelist, 0, alphasort);
++
++	if (n < 0)
++	{
++            perror("scandir");
++	    exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
++	}
++        else 
++	{
++            	while(n--) 
++		{
++			char fulldirname[MAX_FN_LEN];
++
++			snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
++
++                	if((scratchdir = opendir(fulldirname)) != NULL)
++			{
++				closedir(scratchdir);
++
++				if(!strcmp(namelist[n]->d_name, ".") || 
++				   !strcmp(namelist[n]->d_name, ".."))
++					/* do nothing */ ;
++				else
++				{
++					subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
++					strcpy(subdirs[d], namelist[n]->d_name);
++					d++;
++					if(d >= MAX_SUBDIRS - 1)
++					{
++						fprintf(stderr, 
++						  "Too many subdirectories, skipping the rest!\n");
++						break;
++					}
++				}
++			}
++                	free(namelist[n]);
++            	}
++            	free(namelist);
++        }
++	
++	subdirs[d] = NULL;
++
++	return subdirs;
++}
++
++static void
++parse_layer7_protocol(const char *s, struct xt_layer7_info *info)
++{
++	char filename[MAX_FN_LEN];
++	char * dir = NULL;
++	char ** subdirs;
++	int n = 0, done = 0;
++
++	if(strlen(l7dir) > 0)
++		dir = l7dir;
++	else
++		dir = "/etc/l7-protocols";
++
++	subdirs = readl7dir(dir);
++
++	while(subdirs[n] != NULL)
++	{
++		int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
++
++		//fprintf(stderr, "Trying to find pattern in %s ... ", filename);
++
++		if(c > MAX_FN_LEN)
++		{
++			exit_error(OTHER_PROBLEM, 
++				"Filename beginning with %s is too long!\n", filename);
++		}
++
++		/* read in the pattern from the file */
++		if(parse_protocol_file(filename, s, info))
++		{
++			//fprintf(stderr, "found\n");
++			done = 1;
++			break;
++		}
++		
++		//fprintf(stderr, "not found\n");
++
++		n++;
++	}
++
++	if(!done)
++		exit_error(OTHER_PROBLEM, 
++			"Couldn't find a pattern definition file for %s.\n", s);
++
++	/* process \xHH escapes and tolower everything. (our regex lib has no
++	case insensitivity option.) */
++	strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
++}
++
++/* Function which parses command options; returns true if it ate an option */
++static int parse(int c, char **argv, int invert, unsigned int *flags,
++      const void *entry, struct xt_entry_match **match)
++{
++	struct xt_layer7_info *layer7info = 
++		(struct xt_layer7_info *)(*match)->data;
++
++	switch (c) {
++	case '1':
++		check_inverse(optarg, &invert, &optind, 0);
++		parse_layer7_protocol(argv[optind-1], layer7info);
++		if (invert)
++			layer7info->invert = 1;
++		*flags = 1;
++		break;
++
++	case '2':
++		/* not going to use this, but maybe we need to strip a ! anyway (?) */
++		check_inverse(optarg, &invert, &optind, 0);
++
++		if(strlen(argv[optind-1]) >= MAX_FN_LEN)
++			exit_error(PARAMETER_PROBLEM, "directory name too long\n");
++
++		strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
++
++		*flags = 1;
++		break;
++
++	default:
++		return 0;
++	}
++
++	return 1;
++}
++
++/* Final check; must have specified --l7proto */
++static void final_check(unsigned int flags)
++{
++	if (!flags)
++		exit_error(PARAMETER_PROBLEM,
++			   "LAYER7 match: You must specify `--l7proto'");
++}
++
++static void print_protocol(char s[], int invert, int numeric)
++{
++	fputs("l7proto ", stdout);
++	if (invert) fputc('!', stdout);
++	printf("%s ", s);
++}
++
++/* Prints out the matchinfo. */
++static void print(const void *ip,
++      const struct xt_entry_match *match,
++      int numeric)
++{
++	printf("LAYER7 ");
++
++	print_protocol(((struct xt_layer7_info *)match->data)->protocol,
++		  ((struct xt_layer7_info *)match->data)->invert, numeric);
++}
++/* Saves the union ipt_matchinfo in parsable form to stdout. */
++static void save(const void *ip, const struct xt_entry_match *match)
++{
++        const struct xt_layer7_info *info =
++            (const struct xt_layer7_info*) match->data;
++
++        printf("--l7proto %s%s ", (info->invert)   ? "! ": "", info->protocol);
++}
++
++static struct iptables_match layer7 = { 
++    .name          = "layer7",
++    .version       = IPTABLES_VERSION,
++    .size          = IPT_ALIGN(sizeof(struct xt_layer7_info)),
++    .userspacesize = IPT_ALIGN(sizeof(struct xt_layer7_info)),
++    .help          = &help,
++    .parse         = &parse,
++    .final_check   = &final_check,
++    .print         = &print,
++    .save          = &save,
++    .extra_opts    = opts
++};
++
++void _init(void)
++{
++	register_match(&layer7);
++}
+--- iptables-1.4.0rc1/extensions/libipt_layer7.man	1969-12-31 18:00:00.000000000 -0600
++++ iptables-1.4.0rc1-layer7/extensions/libipt_layer7.man	2007-11-19 05:49:46.000000000 -0600
+@@ -0,0 +1,14 @@
++This module matches packets based on the application layer data of 
++their connections.  It uses regular expression matching to compare 
++the application layer data to regular expressions found it the layer7 
++configuration files.  This is an experimental module which can be found at 
++http://l7-filter.sf.net.  It takes two options.
