update iptables to 1.4.0 (2.6 kernels only), refresh kernel patches

SVN-Revision: 10843

3 files changed, 397 insertions, 388 deletions

diff --git a/target/linux/generic-2.6/patches-2.6.23/101-netfilter_layer7_pktmatch.patch b/target/linux/generic-2.6/patches-2.6.23/101-netfilter_layer7_pktmatch.patch
new file mode 100644
index 0000000000..2574543131
--- /dev/null
+++ b/target/linux/generic-2.6/patches-2.6.23/101-netfilter_layer7_pktmatch.patch
@@ -0,0 +1,113 @@
+Index: linux-2.6.23.16/include/linux/netfilter/xt_layer7.h
+===================================================================
+--- linux-2.6.23.16.orig/include/linux/netfilter/xt_layer7.h
++++ linux-2.6.23.16/include/linux/netfilter/xt_layer7.h
+@@ -8,6 +8,7 @@ struct xt_layer7_info {
+     char protocol[MAX_PROTOCOL_LEN];
+     char pattern[MAX_PATTERN_LEN];
+     u_int8_t invert;
++    u_int8_t pkt;
+ };
+ 
+ #endif /* _XT_LAYER7_H */
+Index: linux-2.6.23.16/net/netfilter/xt_layer7.c
+===================================================================
+--- linux-2.6.23.16.orig/net/netfilter/xt_layer7.c
++++ linux-2.6.23.16/net/netfilter/xt_layer7.c
+@@ -297,34 +297,36 @@ static int match_no_append(struct nf_con
+ }
+ 
+ /* add the new app data to the conntrack.  Return number of bytes added. */
+-static int add_data(struct nf_conn * master_conntrack,
+-                    char * app_data, int appdatalen)
++static int add_datastr(char *target, int offset, char *app_data, int len)
+ {
+ 	int length = 0, i;
+-	int oldlength = master_conntrack->layer7.app_data_len;
+-
+-	/* This is a fix for a race condition by Deti Fliegl. However, I'm not 
+-	   clear on whether the race condition exists or whether this really 
+-	   fixes it.  I might just be being dense... Anyway, if it's not really 
+-	   a fix, all it does is waste a very small amount of time. */
+-	if(!master_conntrack->layer7.app_data) return 0;
++	
++	if (!target) return 0;
+ 
+ 	/* Strip nulls. Make everything lower case (our regex lib doesn't
+ 	do case insensitivity).  Add it to the end of the current data. */
+-	for(i = 0; i < maxdatalen-oldlength-1 &&
+-		   i < appdatalen; i++) {
++	for(i = 0; i < maxdatalen-offset-1 && i < len; i++) {
+ 		if(app_data[i] != '\0') {
+ 			/* the kernel version of tolower mungs 'upper ascii' */
+-			master_conntrack->layer7.app_data[length+oldlength] =
++			target[length+offset] =
+ 				isascii(app_data[i])? 
+ 					tolower(app_data[i]) : app_data[i];
+ 			length++;
+ 		}
+ 	}
++	target[length+offset] = '\0';
++	
++	return length;
++}
+ 
+-	master_conntrack->layer7.app_data[length+oldlength] = '\0';
+-	master_conntrack->layer7.app_data_len = length + oldlength;
++/* add the new app data to the conntrack.  Return number of bytes added. */
++static int add_data(struct nf_conn * master_conntrack,
++                    char * app_data, int appdatalen)
++{
++	int length;
+ 
++	length = add_datastr(master_conntrack->layer7.app_data, master_conntrack->layer7.app_data_len, app_data, appdatalen);
++	master_conntrack->layer7.app_data_len += length;
+ 	return length;
+ }
+ 
+@@ -411,7 +413,7 @@ match(const struct sk_buff *skbin,
+ 	const struct xt_layer7_info * info = matchinfo;
+ 	enum ip_conntrack_info master_ctinfo, ctinfo;
+ 	struct nf_conn *master_conntrack, *conntrack;
+-	unsigned char * app_data;
++	unsigned char *app_data, *tmp_data;
+ 	unsigned int pattern_result, appdatalen;
+ 	regexp * comppattern;
+ 
+@@ -439,8 +441,8 @@ match(const struct sk_buff *skbin,
+ 		master_conntrack = master_ct(master_conntrack);
+ 
+ 	/* if we've classified it or seen too many packets */
+-	if(TOTAL_PACKETS > num_packets ||
+-	   master_conntrack->layer7.app_proto) {
++	if(!info->pkt && (TOTAL_PACKETS > num_packets ||
++	   master_conntrack->layer7.app_proto)) {
+ 
+ 		pattern_result = match_no_append(conntrack, master_conntrack, 
+ 						 ctinfo, master_ctinfo, info);
+@@ -473,6 +475,25 @@ match(const struct sk_buff *skbin,
+ 	/* the return value gets checked later, when we're ready to use it */
+ 	comppattern = compile_and_cache(info->pattern, info->protocol);
+ 
++	if (info->pkt) {
++		tmp_data = kmalloc(maxdatalen, GFP_ATOMIC);
++		if(!tmp_data){
++			if (net_ratelimit())
++				printk(KERN_ERR "layer7: out of memory in match, bailing.\n");
++			return info->invert;
++		}
++
++		tmp_data[0] = '\0';
++		add_datastr(tmp_data, 0, app_data, appdatalen);
++		pattern_result = ((comppattern && regexec(comppattern, tmp_data)) ? 1 : 0);
++
++		kfree(tmp_data);
++		tmp_data = NULL;
++		spin_unlock_bh(&l7_lock);
++
++		return (pattern_result ^ info->invert);
++	}
++
+ 	/* On the first packet of a connection, allocate space for app data */
+ 	if(TOTAL_PACKETS == 1 && !skb->cb[0] && 
+ 	   !master_conntrack->layer7.app_data){
diff --git a/target/linux/generic-2.6/patches-2.6.23/170-netfilter_chaostables.patch b/target/linux/generic-2.6/patches-2.6.23/170-netfilter_chaostables_0.8.patch
index cfc0092330..ad9e0597bf 100644
--- a/target/linux/generic-2.6/patches-2.6.23/170-netfilter_chaostables.patch
+++ b/target/linux/generic-2.6/patches-2.6.23/170-netfilter_chaostables_0.8.patch
@@ -1,17 +1,17 @@
-Index: linux-2.6.23/include/linux/netfilter/oot_conntrack.h
+Index: linux-2.6.23.16/include/linux/netfilter/oot_conntrack.h
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/include/linux/netfilter/oot_conntrack.h	2007-10-10 13:52:59.000000000 +0800
+--- /dev/null
++++ linux-2.6.23.16/include/linux/netfilter/oot_conntrack.h
 @@ -0,0 +1,5 @@
 +#if defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
 +#	include <linux/netfilter_ipv4/ip_conntrack.h>
 +#else /* linux-2.6.20+ */
 +#	include <net/netfilter/nf_nat_rule.h>
 +#endif
-Index: linux-2.6.23/include/linux/netfilter/oot_trans.h
+Index: linux-2.6.23.16/include/linux/netfilter/oot_trans.h
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/include/linux/netfilter/oot_trans.h	2007-10-10 13:52:59.000000000 +0800
+--- /dev/null
++++ linux-2.6.23.16/include/linux/netfilter/oot_trans.h
 @@ -0,0 +1,14 @@
 +/* Out of tree workarounds */
 +#include <linux/version.h>
@@ -27,42 +27,42 @@ Index: linux-2.6.23/include/linux/netfilter/oot_trans.h
