Imported Debian patch 1.4.21-2

debian/README.Debian

+Documentation:
+==============
+
+The various netfilter and iptables HOWTOS can be found at:
+
+  http://www.netfilter.org/documentation/
+

debian/README.source

+This is a quilt style (using source format 3.0 (quilt)) package build with
+a quirky build directory hack. Look at /usr/share/doc/quilt/README.source
+for details on using quilt patch management with Debian packages.

debian/changelog

+iptables (1.4.21-2) unstable; urgency=medium
+
+  * correct _dhopts var to enable autoreconf. Closes: #744968
+  * use arch:linux-any. Closes: #745171
+  * bump standards version, 3.9.4 to 3.9.5
+  * drop extra iptables-apply, fix iptables.install
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 19 May 2014 20:49:01 -0400
+
+iptables (1.4.21-1) unstable; urgency=low
+
+  * New upstream release
+    + Corrected spurious load_extension errors. Closes: #699537
+    + Corrected man page icmp defaults. Closes: #644819
+    + Corrected state man page. Closes: #654983
+    + Corrected address in hashlimit man page. Closes: #698393
+    + Removed syslogd man page references. Closes: #567564
+    + Added string match man page hex examples. Closes: #699904
+    + Merged 0201-iptables-xml_man_section.patch
+    + Merged 0303-extension_cppflags.patch
+    + Merged 0401-state-match-display.patch 
+  * Updated iptables-apply to v1.1. Closes: #580941
+  * Use mktemp instead of tmpfile for iptables-apply. Closes: #668582
+  * Add iptables-apply info to man pages. Closes: #660748
+  * Updated debian/copyright 
+  * Updated debian/control Description
+  * Removed debian/builddir hack and other debian/rules cruft
+  * Removed debug info from README.Debian
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 01 Dec 2013 19:48:23 -0500
+
+iptables (1.4.20-2) unstable; urgency=low
+
+  * Fixed man page installation so that @PACKAGE_VERSION@ is expanded.
+    Reported by Christoph Biedl. Thanks.
+    Closes: #712403
+  * Fixed iptables-xml manpage mix-up
+  * Restored missing connlabel extension
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 17 Aug 2013 09:16:04 -0400
+
+iptables (1.4.20-1) unstable; urgency=low
+
+  * New upstream release
+  * added 0401-state-match-display.patch for the missing state match
+    display reported by Eugene Berdnikov and fixed by Phil Oester. Thanks.
+    Closes: #718810 
+  * upstream fix addresses concurrent invocation issues reported by
+    Lamont Jones. Fixed upstream by Phil Oester and Pablo Neira Ayuso.
+    Closes: #710997
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 08 Aug 2013 10:39:54 -0400
+
+iptables (1.4.19.1-1) unstable; urgency=low
+
+  * New upstream release
+  * Bumped Standard-Version to 3.9.4
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 20 Jul 2013 17:30:47 -0400
+
+iptables (1.4.18-1.1) unstable; urgency=low
+
+  [ gregor herrmann ]
+  * Fix "libipq.h includes non-existing linux/netfilter_ipv4/ip_queue.h":
+    ship /usr/include/linux/netfilter_ipv4/ip_queue.h in iptables-dev;
+    add Breaks on linux-libc-dev << 3.5
+    (Closes: #707535)
+
+  [ Dominic Hargreaves ]
+  * Non-maintainer upload
+
+ -- Dominic Hargreaves <dom@earth.li>  Sat, 13 Jul 2013 16:09:01 +0100
+
+iptables (1.4.18-1) unstable; urgency=low
+
+  * New upstream release
+  * New package for soname bump: libxtables10
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 24 Mar 2013 17:15:41 -0400
+
+iptables (1.4.16.3-4) unstable; urgency=low
+
+  * Added missing Breaks and Replaces for libxtables9. Thanks all.