++.TP
++.BI "--l7proto " "\fIprotocol\fP"
++Match the specified protocol.  The protocol name must match a file 
++name in /etc/l7-protocols/ or one of its first-level child directories.
++.TP
++.BI "--l7dir " "\fIdirectory\fP"
++Use \fIdirectory\fP instead of /etc/l7-protocols/.  This option must be 
++specified before --l7proto.
++
+--- iptables-1.4.0rc1/extensions/.layer7-test	1969-12-31 18:00:00.000000000 -0600
++++ iptables-1.4.0rc1-layer7/extensions/.layer7-test	2007-11-19 06:18:58.000000000 -0600
+@@ -0,0 +1,2 @@
++#! /bin/sh
++[ -f $KERNEL_DIR/include/linux/netfilter/xt_layer7.h ] && echo layer7
diff --git a/package/iptables/patches/1.4.0/003-layer7_2.17_pktmatch.patch b/package/iptables/patches/1.4.0/003-layer7_2.17_pktmatch.patch
new file mode 100644
index 0000000000..dd6efc15dc
--- /dev/null
+++ b/package/iptables/patches/1.4.0/003-layer7_2.17_pktmatch.patch
@@ -0,0 +1,43 @@
+Index: iptables-1.4.0/extensions/libipt_layer7.c
+===================================================================
+--- iptables-1.4.0.orig/extensions/libipt_layer7.c
++++ iptables-1.4.0/extensions/libipt_layer7.c
+@@ -43,7 +43,8 @@ static void help(void)
+ 	"LAYER7 match v%s options:\n"
+ 	"--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
+ 	"                       (--l7dir must be specified before --l7proto if used!)\n"
+-	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
++	"--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n"
++	"--l7pkt              : Skip connection tracking and match individual packets\n",
+ 	IPTABLES_VERSION);
+ 	fputc('\n', stdout);
+ }
+@@ -51,6 +52,7 @@ static void help(void)
+ static struct option opts[] = {
+ 	{ .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
+ 	{ .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
++	{ .name = "l7pkt",   .has_arg = 0, .flag = 0, .val = '3' },
+ 	{ .name = 0 }
+ };
+ 
+@@ -339,6 +341,10 @@ static int parse(int c, char **argv, int
+ 		*flags = 1;
+ 		break;
+ 
++	case '3':
++		layer7info->pkt = 1;
++		break;
++
+ 	default:
+ 		return 0;
+ 	}
+@@ -370,6 +376,9 @@ static void print(const void *ip,
+ 
+ 	print_protocol(((struct xt_layer7_info *)match->data)->protocol,
+ 		  ((struct xt_layer7_info *)match->data)->invert, numeric);
++
++	if (((struct xt_layer7_info *)match->data)->pkt)
++		printf("l7pkt ");
+ }
+ /* Saves the union ipt_matchinfo in parsable form to stdout. */
+ static void save(const void *ip, const struct xt_entry_match *match)
diff --git a/package/iptables/patches/1.4.0/004-drop_multiport_v0_support.patch b/package/iptables/patches/1.4.0/004-drop_multiport_v0_support.patch
new file mode 100644
index 0000000000..0f6e01b19d
--- /dev/null
+++ b/package/iptables/patches/1.4.0/004-drop_multiport_v0_support.patch
@@ -0,0 +1,279 @@
+Index: iptables-1.4.0/extensions/libxt_multiport.c
+===================================================================
+--- iptables-1.4.0.orig/extensions/libxt_multiport.c
++++ iptables-1.4.0/extensions/libxt_multiport.c
+@@ -12,22 +12,6 @@
+ #include "../include/linux/netfilter/xt_multiport.h"
+ 
+ /* Function which prints out usage message. */
+-static void multiport_help(void)
+-{
+-	printf(
+-"multiport v%s options:\n"
+-" --source-ports port[,port,port...]\n"
+-" --sports ...\n"
+-"				match source port(s)\n"
+-" --destination-ports port[,port,port...]\n"
+-" --dports ...\n"
+-"				match destination port(s)\n"
+-" --ports port[,port,port]\n"
+-"				match both source and destination port(s)\n"
+-" NOTE: this kernel does not support port ranges in multiport.\n",
+-IPTABLES_VERSION);
+-}
+-
+ static void multiport_help_v1(void)
+ {
+ 	printf(
+@@ -71,26 +55,6 @@ proto_to_name(u_int8_t proto)
+ 	}
+ }
+ 
+-static unsigned int
+-parse_multi_ports(const char *portstring, u_int16_t *ports, const char *proto)
+-{
+-	char *buffer, *cp, *next;
+-	unsigned int i;
+-
+-	buffer = strdup(portstring);
+-	if (!buffer) exit_error(OTHER_PROBLEM, "strdup failed");
+-
+-	for (cp=buffer, i=0; cp && i<XT_MULTI_PORTS; cp=next,i++)
+-	{
+-		next=strchr(cp, ',');
+-		if (next) *next++='\0';
+-		ports[i] = parse_port(cp, proto);
+-	}
+-	if (cp) exit_error(PARAMETER_PROBLEM, "too many ports specified");
+-	free(buffer);
+-	return i;
+-}
+-
+ static void
+ parse_multi_ports_v1(const char *portstring, 
+ 		     struct xt_multiport_v1 *multiinfo,
+@@ -154,73 +118,6 @@ check_proto(u_int16_t pnum, u_int8_t inv
+ /* Function which parses command options; returns true if it
+    ate an option */
+ static int
+-__multiport_parse(int c, char **argv, int invert, unsigned int *flags,
+-                  struct xt_entry_match **match, u_int16_t pnum,
+-                  u_int8_t invflags)
+-{
+-	const char *proto;