 +#	define tcp_v4_check(tcph, tcph_sz, s, d, csp) \
 +		tcp_v4_check((tcph_sz), (s), (d), (csp))
 +#endif
-Index: linux-2.6.23/include/linux/netfilter/xt_CHAOS.h
+Index: linux-2.6.23.16/include/linux/netfilter/xt_CHAOS.h
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/include/linux/netfilter/xt_CHAOS.h	2007-10-10 13:52:59.000000000 +0800
+--- /dev/null
++++ linux-2.6.23.16/include/linux/netfilter/xt_CHAOS.h
 @@ -0,0 +1,14 @@
-+#ifndef _LINUX_XT_CHAOS_H
-+#define _LINUX_XT_CHAOS_H 1
++#ifndef _LINUX_NETFILTER_XT_CHAOS_H
++#define _LINUX_NETFILTER_XT_CHAOS_H 1
 +
-+enum xt_chaos_variant {
++enum xt_chaos_target_variant {
 +	XTCHAOS_NORMAL,
 +	XTCHAOS_TARPIT,
 +	XTCHAOS_DELUDE,
 +};
 +
-+struct xt_chaos_info {
-+	enum xt_chaos_variant variant;
++struct xt_chaos_target_info {
++	uint8_t variant;
 +};
 +
-+#endif /* _LINUX_XT_CHAOS_H */
-Index: linux-2.6.23/include/linux/netfilter/xt_portscan.h
++#endif /* _LINUX_NETFILTER_XT_CHAOS_H */
+Index: linux-2.6.23.16/include/linux/netfilter/xt_portscan.h
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/include/linux/netfilter/xt_portscan.h	2007-10-10 13:52:59.000000000 +0800
+--- /dev/null
++++ linux-2.6.23.16/include/linux/netfilter/xt_portscan.h
 @@ -0,0 +1,8 @@
-+#ifndef _LINUX_XT_PORTSCAN_H
-+#define _LINUX_XT_PORTSCAN_H 1
++#ifndef _LINUX_NETFILTER_XT_PORTSCAN_H
++#define _LINUX_NETFILTER_XT_PORTSCAN_H 1
 +
-+struct xt_portscan_info {
-+	unsigned int match_stealth, match_syn, match_cn, match_gr;
++struct xt_portscan_match_info {
++	uint8_t match_stealth, match_syn, match_cn, match_gr;
 +};
 +
-+#endif /* _LINUX_XT_PORTSCAN_H */
-Index: linux-2.6.23/net/netfilter/find_match.c
++#endif /* _LINUX_NETFILTER_XT_PORTSCAN_H */
+Index: linux-2.6.23.16/net/netfilter/find_match.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/net/netfilter/find_match.c	2007-10-10 13:52:59.000000000 +0800
+--- /dev/null
++++ linux-2.6.23.16/net/netfilter/find_match.c
 @@ -0,0 +1,39 @@
 +/*
 +    xt_request_find_match
@@ -95,7 +95,7 @@ Index: linux-2.6.23/net/netfilter/find_match.c
 +
 +	match = try_then_request_module(xt_find_match(af, name, revision),
 +		"%st_%s", xt_prefix[af], name);
-+	if(IS_ERR(match) || match == NULL)
++	if (IS_ERR(match) || match == NULL)
 +		return NULL;
 +
 +	return match;
@@ -103,11 +103,11 @@ Index: linux-2.6.23/net/netfilter/find_match.c
 +
 +/* In case it goes into mainline, let this out-of-tree package compile */
 +#define xt_request_find_match xt_request_find_match_lo
-Index: linux-2.6.23/net/netfilter/Kconfig
+Index: linux-2.6.23.16/net/netfilter/Kconfig
 ===================================================================
---- linux-2.6.23.orig/net/netfilter/Kconfig	2007-10-10 04:31:38.000000000 +0800
-+++ linux-2.6.23/net/netfilter/Kconfig	2007-10-10 13:53:04.000000000 +0800
-@@ -265,6 +265,14 @@
+--- linux-2.6.23.16.orig/net/netfilter/Kconfig
++++ linux-2.6.23.16/net/netfilter/Kconfig
+@@ -265,6 +265,14 @@ config NETFILTER_XTABLES
  
  # alphabetically ordered list of targets
  
@@ -122,7 +122,7 @@ Index: linux-2.6.23/net/netfilter/Kconfig
  config NETFILTER_XT_TARGET_CLASSIFY
  	tristate '"CLASSIFY" target support'
  	depends on NETFILTER_XTABLES
-@@ -292,6 +300,14 @@
+@@ -292,6 +300,14 @@ config NETFILTER_XT_TARGET_CONNMARK
  	  <file:Documentation/kbuild/modules.txt>.  The module will be called
  	  ipt_CONNMARK.ko.  If unsure, say `N'.
  
@@ -137,7 +137,7 @@ Index: linux-2.6.23/net/netfilter/Kconfig
  config NETFILTER_XT_TARGET_DSCP
  	tristate '"DSCP" target support'
  	depends on NETFILTER_XTABLES
-@@ -556,6 +572,14 @@
+@@ -556,6 +572,14 @@ config NETFILTER_XT_MATCH_POLICY
  
  	  To compile it as a module, choose M here.  If unsure, say N.
  
@@ -152,42 +152,38 @@ Index: linux-2.6.23/net/netfilter/Kconfig
  config NETFILTER_XT_MATCH_MULTIPORT
  	tristate "Multiple port match support"
  	depends on NETFILTER_XTABLES
-Index: linux-2.6.23/net/netfilter/Makefile
+Index: linux-2.6.23.16/net/netfilter/Makefile
 ===================================================================
---- linux-2.6.23.orig/net/netfilter/Makefile	2007-10-10 04:31:38.000000000 +0800
-+++ linux-2.6.23/net/netfilter/Makefile	2007-10-10 13:52:59.000000000 +0800
-@@ -38,8 +38,10 @@
- obj-$(CONFIG_NETFILTER_XTABLES) += x_tables.o xt_tcpudp.o
- 
- # targets
+--- linux-2.6.23.16.orig/net/netfilter/Makefile
++++ linux-2.6.23.16/net/netfilter/Makefile
+@@ -49,6 +49,8 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) 
+ obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
 +obj-$(CONFIG_NETFILTER_XT_TARGET_CHAOS) += xt_CHAOS.o
- obj-$(CONFIG_NETFILTER_XT_TARGET_CLASSIFY) += xt_CLASSIFY.o
- obj-$(CONFIG_NETFILTER_XT_TARGET_CONNMARK) += xt_CONNMARK.o
 +obj-$(CONFIG_NETFILTER_XT_TARGET_DELUDE) += xt_DELUDE.o
- obj-$(CONFIG_NETFILTER_XT_TARGET_DSCP) += xt_DSCP.o
- obj-$(CONFIG_NETFILTER_XT_TARGET_MARK) += xt_MARK.o
- obj-$(CONFIG_NETFILTER_XT_TARGET_NFQUEUE) += xt_NFQUEUE.o
-@@ -66,6 +68,7 @@
- obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
+ 
+ # matches
+ obj-$(CONFIG_NETFILTER_XT_MATCH_COMMENT) += xt_comment.o
+@@ -78,3 +80,4 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_TCPMSS) 
+ obj-$(CONFIG_NETFILTER_XT_MATCH_PHYSDEV) += xt_physdev.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_U32) += xt_u32.o
+ obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
 +obj-$(CONFIG_NETFILTER_XT_MATCH_PORTSCAN) += xt_portscan.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o
- obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
-Index: linux-2.6.23/net/netfilter/xt_CHAOS.c
+Index: linux-2.6.23.16/net/netfilter/xt_CHAOS.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/net/netfilter/xt_CHAOS.c	2007-10-10 13:52:59.000000000 +0800
-@@ -0,0 +1,205 @@
+--- /dev/null
++++ linux-2.6.23.16/net/netfilter/xt_CHAOS.c
+@@ -0,0 +1,200 @@
 +/*
-+	CHAOS target for netfilter
-+
-+	Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2006 - 2007
-+	This program is free software; you can redistribute it and/or modify
-+	it under the terms of the GNU General Public License version 2 as
-+	published by the Free Software Foundation.