+    Closes: #692171
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 02 Nov 2012 22:52:47 -0400
+
+iptables (1.4.16.3-3) unstable; urgency=low
+
+  * Added versioned libxtables dependency 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 28 Oct 2012 09:40:00 -0400
+
+iptables (1.4.16.3-2) unstable; urgency=low
+
+  * Moved libxtables into a separate package. Fixes problem with connman
+    reported by Jonathan Nieder. Thanks. Closes: #691546
+  * Added nfnl_osf and xtables-mutil man page stubs.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 27 Oct 2012 09:36:56 -0400
+
+iptables (1.4.16.3-1) unstable; urgency=low
+
+  * New upstream release
+  * Moved nfnl_osf to /usr/sbin. Fixes lib dependency problem reported
+    by Matteo Cortese. Thanks. Closes: #667688
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 19 Oct 2012 12:07:42 -0400
+
+iptables (1.4.14-3) unstable; urgency=low
+
+  * Fixes iptables comment output error reported by Christoph Anton
+    Mitterer. Fixed upstream by Pablo Neira Ayuso. Thanks. 
+    Closes: #679098
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 28 Jul 2012 11:58:38 -0400
+
+iptables (1.4.14-2) unstable; urgency=low
+
+  * Added missing 1.4.13-1.1 NMU fix 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 11 Jun 2012 17:39:35 -0400
+
+iptables (1.4.14-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Laurence J. Lane <ljlanedd@debian.org>  Mon, 11 Jun 2012 17:31:41 -0400
+
+iptables (1.4.13-1.1) unstable; urgency=low
+
+  * Non-maintainer upload.
+  * Add build-arch and build-indep targets to BUILD_DIR_TARGETS (closes:
+    #666335). Thanks to Lucas Nussbaum for the bug report.
+
+ -- Jakub Wilk <jwilk@debian.org>  Sun, 22 Apr 2012 15:50:33 +0200
+
+iptables (1.4.13-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 27 Mar 2012 09:35:10 -0400
+
+iptables (1.4.12.2-3) unstable; urgency=low
+
+  * Added CPPFLAGS for extensions to enable hardening. Report and 
+    patch by Simon Ruderich. Thanks. Closes: #665286 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 22 Mar 2012 18:54:37 -0400
+
+iptables (1.4.12.2-2) unstable; urgency=low
+
+  * Added iptables-xml.1. Resolves issues reported by Thilo Six and
+    Helge Kreutzmann. Thanks. Closes: #623112
+
+  * include/linux/types.h refresh adds __aligned_u64. Gleaned from a post
+    by Autif Khan. Fixes FTBFS reported by Moritz Muehlenhoff. Thanks.
+    Closes: #664066  
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 15 Mar 2012 14:03:31 -0400
+
+iptables (1.4.12.2-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 05 Jan 2012 16:30:12 -0500
+
+iptables (1.4.12.1-1) unstable; urgency=low
+
+  * New upstream release
+  * Depend on debhelper 9. Allows hardened build flags. Reported by
+    Moritz Muehlenhoff. Thanks. Closes: #653737
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 31 Dec 2011 14:04:51 -0500
+
+iptables (1.4.12-1) unstable; urgency=low
+
+  * New upstream release
+    + fixes state inversion bug reported by gpe92 Closes: #634769
+    + fixes ctorigdstport port number bug reported by Jim Barber.
+      Closes: #632804
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 28 Jul 2011 17:17:14 -0400
+
+iptables (1.4.11.1-3) unstable; urgency=low
+
+  * Fixes fragmention inversion reported by Mark Wooding and
+    fixed upstream by Jan Englehardt. Thanks. Closes: #632695
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 05 Jul 2011 09:59:28 -0400
+
+iptables (1.4.11.1-2) unstable; urgency=low
+
+  * Bugs reported by Markus Waldeck and fixed upstream by Jan Englehardt.
+    Thanks.
+    + missing target and match manpage extensions
+    + LOG target option parsing
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 21 Jun 2011 14:42:05 -0400
+
+iptables (1.4.11.1-1) unstable; urgency=low
+
+  * New upstream release
+  * Upstream fixes by Jan Engelhardt. Thanks.
+    + localtz option of time match reported by Damyan Ivanov.
+      Closes: #615121
+    + segmentation faults on empty source address reported by
+      Jussi Judin. Closes: #611990
+    + ipv6 TPROXY support requested by martin f krafft.