+-	struct xt_multiport *multiinfo
+-		= (struct xt_multiport *)(*match)->data;
+-
+-	switch (c) {
+-	case '1':
+-		check_inverse(argv[optind-1], &invert, &optind, 0);
+-		proto = check_proto(pnum, invflags);
+-		multiinfo->count = parse_multi_ports(argv[optind-1],
+-						     multiinfo->ports, proto);
+-		multiinfo->flags = XT_MULTIPORT_SOURCE;
+-		break;
+-
+-	case '2':
+-		check_inverse(argv[optind-1], &invert, &optind, 0);
+-		proto = check_proto(pnum, invflags);
+-		multiinfo->count = parse_multi_ports(argv[optind-1],
+-						     multiinfo->ports, proto);
+-		multiinfo->flags = XT_MULTIPORT_DESTINATION;
+-		break;
+-
+-	case '3':
+-		check_inverse(argv[optind-1], &invert, &optind, 0);
+-		proto = check_proto(pnum, invflags);
+-		multiinfo->count = parse_multi_ports(argv[optind-1],
+-						     multiinfo->ports, proto);
+-		multiinfo->flags = XT_MULTIPORT_EITHER;
+-		break;
+-
+-	default:
+-		return 0;
+-	}
+-
+-	if (invert)
+-		exit_error(PARAMETER_PROBLEM,
+-			   "multiport does not support invert");
+-
+-	if (*flags)
+-		exit_error(PARAMETER_PROBLEM,
+-			   "multiport can only have one option");
+-	*flags = 1;
+-	return 1;
+-}
+-
+-static int
+-multiport_parse(int c, char **argv, int invert, unsigned int *flags,
+-                const void *e, struct xt_entry_match **match)
+-{
+-	const struct ipt_entry *entry = e;
+-	return __multiport_parse(c, argv, invert, flags, match,
+-	       entry->ip.proto, entry->ip.invflags);
+-}
+-
+-static int
+-multiport_parse6(int c, char **argv, int invert, unsigned int *flags,
+-                 const void *e, struct xt_entry_match **match)
+-{
+-	const struct ip6t_entry *entry = (const struct ip6t_entry *)e;
+-	return __multiport_parse(c, argv, invert, flags, match,
+-	       entry->ipv6.proto, entry->ipv6.invflags);
+-}
+-
+-static int
+ __multiport_parse_v1(int c, char **argv, int invert, unsigned int *flags,
+                      struct xt_entry_match **match, u_int16_t pnum,
+                      u_int8_t invflags)
+@@ -313,55 +210,6 @@ print_port(u_int16_t port, u_int8_t prot
+ }
+ 
+ /* Prints out the matchinfo. */
+-static void
+-__multiport_print(const struct xt_entry_match *match, int numeric,
+-                  u_int16_t proto)
+-{
+-	const struct xt_multiport *multiinfo
+-		= (const struct xt_multiport *)match->data;
+-	unsigned int i;
+-
+-	printf("multiport ");
+-
+-	switch (multiinfo->flags) {
+-	case XT_MULTIPORT_SOURCE:
+-		printf("sports ");
+-		break;
+-
+-	case XT_MULTIPORT_DESTINATION:
+-		printf("dports ");
+-		break;
+-
+-	case XT_MULTIPORT_EITHER:
+-		printf("ports ");
+-		break;
+-
+-	default:
+-		printf("ERROR ");
+-		break;
+-	}
+-
+-	for (i=0; i < multiinfo->count; i++) {
+-		printf("%s", i ? "," : "");
+-		print_port(multiinfo->ports[i], proto, numeric);
+-	}
+-	printf(" ");
+-}
+-
+-static void multiport_print(const void *ip_void,
+-                            const struct xt_entry_match *match, int numeric)
+-{
+-	const struct ipt_ip *ip = ip_void;
+-	__multiport_print(match, numeric, ip->proto);
+-}
+-
+-static void multiport_print6(const void *ip_void,
+-                             const struct xt_entry_match *match, int numeric)
+-{
+-	const struct ip6t_ip6 *ip = (const struct ip6t_ip6 *)ip_void;
+-	__multiport_print(match, numeric, ip->proto);
+-}
+-
+ static void __multiport_print_v1(const struct xt_entry_match *match,
+                                  int numeric, u_int16_t proto)
+ {
+@@ -418,48 +266,6 @@ static void multiport_print6_v1(const vo
+ }
+ 
+ /* Saves the union ipt_matchinfo in parsable form to stdout. */
+-static void __multiport_save(const struct xt_entry_match *match,
+-                             u_int16_t proto)
+-{
+-	const struct xt_multiport *multiinfo
+-		= (const struct xt_multiport *)match->data;
+-	unsigned int i;
+-
+-	switch (multiinfo->flags) {
+-	case XT_MULTIPORT_SOURCE:
+-		printf("--sports ");
+-		break;
+-
+-	case XT_MULTIPORT_DESTINATION:
+-		printf("--dports ");
+-		break;
+-
+-	case XT_MULTIPORT_EITHER:
+-		printf("--ports ");
+-		break;
+-	}
+-
+-	for (i=0; i < multiinfo->count; i++) {
+-		printf("%s", i ? "," : "");
+-		print_port(multiinfo->ports[i], proto, 1);
+-	}
+-	printf(" ");
+-}
+-
+-static void multiport_save(const void *ip_void,
+-                           const struct xt_entry_match *match)
+-{
+-	const struct ipt_ip *ip = ip_void;
+-	__multiport_save(match, ip->proto);
+-}
+-
+-static void multiport_save6(const void *ip_void,
+-                            const struct xt_entry_match *match)
+-{
+-	const struct ip6t_ip6 *ip = (const struct ip6t_ip6 *)ip_void;
+-	__multiport_save(match, ip->proto);
+-}
+-
+ static void __multiport_save_v1(const struct xt_entry_match *match,