-+*/
++ *	CHAOS target for netfilter
++ *	Copyright © CC Computer Consultants GmbH, 2006 - 2007
++ *	Contact: Jan Engelhardt <jengelh@computergmbh.de>
++ *
++ *	This program is free software; you can redistribute it and/or modify
++ *	it under the terms of the GNU General Public License; either version
++ *	2 or 3 as published by the Free Software Foundation.
++ */
 +#include <linux/icmp.h>
 +#include <linux/in.h>
 +#include <linux/ip.h>
@@ -198,9 +194,17 @@ Index: linux-2.6.23/net/netfilter/xt_CHAOS.c
 +#include <linux/netfilter/xt_tcpudp.h>
 +#include <linux/netfilter_ipv4/ipt_REJECT.h>
 +#include <net/ip.h>
-+#include <linux/netfilter/xt_CHAOS.h>
-+#include "find_match.c"
-+#include <linux/netfilter/oot_trans.h>
++#if defined(_LOCAL)
++#	include "xt_CHAOS.h"
++#	include "find_match.c"
++#elif defined(CONFIG_NETFILTER_XT_TARGET_CHAOS) || \
++    defined(CONFIG_NETFILTER_XT_TARGET_CHAOS_MODULE)
++#	include <linux/netfilter/xt_CHAOS.h>
++#	include "find_match.c"
++#else
++#	include "xt_CHAOS.h"
++#	include "find_match.c"
++#endif
 +#define PFX KBUILD_MODNAME ": "
 +
 +/* Module parameters */
@@ -226,111 +230,97 @@ Index: linux-2.6.23/net/netfilter/xt_CHAOS.c
 +};
 +
 +/* CHAOS functions */
-+static void xt_chaos_total(const struct xt_chaos_info *info,
++static void xt_chaos_total(const struct xt_chaos_target_info *info,
 +    struct sk_buff **pskb, const struct net_device *in,
 +    const struct net_device *out, unsigned int hooknum)
 +{
-+	const int protoff = ip_hdrlen(*pskb);
-+	const int offset  = ntohs(ip_hdr(*pskb)->frag_off) & IP_OFFSET;
++	const struct iphdr *iph = ip_hdr(*pskb);
++	const int protoff       = 4 * iph->ihl;
++	const int offset        = ntohs(iph->frag_off) & IP_OFFSET;
 +	const struct xt_target *destiny;
-+	bool hotdrop = false;
-+	int ret;
++	bool hotdrop = false, ret;
 +
 +	ret = xm_tcp->match(*pskb, in, out, xm_tcp, &tcp_params,
 +	                    offset, protoff, &hotdrop);
-+	if(!ret || hotdrop || (unsigned int)net_random() > delude_percentage)
++	if (!ret || hotdrop || (unsigned int)net_random() > delude_percentage)
 +		return;
 +
 +	destiny = (info->variant == XTCHAOS_TARPIT) ? xt_tarpit : xt_delude;
-+#ifdef HAVE_TARGUSERINFO
-+	destiny->target(pskb, in, out, hooknum, destiny, NULL, NULL);
-+#else
 +	destiny->target(pskb, in, out, hooknum, destiny, NULL);
-+#endif
 +	return;
 +}
 +
-+static unsigned int xt_chaos_target(struct sk_buff **pskb,
++static unsigned int chaos_tg(struct sk_buff **pskb,
 +    const struct net_device *in, const struct net_device *out,
-+    unsigned int hooknum, const struct xt_target *target, const void *targinfo
-+#ifdef HAVE_TARGUSERINFO
-+    ,
-+    void *userinfo
-+#endif
-+    )
++    unsigned int hooknum, const struct xt_target *target, const void *targinfo)
 +{
-+	/* Equivalent to:
++	/*
++	 * Equivalent to:
 +	 * -A chaos -m statistic --mode random --probability \
 +	 *         $reject_percentage -j REJECT --reject-with host-unreach;
 +	 * -A chaos -p tcp -m statistic --mode random --probability \
 +	 *         $delude_percentage -j DELUDE;
 +	 * -A chaos -j DROP;
 +	 */
-+	const struct xt_chaos_info *info = targinfo;
++	const struct xt_chaos_target_info *info = targinfo;
++	const struct iphdr *iph = ip_hdr(*pskb);
 +
-+	if((unsigned int)net_random() <= reject_percentage)
-+#ifdef HAVE_TARGUSERINFO
-+		return xt_reject->target(pskb, in, out, hooknum, target,
-+		       &reject_params, userinfo);
-+#else
++	if ((unsigned int)net_random() <= reject_percentage)
 +		return xt_reject->target(pskb, in, out, hooknum, target,
 +		       &reject_params);
-+#endif
 +
 +	/* TARPIT/DELUDE may not be called from the OUTPUT chain */
-+	if(ip_hdr(*pskb)->protocol == IPPROTO_TCP &&
-+	  info->variant != XTCHAOS_NORMAL && hooknum != NF_IP_LOCAL_OUT)
++	if (iph->protocol == IPPROTO_TCP &&
++	    info->variant != XTCHAOS_NORMAL && hooknum != NF_IP_LOCAL_OUT)
 +		xt_chaos_total(info, pskb, in, out, hooknum);
 +
 +	return NF_DROP;
 +}
 +
-+static bool xt_chaos_checkentry(const char *tablename, const void *entry,
-+    const struct xt_target *target, void *targinfo,
-+#ifdef HAVE_TARGINFOSIZE
-+    unsigned int targinfosize,
-+#endif
-+    unsigned int hook_mask)
++static bool chaos_tg_check(const char *tablename, const void *entry,
++    const struct xt_target *target, void *targinfo, unsigned int hook_mask)
 +{
-+	const struct xt_chaos_info *info = targinfo;
-+	if(info->variant == XTCHAOS_DELUDE && !have_delude) {
++	const struct xt_chaos_target_info *info = targinfo;
++
++	if (info->variant == XTCHAOS_DELUDE && !have_delude) {
 +		printk(KERN_WARNING PFX "Error: Cannot use --delude when "
 +		       "DELUDE module not available\n");
 +		return false;
 +	}