+      Closes: # 529954
+    + "can't set policy error" reported by Rob Leslie.
+      Closes: #598315
+    + formatting issues reported by jdanni. Closes: #429579
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 12 Jun 2011 12:33:47 -0400
+
+iptables (1.4.10-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 29 Oct 2010 12:29:39 -0400
+
+iptables (1.4.9-1) unstable; urgency=low
+
+  * New upstream release
+  * remove extra iptables-xml.8. Reported by David Prevot. Thanks.
+    Closes: #590619 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 07 Aug 2010 18:24:17 -0400
+
+iptables (1.4.8-3) unstable; urgency=low
+
+  * added missing iptables-xml symlink and man page. Reported by Carl
+    Fürstenberg and others. Closes: #589059
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 16 Jul 2010 16:56:20 -0400
+
+iptables (1.4.8-2) unstable; urgency=low
+
+  * rebuild with clean source tree, Closes: #582448
+  * updated upstream changelog to 1.4.8
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 12 Jun 2010 13:26:16 -0400
+
+iptables (1.4.8-1) unstable; urgency=low
+
+  * New upstream release
+  * Fixed iptables-apply DEFAULT_FILE variable. Problem reported by
+    fixed by StalkR. Thanks. Closes: #582448
+  * Added versioned build dependency on libtool. Problem reported by Pawel
+    Rozanski and Flavio Silveir. Thanks. Closes: #567066
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 31 May 2010 08:44:28 -0400
+
+iptables (1.4.6-2) unstable; urgency=low
+
+  * corrected debian changelog entry for 1.4.6-1
+  * updated upstream changelog. Problem reported by Klaus Ethgen. Thanks.
+    Closes: 561236
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 20 Dec 2009 16:09:02 -0500
+
+iptables (1.4.6-1) unstable; urgency=low
+
+  * New upstream release
+  * Fixes ignored mask with replace rule. Reported by Hugh McDonald and
+    and fixed upstream. Thanks. Closes: #560910
+  * Fixes single ip address use with iprange. Reported by  Sergey Kovalev
+    and fixed upstream. Thanks. Closes: #547139
+  * Fixes TCP MSS clamp documentation. Reported and fixed by Tim Small.
+    Added upstream. Thanks. Closes: #551272
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 14 Dec 2009 12:45:24 -0500
+
+iptables (1.4.5-1) unstable; urgency=low
+
+  * New upstream release
+  * Bumped Standards Version to 3.8.3 
+  * Moved to source format 3.0 (quilt)
+  * s/macthes/matches/ in iptables(8). Reported by Trent W. Buck and
+    fixed upstream. Closes: #539101 
+  * s/packages/package in iptables-dev descrition. Reported by Pascal
+    De Vuyst. Thanks. Closes: #557369
+  * Fixed iptables-apply default rule problem reported by StalkR. Fixed
+    upstream. Thanks. Closes: #547734 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 28 Nov 2009 16:41:04 -0500
+
+iptables (1.4.4-2) unstable; urgency=low
+
+  * renamed debian/patches to debian/patch to avoid 3.0-quilt-by-default
+    bug reports. Closes: #538608
+  * Bumped Standards Version to 3.8.2
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 28 Jul 2009 09:16:06 -0400
+
+iptables (1.4.4-1) unstable; urgency=low
+
+  * New upstream release
+  * Upstream added Ian Bruce's man page errors fix. Thanks. 
+    Closes: #531677
+  * Upstream added Piotr Lewandowski's iptables(8) typo fix. Thanks.
+    Closes: #528457
+  * Upstream fixed intraposition vs extraposition deprecation warning.
+    Thanks. Closes: #528736 
+  * Added ip6tables-apply symlinks for martin f krafft. Closes: #524862
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 18 Jun 2009 08:14:55 -0400
+
+iptables (1.4.3.2-2) unstable; urgency=low
+
+  * added iptables dependency to iptables-dev. Reported by Sebastian
+    Harl. Thanks. Closes:# 524766 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 19 Apr 2009 14:57:46 -0400
+
+iptables (1.4.3.2-1) unstable; urgency=low
+
+  * New upstream release
+  * Fixed negation extrapositoned stuff. Reported by Dr. Markus Waldeck.