+                                 u_int16_t proto)
+ {
+@@ -509,36 +315,6 @@ static void multiport_save6_v1(const voi
+ 	__multiport_save_v1(match, ip->proto);
+ }
+ 
+-static struct xtables_match multiport_match = {
+-	.family		= AF_INET,
+-	.name		= "multiport",
+-	.revision	= 0,
+-	.version	= IPTABLES_VERSION,
+-	.size		= XT_ALIGN(sizeof(struct xt_multiport)),
+-	.userspacesize	= XT_ALIGN(sizeof(struct xt_multiport)),
+-	.help		= multiport_help,
+-	.parse		= multiport_parse,
+-	.final_check	= multiport_check,
+-	.print		= multiport_print,
+-	.save		= multiport_save,
+-	.extra_opts	= multiport_opts,
+-};
+-
+-static struct xtables_match multiport_match6 = {
+-	.family		= AF_INET6,
+-	.name		= "multiport",
+-	.revision	= 0,
+-	.version	= IPTABLES_VERSION,
+-	.size		= XT_ALIGN(sizeof(struct xt_multiport)),
+-	.userspacesize	= XT_ALIGN(sizeof(struct xt_multiport)),
+-	.help		= multiport_help,
+-	.parse		= multiport_parse6,
+-	.final_check	= multiport_check,
+-	.print		= multiport_print6,
+-	.save		= multiport_save6,
+-	.extra_opts	= multiport_opts,
+-};
+-
+ static struct xtables_match multiport_match_v1 = {
+ 	.family		= AF_INET,
+ 	.name		= "multiport",
+@@ -572,8 +348,6 @@ static struct xtables_match multiport_ma
+ void
+ _init(void)
+ {
+-	xtables_register_match(&multiport_match);
+-	xtables_register_match(&multiport_match6);
+ 	xtables_register_match(&multiport_match_v1);
+ 	xtables_register_match(&multiport_match6_v1);
+ }
diff --git a/package/iptables/patches/1.4.0/005-imq1.patch b/package/iptables/patches/1.4.0/005-imq1.patch
new file mode 100644
index 0000000000..63617076bd
--- /dev/null
+++ b/package/iptables/patches/1.4.0/005-imq1.patch
@@ -0,0 +1,219 @@
+--- iptables-1.4.0.orig/extensions.orig/.IMQ-test6	Thu Jan  1 01:00:00 1970
++++ iptables-1.4.0/extensions/.IMQ-test6	Mon Jun 16 10:12:47 2003
+@@ -0,0 +1,3 @@
++#!/bin/sh
++# True if IMQ target patch is applied.
++[ -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_IMQ.h ] && echo IMQ
+--- iptables-1.4.0.orig/extensions.orig/libip6t_IMQ.c	Thu Jan  1 01:00:00 1970
++++ iptables-1.4.0/extensions/libip6t_IMQ.c	Mon Jun 16 10:12:47 2003
+@@ -0,0 +1,100 @@
++/* Shared library add-on to iptables to add IMQ target support. */
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++
++#include <ip6tables.h>
++#include <linux/netfilter_ipv6/ip6_tables.h>
++#include <linux/netfilter_ipv6/ip6t_IMQ.h>
++
++/* Function which prints out usage message. */
++static void
++help(void)
++{
++	printf(
++"IMQ target v%s options:\n"
++"  --todev <N>		enqueue to imq<N>, defaults to 0\n", 
++IPTABLES_VERSION);
++}
++
++static struct option opts[] = {
++	{ "todev", 1, 0, '1' },
++	{ 0 }
++};
++
++/* Initialize the target. */
++static void
++init(struct xt_entry_target *t)
++{
++	struct ip6t_imq_info *mr = (struct ip6t_imq_info*)t->data;
++
++	mr->todev = 0;
++}
++
++/* Function which parses command options; returns true if it
++   ate an option */
++static int
++parse(int c, char **argv, int invert, unsigned int *flags,
++      const void *entry,
++      struct xt_entry_target **target)
++{
++	struct ip6t_imq_info *mr = (struct ip6t_imq_info*)(*target)->data;
++	
++	switch(c) {
++	case '1':
++		if (check_inverse(optarg, &invert, NULL, 0))
++			exit_error(PARAMETER_PROBLEM,
++				   "Unexpected `!' after --todev");
++		mr->todev=atoi(optarg);
++		break;
++	default:
++		return 0;
++	}
++	return 1;
++}
++
++static void
++final_check(unsigned int flags)
++{
++}
++
++/* Prints out the targinfo. */
++static void
++print(const void *ip,
++      const struct xt_entry_target *target,
++      int numeric)
++{
++	struct ip6t_imq_info *mr = (struct ip6t_imq_info*)target->data;
++
++	printf("IMQ: todev %u ", mr->todev);
++}
++
++/* Saves the union ipt_targinfo in parsable form to stdout. */
++static void
++save(const void *ip, const struct xt_entry_target *target)
++{
++	struct ip6t_imq_info *mr = (struct ip6t_imq_info*)target->data;
++
++	printf("--todev %u", mr->todev);
++}
++
++static struct ip6tables_target imq = {
++	.next		= NULL,
++	.name		= "IMQ",
++	.version	= IPTABLES_VERSION,
++	.size		= IP6T_ALIGN(sizeof(struct ip6t_imq_info)),
++	.userspacesize	= IP6T_ALIGN(sizeof(struct ip6t_imq_info)),
++	.help		= &help,
++	.init		= &init,
++	.parse		= &parse,
++	.final_check	= &final_check,
++	.print		= &print,
++	.save		= &save,
++	.extra_opts	= opts
++};
++
++static __attribute__((constructor)) void _init(void)
++{
++	register_target6(&imq);
++}
+--- iptables-1.4.0.orig/extensions.orig/.IMQ-test	Thu Jan  1 01:00:00 1970
++++ iptables-1.4.0/extensions/.IMQ-test	Mon Jun 16 10:12:47 2003
+@@ -0,0 +1,3 @@
++#!/bin/sh
++# True if IMQ target patch is applied.