-+	if(info->variant == XTCHAOS_TARPIT && !have_tarpit) {
++	if (info->variant == XTCHAOS_TARPIT && !have_tarpit) {
 +		printk(KERN_WARNING PFX "Error: Cannot use --tarpit when "
 +		       "TARPIT module not available\n");
 +		return false;
 +	}
++
 +	return true;
 +}
 +
-+static struct xt_target xt_chaos_info = {
++static struct xt_target chaos_tg_reg = {
 +	.name       = "CHAOS",
-+	.target     = xt_chaos_target,
-+	.checkentry = xt_chaos_checkentry,
++	.family     = AF_INET,
 +	.table      = "filter",
-+	.targetsize = sizeof(struct xt_chaos_info),
 +	.hooks      = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) |
 +	              (1 << NF_IP_LOCAL_OUT),
-+	.family     = AF_INET,
++	.checkentry = chaos_tg_check,
++	.target     = chaos_tg,
++	.targetsize = sizeof(struct xt_chaos_target_info),
 +	.me         = THIS_MODULE,
 +};
 +
-+static int __init xt_chaos_init(void)
++static int __init chaos_tg_init(void)
 +{
 +	int ret = -EINVAL;
 +
 +	xm_tcp = xt_request_find_match(AF_INET, "tcp", 0);
-+	if(xm_tcp == NULL) {
++	if (xm_tcp == NULL) {
 +		printk(KERN_WARNING PFX "Error: Could not find or load "
 +		       "\"tcp\" match\n");
 +		return -EINVAL;
 +	}
 +
 +	xt_reject = xt_request_find_target(AF_INET, "REJECT", 0);
-+	if(xt_reject == NULL) {
++	if (xt_reject == NULL) {
 +		printk(KERN_WARNING PFX "Error: Could not find or load "
 +		       "\"REJECT\" target\n");
 +		goto out2;
@@ -338,17 +328,17 @@ Index: linux-2.6.23/net/netfilter/xt_CHAOS.c
 +
 +	xt_tarpit   = xt_request_find_target(AF_INET, "TARPIT", 0);
 +	have_tarpit = xt_tarpit != NULL;
-+	if(!have_tarpit)
++	if (!have_tarpit)
 +		printk(KERN_WARNING PFX "Warning: Could not find or load "
 +		       "\"TARPIT\" target\n");
 +
 +	xt_delude   = xt_request_find_target(AF_INET, "DELUDE", 0);
 +	have_delude = xt_delude != NULL;
-+	if(!have_delude)
++	if (!have_delude)
 +		printk(KERN_WARNING PFX "Warning: Could not find or load "
 +		       "\"DELUDE\" target\n");
 +
-+	if((ret = xt_register_target(&xt_chaos_info)) != 0) {
++	if ((ret = xt_register_target(&chaos_tg_reg)) != 0) {
 +		printk(KERN_WARNING PFX "xt_register_target returned "
 +		       "error %d\n", ret);
 +		goto out3;
@@ -357,9 +347,9 @@ Index: linux-2.6.23/net/netfilter/xt_CHAOS.c
 +	return 0;
 +
 + out3:
-+ 	if(have_delude)
++ 	if (have_delude)
 + 		module_put(xt_delude->me);
-+	if(have_tarpit)
++	if (have_tarpit)
 +		module_put(xt_tarpit->me);
 +	module_put(xt_reject->me);
 + out2:
@@ -367,132 +357,67 @@ Index: linux-2.6.23/net/netfilter/xt_CHAOS.c
 +	return ret;
 +}
 +
-+static void __exit xt_chaos_exit(void)
++static void __exit chaos_tg_exit(void)
 +{
-+	xt_unregister_target(&xt_chaos_info);
++	xt_unregister_target(&chaos_tg_reg);
 +	module_put(xm_tcp->me);
 +	module_put(xt_reject->me);
-+	if(have_delude)
++	if (have_delude)
 +		module_put(xt_delude->me);
-+	if(have_tarpit)
++	if (have_tarpit)
 +		module_put(xt_tarpit->me);
 +	return;
 +}
 +
-+module_init(xt_chaos_init);
-+module_exit(xt_chaos_exit);
-+MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");
-+MODULE_DESCRIPTION("netfilter CHAOS target");
++module_init(chaos_tg_init);
++module_exit(chaos_tg_exit);
++MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
++MODULE_DESCRIPTION("netfilter \"CHAOS\" target");
 +MODULE_LICENSE("GPL");
 +MODULE_ALIAS("ipt_CHAOS");
-Index: linux-2.6.23/net/netfilter/xt_DELUDE.c
+Index: linux-2.6.23.16/net/netfilter/xt_DELUDE.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/net/netfilter/xt_DELUDE.c	2007-10-10 13:52:59.000000000 +0800
-@@ -0,0 +1,288 @@
+--- /dev/null
++++ linux-2.6.23.16/net/netfilter/xt_DELUDE.c
+@@ -0,0 +1,197 @@
 +/*
-+	DELUDE target
-+	Copyright © Jan Engelhardt <jengelh [at] gmx de>, 2007
-+
-+	Based upon linux-2.6.18.5/net/ipv4/netfilter/ipt_REJECT.c:
-+	(C) 1999-2001 Paul `Rusty' Russell
-+	(C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
-+
-+	xt_DELUDE acts like REJECT, but does reply with SYN-ACK on SYN.
-+
-+	This program is free software; you can redistribute it and/or modify
-+	it under the terms of the GNU General Public License version 2 as
-+	published by the Free Software Foundation.
-+*/
++ *	DELUDE target
++ *	Copyright © CC Computer Consultants GmbH, 2007
++ *	Contact: Jan Engelhardt <jengelh@computergmbh.de>
++ *
++ *	Based upon linux-2.6.18.5/net/ipv4/netfilter/ipt_REJECT.c:
++ *	(C) 1999-2001 Paul `Rusty' Russell
++ *	(C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
++ *
++ *	xt_DELUDE acts like REJECT, but does reply with SYN-ACK on SYN.
++ *
++ *	This program is free software; you can redistribute it and/or modify
++ *	it under the terms of the GNU General Public License version 2 as
++ *	published by the Free Software Foundation.
++ */
 +#include <linux/module.h>
 +#include <linux/skbuff.h>
 +#include <linux/ip.h>
-+#include <linux/random.h>
 +#include <linux/tcp.h>
-+#include <linux/udp.h>
-+#include <linux/icmp.h>
-+#include <net/icmp.h>
-+#include <net/ip.h>
-+#include <net/tcp.h>
-+#include <net/route.h>
-+#include <net/dst.h>
-+#include <linux/netfilter_ipv4/ip_tables.h>
++#include <linux/netfilter/x_tables.h>
 +#ifdef CONFIG_BRIDGE_NETFILTER
 +#	include <linux/netfilter_bridge.h>
 +#endif
-+#include <linux/netfilter/oot_trans.h>
++#include <net/tcp.h>
 +#define PFX KBUILD_MODNAME ": "
 +
-+static inline struct rtable *route_reverse(struct sk_buff *skb,
-+					   struct tcphdr *tcph, int hook)
++static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 +{
-+	struct iphdr *iph = ip_hdr(skb);
-+	struct dst_entry *odst;
-+	struct flowi fl = {};
-+	struct rtable *rt;
-+
-+	/* We don't require ip forwarding to be enabled to be able to
-+	 * send a RST reply for bridged traffic. */
-+	if (hook != NF_IP_FORWARD
-+#ifdef CONFIG_BRIDGE_NETFILTER
-+	    || (skb->nf_bridge && skb->nf_bridge->mask & BRNF_BRIDGED)
-+#endif
-+	   ) {
-+		fl.nl_u.ip4_u.daddr = iph->saddr;
-+		if (hook == NF_IP_LOCAL_IN)
-+			fl.nl_u.ip4_u.saddr = iph->daddr;
-+		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
-+
-+		if (ip_route_output_key(&rt, &fl) != 0)
-+			return NULL;
-+	} else {
-+		/* non-local src, find valid iif to satisfy
-+		 * rp-filter when calling ip_route_input. */
-+		fl.nl_u.ip4_u.daddr = iph->daddr;
-+		if (ip_route_output_key(&rt, &fl) != 0)
-+			return NULL;
-+
-+		odst = skb->dst;
-+		if (ip_route_input(skb, iph->saddr, iph->daddr,
-+		                   RT_TOS(iph->tos), rt->u.dst.dev) != 0) {
-+			dst_release(&rt->u.dst);
-+			return NULL;
-+		}
-+		dst_release(&rt->u.dst);
-+		rt = (struct rtable *)skb->dst;
-+		skb->dst = odst;
-+
-+		fl.nl_u.ip4_u.daddr = iph->saddr;
-+		fl.nl_u.ip4_u.saddr = iph->daddr;
-+		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);
-+	}
-+
-+	if (rt->u.dst.error) {
-+		dst_release(&rt->u.dst);
-+		return NULL;
-+	}
-+
-+	fl.proto = IPPROTO_TCP;
-+	fl.fl_ip_sport = tcph->dest;
-+	fl.fl_ip_dport = tcph->source;
-+
-+	xfrm_lookup((struct dst_entry **)&rt, &fl, NULL, 0);
-+
-+	return rt;
-+}
-+
-+static void send_reset(struct sk_buff *oldskb, int hook)
-+{
-+	struct sk_buff *nskb;
-+	struct iphdr *iph = ip_hdr(oldskb);
 +	struct tcphdr _otcph, *oth, *tcph;
-+	__be16 tmp_port;
-+	__be32 tmp_addr;
-+	int needs_ack;
 +	unsigned int addr_type;
++	struct sk_buff *nskb;
++	u_int16_t tmp_port;
++	u_int32_t tmp_addr;
++	struct iphdr *niph;
++	bool needs_ack;
 +
 +	/* IP header checks: fragment. */
-+	if (iph->frag_off & htons(IP_OFFSET))
++	if (ip_hdr(oldskb)->frag_off & htons(IP_OFFSET))
 +		return;
 +
 +	oth = skb_header_pointer(oldskb, ip_hdrlen(oldskb),
@@ -518,78 +443,75 @@ Index: linux-2.6.23/net/netfilter/xt_DELUDE.c
 +
 +	/* This packet will not be the same as the other: clear nf fields */
 +	nf_reset(nskb);
-+	nskb->nfmark = 0;
++	nskb->mark = 0;
 +	skb_init_secmark(nskb);
 +
 +	skb_shinfo(nskb)->gso_size = 0;
 +	skb_shinfo(nskb)->gso_segs = 0;
 +	skb_shinfo(nskb)->gso_type = 0;
 +
-+	tcph = tcp_hdr(nskb);
++	tcph = (struct tcphdr *)(skb_network_header(nskb) + ip_hdrlen(nskb));
 +
 +	/* Swap source and dest */
-+	tmp_addr = ip_hdr(nskb)->saddr;
-+	ip_hdr(nskb)->saddr = ip_hdr(nskb)->daddr;
-+	ip_hdr(nskb)->daddr = tmp_addr;
-+	tmp_port = tcph->source;
++	niph         = ip_hdr(nskb);
++	tmp_addr     = niph->saddr;
++	niph->saddr  = niph->daddr;
++	niph->daddr  = tmp_addr;
++	tmp_port     = tcph->source;
 +	tcph->source = tcph->dest;
-+	tcph->dest = tmp_port;
++	tcph->dest   = tmp_port;
 +
 +	/* Truncate to length (no data) */
-+	tcph->doff = sizeof(struct tcphdr)/4;
++	tcph->doff    = sizeof(struct tcphdr) / 4;
 +	skb_trim(nskb, ip_hdrlen(nskb) + sizeof(struct tcphdr));
-+	ip_hdr(nskb)->tot_len = htons(nskb->len);
++	niph->tot_len = htons(nskb->len);
 +
-+	if(oth->syn && !oth->ack && !oth->rst && !oth->fin) {
++	if (oth->syn && !oth->ack && !oth->rst && !oth->fin) {
 +		/* DELUDE essential part */
 +		tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin +
 +		                oldskb->len - ip_hdrlen(oldskb) -
 +		                (oth->doff << 2));
-+		tcph->seq     = htonl(secure_tcp_sequence_number(
-+		                ip_hdr(nskb)->saddr, ip_hdr(nskb)->daddr,
-+			        tcph->source, tcph->dest));
-+		tcph->ack     = 1;
++		tcph->seq     = false;
++		tcph->ack     = true;
 +	} else {
-+		if(!tcph->ack) {
-+			needs_ack = 1;
-+			tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn + oth->fin
-+					      + oldskb->len - ip_hdrlen(oldskb)
-+					      - (oth->doff<<2));
-+			tcph->seq = 0;
++		if (!tcph->ack) {
++			needs_ack     = true;
++			tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn +
++			                oth->fin + oldskb->len -
++			                ip_hdrlen(oldskb) - (oth->doff<<2));
++			tcph->seq     = false;
 +		} else {
-+			needs_ack = 0;
-+			tcph->seq = oth->ack_seq;
-+			tcph->ack_seq = 0;
++			needs_ack     = false;
++			tcph->seq     = oth->ack_seq;
++			tcph->ack_seq = false;
 +		}
 +
 +		/* Reset flags */
 +		((u_int8_t *)tcph)[13] = 0;
-+		tcph->rst = 1;