++[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_IMQ.h ] && echo IMQ
+--- iptables-1.4.0.orig/extensions.orig/libipt_IMQ.c	Thu Jan  1 01:00:00 1970
++++ iptables-1.4.0/extensions/libipt_IMQ.c	Mon Jun 16 10:12:47 2003
+@@ -0,0 +1,100 @@
++/* Shared library add-on to iptables to add IMQ target support. */
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++
++#include <iptables.h>
++#include <linux/netfilter_ipv4/ip_tables.h>
++#include <linux/netfilter_ipv4/ipt_IMQ.h>
++
++/* Function which prints out usage message. */
++static void
++help(void)
++{
++	printf(
++"IMQ target v%s options:\n"
++"  --todev <N>		enqueue to imq<N>, defaults to 0\n", 
++IPTABLES_VERSION);
++}
++
++static struct option opts[] = {
++	{ "todev", 1, 0, '1' },
++	{ 0 }
++};
++
++/* Initialize the target. */
++static void
++init(struct xt_entry_target *t)
++{
++	struct ipt_imq_info *mr = (struct ipt_imq_info*)t->data;
++
++	mr->todev = 0;
++}
++
++/* Function which parses command options; returns true if it
++   ate an option */
++static int
++parse(int c, char **argv, int invert, unsigned int *flags,
++      const void *entry,
++      struct xt_entry_target **target)
++{
++	struct ipt_imq_info *mr = (struct ipt_imq_info*)(*target)->data;
++	
++	switch(c) {
++	case '1':
++		if (check_inverse(optarg, &invert, NULL, 0))
++			exit_error(PARAMETER_PROBLEM,
++				   "Unexpected `!' after --todev");
++		mr->todev=atoi(optarg);
++		break;
++	default:
++		return 0;
++	}
++	return 1;
++}
++
++static void
++final_check(unsigned int flags)
++{
++}
++
++/* Prints out the targinfo. */
++static void
++print(const void *ip,
++      const struct xt_entry_target *target,
++      int numeric)
++{
++	struct ipt_imq_info *mr = (struct ipt_imq_info*)target->data;
++
++	printf("IMQ: todev %u ", mr->todev);
++}
++
++/* Saves the union ipt_targinfo in parsable form to stdout. */
++static void
++save(const void *ip, const struct xt_entry_target *target)
++{
++	struct ipt_imq_info *mr = (struct ipt_imq_info*)target->data;
++
++	printf("--todev %u", mr->todev);
++}
++
++static struct iptables_target imq = {
++	.next		= NULL,
++	.name		= "IMQ",
++	.version	= IPTABLES_VERSION,
++	.size		= IPT_ALIGN(sizeof(struct ipt_imq_info)),
++	.userspacesize	= IPT_ALIGN(sizeof(struct ipt_imq_info)),
++	.help		= &help,
++	.init		= &init,
++	.parse		= &parse,
++	.final_check	= &final_check,
++	.print		= &print,
++	.save		= &save,
++	.extra_opts	= opts
++};
++
++static __attribute__((constructor)) void _init(void)
++{
++	register_target(&imq);
++}
+
diff --git a/package/iptables/patches/1.4.0/006-chaostables_0.8.patch b/package/iptables/patches/1.4.0/006-chaostables_0.8.patch
new file mode 100644
index 0000000000..a9eb14544f
--- /dev/null
+++ b/package/iptables/patches/1.4.0/006-chaostables_0.8.patch
@@ -0,0 +1,393 @@
+Index: iptables-1.4.0/extensions/.CHAOS-testx
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/.CHAOS-testx
+@@ -0,0 +1,3 @@
++#! /bin/sh
++
++[ -f "$KERNEL_DIR/include/linux/netfilter/xt_CHAOS.h" ] && echo "CHAOS"
+Index: iptables-1.4.0/extensions/libxt_CHAOS.c
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_CHAOS.c
+@@ -0,0 +1,114 @@
++/*
++ *	CHAOS target for iptables
++ *	Copyright © CC Computer Consultants GmbH, 2006 - 2007
++ *	Contact: Jan Engelhardt <jengelh@computergmbh.de>
++ *
++ *	This program is free software; you can redistribute it and/or modify
++ *	it under the terms of the GNU General Public License; either version
++ *	2 or 3 as published by the Free Software Foundation.