++		tcph->rst = true;
 +		tcph->ack = needs_ack;
 +	}
 +
-+
-+	tcph->window = 0;
++	tcph->window  = 0;
 +	tcph->urg_ptr = 0;
 +
 +	/* Adjust TCP checksum */
 +	tcph->check = 0;
-+	tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr),
-+				   ip_hdr(nskb)->saddr,
-+				   ip_hdr(nskb)->daddr,
-+				   csum_partial((char *)tcph,
-+						sizeof(struct tcphdr), 0));
++	tcph->check = tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
++	              niph->daddr, csum_partial((char *)tcph,
++	              sizeof(struct tcphdr), 0));
 +
 +	/* Set DF, id = 0 */
-+	ip_hdr(nskb)->frag_off = htons(IP_DF);
-+	ip_hdr(nskb)->id = 0;
++	niph->frag_off = htons(IP_DF);
++	niph->id       = 0;
 +
 +	addr_type = RTN_UNSPEC;
-+	if (hook != NF_IP_FORWARD
 +#ifdef CONFIG_BRIDGE_NETFILTER
-+	    || (nskb->nf_bridge && nskb->nf_bridge->mask & BRNF_BRIDGED)
++	if (hook != NF_IP_FORWARD || (nskb->nf_bridge != NULL &&
++	    nskb->nf_bridge->mask & BRNF_BRIDGED))
++#else
++	if (hook != NF_IP_FORWARD)
 +#endif
-+	   )
 +		addr_type = RTN_LOCAL;
 +
 +	if (ip_route_me_harder(&nskb, addr_type))
@@ -598,12 +520,11 @@ Index: linux-2.6.23/net/netfilter/xt_DELUDE.c
 +	nskb->ip_summed = CHECKSUM_NONE;
 +
 +	/* Adjust IP TTL */
-+	ip_hdr(nskb)->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
++	niph->ttl = dst_metric(nskb->dst, RTAX_HOPLIMIT);
 +
 +	/* Adjust IP checksum */
-+	ip_hdr(nskb)->check = 0;
-+	ip_hdr(nskb)->check = ip_fast_csum((unsigned char *)ip_hdr(nskb),
-+					   ip_hdr(nskb)->ihl);
++	niph->check = 0;
++	niph->check = ip_fast_csum(skb_network_header(nskb), niph->ihl);
 +
 +	/* "Never happens" */
 +	if (nskb->len > dst_mtu(nskb->dst))
@@ -619,78 +540,57 @@ Index: linux-2.6.23/net/netfilter/xt_DELUDE.c
 +	kfree_skb(nskb);
 +}
 +
-+static unsigned int xt_delude_target(struct sk_buff **pskb,
++static unsigned int delude_tg(struct sk_buff **pskb,
 +    const struct net_device *in, const struct net_device *out,
-+    unsigned int hooknum, const struct xt_target *target, const void *targinfo
-+#ifdef HAVE_TARGUSERINFO
-+    ,
-+    void *userinfo
-+#endif
-+    )
++    unsigned int hooknum, const struct xt_target *target, const void *targinfo)
 +{
 +	/* WARNING: This code causes reentry within iptables.
 +	   This means that the iptables jump stack is now crap.  We
 +	   must return an absolute verdict. --RR */
-+	send_reset(*pskb, hooknum);
++	delude_send_reset(*pskb, hooknum);
 +	return NF_DROP;
 +}
 +
-+static bool xt_delude_check(const char *tablename, const void *e_void,
-+    const struct xt_target *target, void *targinfo,
-+#ifdef HAVE_TARGINFOSIZE
-+    unsigned int targinfosize,
-+#endif
-+    unsigned int hook_mask)
-+{
-+	if(hook_mask & ~((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD))) {
-+		printk(KERN_WARNING PFX "DELUDE may not be used in chains "
-+		       "other than INPUT and FORWARD\n");
-+		return false;
-+	}
-+	return true;
-+}
-+
-+static struct xt_target xt_delude_info = {
++static struct xt_target delude_tg_reg = {
 +	.name       = "DELUDE",
-+	.target     = xt_delude_target,
-+	.checkentry = xt_delude_check,
++	.family     = AF_INET,
 +	.table      = "filter",
-+	.hooks      = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) |
-+	              (1 << NF_IP_LOCAL_OUT),
++	.hooks      = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD),
++	.target     = delude_tg,
 +	.proto      = IPPROTO_TCP,
-+	.family     = AF_INET,
 +	.me         = THIS_MODULE,
 +};
 +
-+static int __init xt_delude_init(void)
++static int __init delude_tg_init(void)
 +{
-+	return xt_register_target(&xt_delude_info);
++	return xt_register_target(&delude_tg_reg);
 +}
 +
-+static void __exit xt_delude_exit(void)
++static void __exit delude_tg_exit(void)
 +{
-+	xt_unregister_target(&xt_delude_info);
++	xt_unregister_target(&delude_tg_reg);
 +}
 +
-+module_init(xt_delude_init);
-+module_exit(xt_delude_exit);
-+MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");
-+MODULE_DESCRIPTION("netfilter DELUDE target");
++module_init(delude_tg_init);
++module_exit(delude_tg_exit);
++MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
++MODULE_DESCRIPTION("netfilter \"DELUDE\" target");
 +MODULE_LICENSE("GPL");
 +MODULE_ALIAS("ipt_DELUDE");
-Index: linux-2.6.23/net/netfilter/xt_portscan.c
+Index: linux-2.6.23.16/net/netfilter/xt_portscan.c
 ===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ linux-2.6.23/net/netfilter/xt_portscan.c	2007-10-10 13:52:59.000000000 +0800
-@@ -0,0 +1,272 @@
+--- /dev/null
++++ linux-2.6.23.16/net/netfilter/xt_portscan.c
+@@ -0,0 +1,269 @@
 +/*
-+	portscan match for netfilter
-+
-+	Written by Jan Engelhardt, 2006 - 2007
-+	This program is free software; you can redistribute it and/or modify
-+	it under the terms of the GNU General Public License version 2 as
-+	published by the Free Software Foundation.
-+*/
++ *	portscan match for netfilter
++ *	Copyright © CC Computer Consultants GmbH, 2006 - 2007
++ *	Contact: Jan Engelhardt <jengelh@computergmbh.de>
++ *
++ *	This program is free software; you can redistribute it and/or modify
++ *	it under the terms of the GNU General Public License; either version
++ *	2 or 3 as published by the Free Software Foundation.