++ */
++#include <getopt.h>
++#include <stdbool.h>
++#include <stdio.h>
++#include <string.h>
++
++#include <xtables.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_CHAOS.h>
++
++enum {
++	F_DELUDE = 1 << 0,
++	F_TARPIT = 1 << 1,
++};
++
++static const struct option chaos_tg_opts[] = {
++	{.name = "delude", .has_arg = false, .val = 'd'},
++	{.name = "tarpit", .has_arg = false, .val = 't'},
++	{},
++};
++
++static void chaos_tg_help(void)
++{
++	printf(
++		"CHAOS target v%s options:\n"
++		"  --delude     Enable DELUDE processing for TCP\n"
++		"  --tarpit     Enable TARPIT processing for TCP\n",
++		IPTABLES_VERSION);
++	return;
++}
++
++static int chaos_tg_parse(int c, char **argv, int invert, unsigned int *flags,
++    const void *entry, struct xt_entry_target **target)
++{
++	struct xt_chaos_target_info *info = (void *)((*target)->data);
++	switch (c) {
++		case 'd':
++			info->variant = XTCHAOS_DELUDE;
++			*flags |= F_DELUDE;
++			return true;
++		case 't':
++			info->variant = XTCHAOS_TARPIT;
++			*flags |= F_TARPIT;
++			return true;
++	}
++	return false;
++}
++
++static void chaos_tg_check(unsigned int flags)
++{
++	if ((flags & (F_DELUDE | F_TARPIT)) == (F_DELUDE | F_TARPIT))
++		/* If flags == 0x03, both were specified, which should not be. */
++		exit_error(PARAMETER_PROBLEM,
++		           "CHAOS: only one of --tarpit or --delude "
++		           "may be specified");
++	return;
++}
++
++static void chaos_tg_print(const void *ip,
++    const struct xt_entry_target *target, int numeric)
++{
++	const struct xt_chaos_target_info *info = (const void *)target->data;
++	switch (info->variant) {
++		case XTCHAOS_DELUDE:
++			printf("DELUDE ");
++			break;
++		case XTCHAOS_TARPIT:
++			printf("TARPIT ");
++			break;
++	}
++	return;
++}
++
++static void chaos_tg_save(const void *ip, const struct xt_entry_target *target)
++{
++	const struct xt_chaos_target_info *info = (const void *)target->data;
++	switch (info->variant) {
++		case XTCHAOS_DELUDE:
++			printf("--delude ");
++			break;
++		case XTCHAOS_TARPIT:
++			printf("--tarpit ");
++			break;
++	}
++	return;
++}
++
++static struct xtables_target chaos_tg_reg = {
++	.version       = IPTABLES_VERSION,
++	.name          = "CHAOS",
++	.family        = AF_INET,
++	.size          = XT_ALIGN(sizeof(struct xt_chaos_target_info)),
++	.userspacesize = XT_ALIGN(sizeof(struct xt_chaos_target_info)),
++	.help          = chaos_tg_help,
++	.parse         = chaos_tg_parse,
++	.final_check   = chaos_tg_check,
++	.print         = chaos_tg_print,
++	.save          = chaos_tg_save,
++	.extra_opts    = chaos_tg_opts,
++};
++
++void _init(void)
++{
++	xtables_register_target(&chaos_tg_reg);
++	return;
++}
+Index: iptables-1.4.0/extensions/libxt_CHAOS.man
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_CHAOS.man
+@@ -0,0 +1,18 @@
++Causes confusion on the other end by doing odd things with incoming packets.
++CHAOS will randomly reply (or not) with one of its configurable subtargets:
++.TP
++\fB--delude\fR
++Use the REJECT and DELUDE targets as a base to do a sudden or deferred
++connection reset, fooling some network scanners to return non-deterministic
++(randomly open/closed) results, and in case it is deemed open, it is actually
++closed/filtered.
++.TP
++\fB--tarpit\fR
++Use the REJECT and TARPIT target as a base to hold the connection until it
++times out. This consumes conntrack entries when connection tracking is loaded
++(which usually is on most machines), and routers inbetween you and the Internet
++may fail to do their connection tracking if they have to handle more
++connections than they can.
++.PP
++The randomness factor of not replying vs. replying can be set during load-time
++of the xt_CHAOS module or during runtime in /sys/modules/xt_CHAOS/parameters.
+Index: iptables-1.4.0/extensions/.DELUDE-testx
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/.DELUDE-testx
+@@ -0,0 +1,3 @@
++#! /bin/sh
++
++[ -f "$KERNEL_DIR/net/netfilter/xt_DELUDE.c" ] && echo "DELUDE"
+Index: iptables-1.4.0/extensions/libxt_DELUDE.c
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_DELUDE.c
+@@ -0,0 +1,49 @@
++/*
++ *	DELUDE target for iptables
++ *	Copyright © CC Computer Consultants GmbH, 2006 - 2007
++ *	Contact: Jan Engelhardt <jengelh@computergmbh.de>
++ *
++ *	This program is free software; you can redistribute it and/or modify
++ *	it under the terms of the GNU General Public License; either version
++ *	2 or 3 as published by the Free Software Foundation.