++ */
 +#include <linux/in.h>
 +#include <linux/ip.h>
 +#include <linux/module.h>
@@ -702,9 +602,15 @@ Index: linux-2.6.23/net/netfilter/xt_portscan.c
 +#include <linux/version.h>
 +#include <linux/netfilter/x_tables.h>
 +#include <linux/netfilter/xt_tcpudp.h>
-+#include <linux/netfilter/oot_conntrack.h>
-+#include <linux/netfilter/xt_portscan.h>
-+#include <linux/netfilter/oot_trans.h>
++#include <net/netfilter/nf_nat_rule.h>
++#if defined(_LOCAL)
++#	include "xt_portscan.h"
++#elif defined(CONFIG_NETFILTER_XT_MATCH_PORTSCAN) || \
++    defined(CONFIG_NETFILTER_XT_MATCH_PORTSCAN_MODULE)
++#	include <linux/netfilter/xt_portscan.h>
++#else
++#	include "xt_portscan.h"
++#endif
 +#define PFX KBUILD_MODNAME ": "
 +
 +enum {
@@ -751,55 +657,55 @@ Index: linux-2.6.23/net/netfilter/xt_portscan.c
 +MODULE_PARM_DESC(mark_valid,    "connmark value for Valid state");
 +
 +/* TCP flag functions */
-+static inline int tflg_ack4(const struct tcphdr *th)
++static inline bool tflg_ack4(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL4) == TCP_FLAG_ACK;
 +}
 +
-+static inline int tflg_ack6(const struct tcphdr *th)
++static inline bool tflg_ack6(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL6) == TCP_FLAG_ACK;
 +}
 +
-+static inline int tflg_fin(const struct tcphdr *th)
++static inline bool tflg_fin(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL3) == TCP_FLAG_FIN;
 +}
 +
-+static inline int tflg_rst(const struct tcphdr *th)
++static inline bool tflg_rst(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL3) == TCP_FLAG_RST;
 +}
 +
-+static inline int tflg_rstack(const struct tcphdr *th)
++static inline bool tflg_rstack(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL4) ==
 +	       (TCP_FLAG_ACK | TCP_FLAG_RST);
 +}
 +
-+static inline int tflg_syn(const struct tcphdr *th)
++static inline bool tflg_syn(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL4) == TCP_FLAG_SYN;
 +}
 +
-+static inline int tflg_synack(const struct tcphdr *th)
++static inline bool tflg_synack(const struct tcphdr *th)
 +{
 +	return (tcp_flag_word(th) & TCP_FLAGS_ALL4) ==
 +	       (TCP_FLAG_SYN | TCP_FLAG_ACK);
 +}
 +
 +/* portscan functions */
-+static inline int xt_portscan_stealth(const struct tcphdr *th)
++static inline bool portscan_mt_stealth(const struct tcphdr *th)
 +{
 +	/*
 +	 * "Connection refused" replies to our own probes must not be matched.
 +	 */
-+	if(tflg_rstack(th))
-+		return 0;
++	if (tflg_rstack(th))
++		return false;
 +
-+	if(tflg_rst(th) && printk_ratelimit()) {
++	if (tflg_rst(th) && printk_ratelimit()) {
 +		printk(KERN_WARNING PFX "Warning: Pure RST received\n");
-+		return 0;
++		return false;
 +	}
 +
 +	/*
@@ -811,42 +717,43 @@ Index: linux-2.6.23/net/netfilter/xt_portscan.c
 +	return !tflg_syn(th);
 +}
 +
-+static inline int xt_portscan_full(int mark, enum ip_conntrack_info ctstate,
-+    int loopback, const struct tcphdr *tcph, int payload_len)
++static inline unsigned int portscan_mt_full(int mark,
++    enum ip_conntrack_info ctstate, bool loopback, const struct tcphdr *tcph,
++    unsigned int payload_len)
 +{
-+	if(mark == mark_estab2) {
++	if (mark == mark_estab2) {
 +		/*
 +		 * -m connmark --mark $ESTAB2
 +		 */
-+		if(tflg_ack4(tcph) && payload_len == 0)
++		if (tflg_ack4(tcph) && payload_len == 0)
 +			return mark; /* keep mark */
-+		else if(tflg_rst(tcph) || tflg_fin(tcph))
++		else if (tflg_rst(tcph) || tflg_fin(tcph))
 +			return mark_grscan;
 +		else
 +			return mark_valid;
-+	} else if(mark == mark_estab1) {
++	} else if (mark == mark_estab1) {
 +		/*
 +		 * -m connmark --mark $ESTAB1
 +		 */
-+		if(tflg_rst(tcph) || tflg_fin(tcph))
++		if (tflg_rst(tcph) || tflg_fin(tcph))
 +			return mark_cnscan;
-+		else if(!loopback && tflg_ack4(tcph) && payload_len == 0)
++		else if (!loopback && tflg_ack4(tcph) && payload_len == 0)
 +			return mark_estab2;
 +		else
 +			return mark_valid;
-+	} else if(mark == mark_synrcv) {
++	} else if (mark == mark_synrcv) {
 +		/*
 +		 * -m connmark --mark $SYN
 +		 */
-+		if(loopback && tflg_synack(tcph))
++		if (loopback && tflg_synack(tcph))
 +			return mark; /* keep mark */
-+		else if(loopback && tflg_rstack(tcph))
++		else if (loopback && tflg_rstack(tcph))
 +			return mark_closed;
-+		else if(tflg_ack6(tcph))
++		else if (tflg_ack6(tcph))
 +			return mark_estab1;
 +		else
 +			return mark_synscan;
-+	} else if(ctstate == IP_CT_NEW && tflg_syn(tcph)) {
++	} else if (ctstate == IP_CT_NEW && tflg_syn(tcph)) {
 +		/*
 +		 * -p tcp --syn --ctstate NEW
 +		 */
@@ -855,25 +762,25 @@ Index: linux-2.6.23/net/netfilter/xt_portscan.c
 +	return mark;
 +}
 +
-+static bool xt_portscan_match(const struct sk_buff *skb,
++static bool portscan_mt(const struct sk_buff *skb,
 +    const struct net_device *in, const struct net_device *out,
 +    const struct xt_match *match, const void *matchinfo, int offset,
 +    unsigned int protoff, bool *hotdrop)
 +{
-+	const struct xt_portscan_info *info = matchinfo;
++	const struct xt_portscan_match_info *info = matchinfo;
 +	enum ip_conntrack_info ctstate;
-+	struct nf_conn *ctdata;
 +	const struct tcphdr *tcph;
++	struct nf_conn *ctdata;
 +	struct tcphdr tcph_buf;
 +
 +	tcph = skb_header_pointer(skb, protoff, sizeof(tcph_buf), &tcph_buf);
-+	if(tcph == NULL)
++	if (tcph == NULL)
 +		return false;
 +
 +	/* Check for invalid packets: -m conntrack --ctstate INVALID */
-+	if((ctdata = nf_ct_get(skb, &ctstate)) == NULL) {
-+		if(info->match_stealth)
-+			return xt_portscan_stealth(tcph);
++	if ((ctdata = nf_ct_get(skb, &ctstate)) == NULL) {
++		if (info->match_stealth)
++			return portscan_mt_stealth(tcph);
 +		/*
 +		 * If @ctdata is NULL, we cannot match the other scan
 +		 * types, return.
@@ -886,17 +793,17 @@ Index: linux-2.6.23/net/netfilter/xt_portscan.c
 +	 * simulate must not be run through again. And for speedup, do not call
 +	 * it either when the connection is already VALID.
 +	 */
-+	if((ctdata->mark & connmark_mask) == mark_valid ||
-+	  (skb->nfmark & packet_mask) != mark_seen)
-+	{
++	if ((ctdata->mark & connmark_mask) == mark_valid ||
++	     (skb->mark & packet_mask) != mark_seen) {
 +		unsigned int n;
-+		n = xt_portscan_full(ctdata->mark & connmark_mask, ctstate,
++
++		n = portscan_mt_full(ctdata->mark & connmark_mask, ctstate,
 +		    in == &loopback_dev, tcph,
 +		    skb->len - protoff - 4 * tcph->doff);
 +
 +		ctdata->mark = (ctdata->mark & ~connmark_mask) | n;
-+		((struct sk_buff *)skb)->nfmark =
-+			(skb->nfmark & ~packet_mask) | mark_seen;
++		((struct sk_buff *)skb)->mark =
++			(skb->mark & ~packet_mask) ^ mark_seen;
 +	}
 +
 +	return (info->match_syn && ctdata->mark == mark_synscan) ||
@@ -904,62 +811,51 @@ Index: linux-2.6.23/net/netfilter/xt_portscan.c
 +	       (info->match_gr && ctdata->mark == mark_grscan);
 +}
 +
-+static bool xt_portscan_checkentry(const char *tablename, const void *entry,
-+    const struct xt_match *match, void *matchinfo,
-+#ifdef HAVE_MATCHINFOSIZE
-+    unsigned int matchinfosize,
-+#endif
-+    unsigned int hook_mask)
++static bool portscan_mt_check(const char *tablename, const void *entry,
++    const struct xt_match *match, void *matchinfo, unsigned int hook_mask)
 +{
-+	const struct xt_portscan_info *info = matchinfo;
-+#ifdef HAVE_MATCHINFOSIZE
-+	if(matchinfosize != XT_ALIGN(sizeof(struct xt_portscan_info))) {
-+		printk(KERN_WARNING PFX "matchinfosize %u != %Zu\n",
-+		       matchinfosize,
-+		       XT_ALIGN(sizeof(struct xt_portscan_info)));
-+		return false;
-+	}
-+#endif
-+	if((info->match_stealth & ~1) || (info->match_syn & ~1) ||
-+	  (info->match_cn & ~1) || (info->match_gr & ~1)) {
++	const struct xt_portscan_match_info *info = matchinfo;
++
++	if ((info->match_stealth & ~1) || (info->match_syn & ~1) ||
++	    (info->match_cn & ~1) || (info->match_gr & ~1)) {
 +		printk(KERN_WARNING PFX "Invalid flags\n");
 +		return false;
 +	}
 +	return true;
 +}
 +
-+static struct xt_match xt_portscan = {
++static struct xt_match portscan_mt_reg __read_mostly = {
 +	.name       = "portscan",
-+	.match      = xt_portscan_match,
-+	.checkentry = xt_portscan_checkentry,
-+	.matchsize  = sizeof(struct xt_portscan_info),
-+	.proto      = IPPROTO_TCP,
 +	.family     = AF_INET,
++	.match      = portscan_mt,
++	.checkentry = portscan_mt_check,
++	.matchsize  = sizeof(struct xt_portscan_match_info),
++	.proto      = IPPROTO_TCP,
 +	.me         = THIS_MODULE,
 +};
 +
-+static int __init xt_portscan_init(void)
++static int __init portscan_mt_init(void)
 +{
-+	return xt_register_match(&xt_portscan);
++	return xt_register_match(&portscan_mt_reg);
 +}
 +
-+static void __exit xt_portscan_exit(void)
++static void __exit portscan_mt_exit(void)
 +{
-+	xt_unregister_match(&xt_portscan);
++	xt_unregister_match(&portscan_mt_reg);
 +	return;
 +}
 +
-+module_init(xt_portscan_init);
-+module_exit(xt_portscan_exit);
-+MODULE_AUTHOR("Jan Engelhardt <jengelh@gmx.de>");
-+MODULE_DESCRIPTION("netfilter portscan match module");
++module_init(portscan_mt_init);
++module_exit(portscan_mt_exit);
++MODULE_AUTHOR("Jan Engelhardt <jengelh@computergmbh.de>");
++MODULE_DESCRIPTION("netfilter \"portscan\" match");
 +MODULE_LICENSE("GPL");
 +MODULE_ALIAS("ipt_portscan");
-Index: linux-2.6.23/drivers/char/random.c
+Index: linux-2.6.23.16/drivers/char/random.c
 ===================================================================
---- linux-2.6.23.orig/drivers/char/random.c	2007-10-10 04:31:38.000000000 +0800
-+++ linux-2.6.23/drivers/char/random.c	2007-10-10 13:52:59.000000000 +0800
-@@ -1564,6 +1564,8 @@
+--- linux-2.6.23.16.orig/drivers/char/random.c
++++ linux-2.6.23.16/drivers/char/random.c
+@@ -1564,6 +1564,8 @@ __u32 secure_tcp_sequence_number(__be32 
  	return seq;
  }
  
diff --git a/target/linux/generic-2.6/patches-2.6.23/171-netfilter_tarpit.patch b/target/linux/generic-2.6/patches-2.6.23/171-netfilter_tarpit.patch
index 058dda5c28..073951a15c 100644
--- a/target/linux/generic-2.6/patches-2.6.23/171-netfilter_tarpit.patch
+++ b/target/linux/generic-2.6/patches-2.6.23/171-netfilter_tarpit.patch
@@ -1,7 +1,7 @@
-Index: linux-2.6.23/net/netfilter/Kconfig
+Index: linux-2.6.23.16/net/netfilter/Kconfig
 ===================================================================
---- linux-2.6.23.orig/net/netfilter/Kconfig
-+++ linux-2.6.23/net/netfilter/Kconfig
+--- linux-2.6.23.16.orig/net/netfilter/Kconfig
++++ linux-2.6.23.16/net/netfilter/Kconfig
 @@ -401,6 +401,23 @@ config NETFILTER_XT_TARGET_CONNSECMARK
  
  	  To compile it as a module, choose M here.  If unsure, say N.
@@ -26,22 +26,22 @@ Index: linux-2.6.23/net/netfilter/Kconfig
  config NETFILTER_XT_TARGET_TCPMSS
  	tristate '"TCPMSS" target support'
  	depends on NETFILTER_XTABLES && (IPV6 || IPV6=n)
-Index: linux-2.6.23/net/netfilter/Makefile
+Index: linux-2.6.23.16/net/netfilter/Makefile
 ===================================================================
---- linux-2.6.23.orig/net/netfilter/Makefile
-+++ linux-2.6.23/net/netfilter/Makefile
-@@ -49,6 +49,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) 
+--- linux-2.6.23.16.orig/net/netfilter/Makefile
++++ linux-2.6.23.16/net/netfilter/Makefile
+@@ -47,6 +47,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_NFLOG) 
  obj-$(CONFIG_NETFILTER_XT_TARGET_NOTRACK) += xt_NOTRACK.o
  obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) += xt_TRACE.o
  obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o
 +obj-$(CONFIG_NETFILTER_XT_TARGET_TARPIT) += xt_TARPIT.o
  obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o
  obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o
- 
-Index: linux-2.6.23/net/netfilter/xt_TARPIT.c
+ obj-$(CONFIG_NETFILTER_XT_TARGET_CHAOS) += xt_CHAOS.o
+Index: linux-2.6.23.16/net/netfilter/xt_TARPIT.c
 ===================================================================
 --- /dev/null
-+++ linux-2.6.23/net/netfilter/xt_TARPIT.c
++++ linux-2.6.23.16/net/netfilter/xt_TARPIT.c
 @@ -0,0 +1,280 @@
 +/*
 + * Kernel module to capture and hold incoming TCP connections using