++ */
++#include <getopt.h>
++#include <stdio.h>
++#include <string.h>
++
++#include <xtables.h>
++#include <linux/netfilter/x_tables.h>
++
++static void delude_tg_help(void)
++{
++	printf("DELUDE takes no options\n");
++	return;
++}
++
++static int delude_tg_parse(int c, char **argv, int invert, unsigned int *flags,
++    const void *entry, struct xt_entry_target **target)
++{
++	return 0;
++}
++
++static void delude_tg_check(unsigned int flags)
++{
++	return;
++}
++
++static struct xtables_target delude_tg_reg = {
++	.version       = IPTABLES_VERSION,
++	.name          = "DELUDE",
++	.family        = AF_INET,
++	.size          = XT_ALIGN(0),
++	.userspacesize = XT_ALIGN(0),
++	.help          = delude_tg_help,
++	.parse         = delude_tg_parse,
++	.final_check   = delude_tg_check,
++};
++
++void _init(void)
++{
++	xtables_register_target(&delude_tg_reg);
++	return;
++}
+Index: iptables-1.4.0/extensions/libxt_DELUDE.man
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_DELUDE.man
+@@ -0,0 +1,4 @@
++The DELUDE target will reply to a SYN packet with SYN-ACK, and to all other
++packets with an RST. This will terminate the connection much like REJECT, but
++network scanners doing TCP half-open discovery can be spoofed to make them
++belive the port is open rather than closed/filtered.
+Index: iptables-1.4.0/extensions/.portscan-testx
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/.portscan-testx
+@@ -0,0 +1,3 @@
++#! /bin/sh
++
++[ -f "$KERNEL_DIR/include/linux/netfilter/xt_portscan.h" ] && echo "portscan"
+Index: iptables-1.4.0/extensions/libxt_portscan.c
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_portscan.c
+@@ -0,0 +1,127 @@
++/*
++ *	portscan match for iptables
++ *	Copyright © CC Computer Consultants GmbH, 2006 - 2007
++ *	Contact: Jan Engelhardt <jengelh@computergmbh.de>
++ *
++ *	This program is free software; you can redistribute it and/or modify
++ *	it under the terms of the GNU General Public License; either version
++ *	2 or 3 as published by the Free Software Foundation.
++ */
++#include <stdbool.h>
++#include <stdio.h>
++#include <string.h>
++#include <stdlib.h>
++#include <getopt.h>
++
++#include <xtables.h>
++#include <iptables.h>
++#include <linux/netfilter/x_tables.h>
++#include <linux/netfilter/xt_portscan.h>
++
++static const struct option portscan_mt_opts[] = {
++	{.name = "stealth", .has_arg = false, .val = 'x'},
++	{.name = "synscan", .has_arg = false, .val = 's'},
++	{.name = "cnscan",  .has_arg = false, .val = 'c'},
++	{.name = "grscan",  .has_arg = false, .val = 'g'},
++	{},
++};
++
++static void portscan_mt_help(void)
++{
++	printf(
++		"portscan match v%s options:\n"
++		"(Combining them will make them match by OR-logic)\n"
++		"  --stealth    Match TCP Stealth packets\n"
++		"  --synscan    Match TCP SYN scans\n"
++		"  --cnscan     Match TCP Connect scans\n"
++		"  --grscan     Match Banner Grabbing scans\n",
++		IPTABLES_VERSION);
++	return;
++}
++
++static int portscan_mt_parse(int c, char **argv, int invert,
++    unsigned int *flags, const void *entry, struct xt_entry_match **match)
++{
++	struct xt_portscan_match_info *info = (void *)((*match)->data);
++
++	switch (c) {
++		case 'c':
++			info->match_cn = true;
++			return true;
++		case 'g':
++			info->match_gr = true;
++			return true;
++		case 's':
++			info->match_syn = true;
++			return true;
++		case 'x':
++			info->match_stealth = true;
++			return true;
++	}
++	return false;
++}
++
++static void portscan_mt_check(unsigned int flags)
++{
++	return;
++}
++
++static void portscan_mt_print(const void *ip,
++    const struct xt_entry_match *match, int numeric)
++{
++	const struct xt_portscan_match_info *info = (const void *)(match->data);
++	const char *s = "";
++
++	printf("portscan ");
++	if (info->match_stealth) {
++		printf("STEALTH");
++		s = ",";
++	}
++	if (info->match_syn) {
++		printf("%sSYNSCAN", s);
++		s = ",";
++	}
++	if (info->match_cn) {
++		printf("%sCNSCAN", s);
++		s = ",";
++	}
++	if (info->match_gr)
++		printf("%sGRSCAN", s);
++	printf(" ");
++	return;
++}
++
++static void portscan_mt_save(const void *ip, const struct xt_entry_match *match)
++{
++	const struct xt_portscan_match_info *info = (const void *)(match->data);
++
++	if (info->match_stealth)
++		printf("--stealth ");
++	if (info->match_syn)
++		printf("--synscan ");
++	if (info->match_cn)
++		printf("--cnscan ");
++	if (info->match_gr)
++		printf("--grscan ");
++	return;
++}
++
++static struct xtables_match portscan_mt_reg = {
++	.version       = IPTABLES_VERSION,
++	.name          = "portscan",
++	.family        = AF_INET,
++	.size          = XT_ALIGN(sizeof(struct xt_portscan_match_info)),
++	.userspacesize = XT_ALIGN(sizeof(struct xt_portscan_match_info)),
++	.help          = portscan_mt_help,
++	.parse         = portscan_mt_parse,
++	.final_check   = portscan_mt_check,
++	.print         = portscan_mt_print,
++	.save          = portscan_mt_save,
++	.extra_opts    = portscan_mt_opts,
++};
++
++void _init(void)
++{
++	xtables_register_match(&portscan_mt_reg);
++	return;
++}
+Index: iptables-1.4.0/extensions/libxt_portscan.man
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_portscan.man
+@@ -0,0 +1,27 @@
++Detects simple port scan attemps based upon the packet's contents. (This is
++different from other implementations, which also try to match the rate of new
++connections.) Note that an attempt is only discovered after it has been carried
++out, but this information can be used in conjunction with other rules to block
++the remote host's future connections. So this match module will match on the
++(probably) last packet the remote side will send to your machine.
++.TP
++\fB--stealth\fR
++Match if the packet did not belong to any known TCP connection
++(Stealth/FIN/XMAS/NULL scan).
++.TP
++\fB--synscan\fR
++Match if the connection was a TCP half-open discovery (SYN scan), i.e. the
++connection was torn down after the 2nd packet in the 3-way handshake.
++.TP
++\fB--cnscan\fR
++Match if the connection was a TCP full open discovery (connect scan), i.e. the
++connection was torn down after completion of the 3-way handshake.
++.TP
++\fB--grscan\fR
++Match if data in the connection only flew in the direction of the remote side,
++e.g. if the connection was terminated after a locally running daemon sent its
++identification. (e.g. openssh)
++.PP
++NOTE: Some clients (Windows XP for example) may do what looks like a SYN scan,
++so be advised to carefully use xt_portscan in conjunction with blocking rules,
++as it may lock out your very own internal network.
diff --git a/package/iptables/patches/1.4.0/007-tarpit_support.patch b/package/iptables/patches/1.4.0/007-tarpit_support.patch
new file mode 100644
index 0000000000..f1914f90be
--- /dev/null
+++ b/package/iptables/patches/1.4.0/007-tarpit_support.patch
@@ -0,0 +1,106 @@
+Index: iptables-1.4.0/extensions/libxt_TARPIT.c
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_TARPIT.c
+@@ -0,0 +1,55 @@
++/* Shared library add-on to iptables to add TARPIT target support */
++#include <stdio.h>
++#include <getopt.h>
++
++#include <xtables.h>
++#include <linux/netfilter/x_tables.h>
++
++static void TARPIT_help(void)
++{
++	fputs(
++"TARPIT takes no options\n"
++"\n", stdout);
++}
++
++static struct option TARPIT_opts[] = {
++	{ 0 }
++};
++
++static int TARPIT_parse(int c, char **argv, int invert, unsigned int *flags,
++			const void *entry, struct xt_entry_target **target)
++{
++	return 0;
++}
++
++static void TARPIT_final_check(unsigned int flags)
++{
++}
++
++static void TARPIT_print(const void *ip, const struct xt_entry_target *target,
++			int numeric)
++{
++}
++
++static void TARPIT_save(const void *ip, const struct xt_entry_target *target)
++{
++}
++
++static struct xtables_target tarpit_target = {
++	.family		= AF_INET,
++	.name		= "TARPIT",
++	.version	= IPTABLES_VERSION,
++	.size		= XT_ALIGN(0),
++	.userspacesize	= XT_ALIGN(0),
++	.help		= TARPIT_help,
++	.parse		= TARPIT_parse,
++	.final_check	= TARPIT_final_check,
++	.print		= TARPIT_print,
++	.save		= TARPIT_save,
++	.extra_opts	= TARPIT_opts
++};
++
++void _init(void)
++{
++	xtables_register_target(&tarpit_target);
++}
+Index: iptables-1.4.0/extensions/libxt_TARPIT.man
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/libxt_TARPIT.man
+@@ -0,0 +1,34 @@
++Captures and holds incoming TCP connections using no local
++per-connection resources. Connections are accepted, but immediately
++switched to the persist state (0 byte window), in which the remote
++side stops sending data and asks to continue every 60-240 seconds.
++Attempts to close the connection are ignored, forcing the remote side
++to time out the connection in 12-24 minutes.
++
++This offers similar functionality to LaBrea
++<http://www.hackbusters.net/LaBrea/> but doesn't require dedicated
++hardware or IPs. Any TCP port that you would normally DROP or REJECT
++can instead become a tarpit.
++
++To tarpit connections to TCP port 80 destined for the current machine:
++.IP
++iptables -A INPUT -p tcp -m tcp --dport 80 -j TARPIT
++.P
++To significantly slow down Code Red/Nimda-style scans of unused address
++space, forward unused ip addresses to a Linux box not acting as a router
++(e.g. "ip route 10.0.0.0 255.0.0.0 ip.of.linux.box" on a Cisco), enable IP
++forwarding on the Linux box, and add:
++.IP
++iptables -A FORWARD -p tcp -j TARPIT
++.IP
++iptables -A FORWARD -j DROP
++.TP
++NOTE:
++If you use the conntrack module while you are using TARPIT, you should
++also use the NOTRACK target, or the kernel will unnecessarily allocate
++resources for each TARPITted connection. To TARPIT incoming
++connections to the standard IRC port while using conntrack, you could:
++.IP
++iptables -t raw -A PREROUTING -p tcp --dport 6667 -j NOTRACK
++.IP
++iptables -A INPUT -p tcp --dport 6667 -j TARPIT
+Index: iptables-1.4.0/extensions/.TARPIT-testx
+===================================================================
+--- /dev/null
++++ iptables-1.4.0/extensions/.TARPIT-testx
+@@ -0,0 +1,2 @@
++#! /bin/sh
++[ -f "$KERNEL_DIR/net/netfilter/xt_TARPIT.c" ] && echo "TARPIT"