+    Fixed upstream. Thanks. Closes: #522309
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 06 Apr 2009 14:30:59 -0400
+
+iptables (1.4.3.1-1) unstable; urgency=low
+
+  * New upstream release
+  * Fixed sparc64 ULOG problems reported by Andrey Chernomyrdin. Fixed
+    upstream. Thanks.  Closes: #232401
+  * Fixed sparc64 limit match problem reported by Arno van Amersfoort.
+    Fixed upstream. Thanks. Closes: #468170
+  * Fixed "Unknown arg %s" problem reported by Guillem Cantallops Ramis.
+    Fixed upstream. Thanks.  Closes: #469548
+  * Fixed iptables-save output problem reported by Ivan Vilata i Balaguer.
+    Fixed upstream. Closes: #514869 
+  * Fixed iptables-save quoting problem reported by
+    =?UTF-8?B?0YHRgtGA0L7QvdC90Lg=?= Closes: #519584.
+    Fixed upstream. Thanks. Closes: #519584
+  * Fixed ip6tables(1) icmp codes problem reported by Dameon Wagner.
+    Fixed upstream. Thanks. Closes: #515752
+  * Fixed string match non-null terminator reported by Franck Joncourt.
+    Fixed upstream. Thanks. Closes: #513516
+  * Added libiptc upstream. Requested by many. Closes: #473533
+  * Fixed tcmpss inversion. Patch by Jan Engelhardt. Thanks. 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 27 Mar 2009 17:02:43 -0400
+
+iptables (1.4.2-6) unstable; urgency=high
+
+  * added missing conntrack numeric fix. Reported by Bernhard Miklautz.
+    Fixed in upstream git repo. Thanks. Closes: #502548
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 09 Feb 2009 14:31:24 -0500
+
+iptables (1.4.2-5) unstable; urgency=low
+
+  * fixed libxt_multiport man page typo. Reported and patched by
+    Marc Fournier. Thanks. Closes: #511891 
+  * fixed iptables-restore.8 formatting. Reported and patched by
+    shaulkarl. Thanks. Closes: #512281
+  * fixed libxt_owner spacing. Reported by Dr. Markus Waldeck. Patched
+    upstream by Daniel Drake. Thanks. Closes: #512320
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 19 Jan 2009 13:32:05 -0500
+
+iptables (1.4.2-4) unstable; urgency=low
+
+  * fixed debian/rules binary targets. Reported by Philipp Kern.
+    Thanks. Closes: #511723
+  * fixed debian/rules build and install stamps.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 13 Jan 2009 19:07:08 -0500
+
+iptables (1.4.2-3) unstable; urgency=low
+
+  * added debian/builddir.mk support
+  * corrected 1.4.2-1 changelog entry: 's@moved iptables@&-xml@'.
+    Reported by jidanni. Thanks.
+  * lintian override left out of 1.4.2-2 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 09 Jan 2009 15:36:33 -0500
+
+iptables (1.4.2-2) unstable; urgency=low
+
+  * lintian cleanups:
+    - moved libxtables.so to iptables-dev package 
+    - added override for libxtables
+    - added ${misc:Depends} for debhelper 
+    - changelog utf8 conversion
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 03 Jan 2009 22:20:58 -0500
+
+iptables (1.4.2-1) unstable; urgency=low
+
+  * New upstream release. Reported by Torsten Werner. Thanks.
+    closes: #503229
+  * moved iptables-xml from /usr/sbin to /usr/bin. Reported by Alexey
+    Feldgendler. Thanks. closes: #509386  
+  * -multi bins were included in buildd generated packages. Reported
+    by Alexey Feldgendler. closes: 509385
+  * added missing iptables.xslt. Reported by Carl Fürstenberg. Thanks.
+    closes: #501615. 
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 02 Jan 2009 17:19:08 -0500
+
+iptables (1.4.1.1-4) unstable; urgency=low
+
+  * removed howtos. closes: #500674
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 30 Sep 2008 12:10:15 -0400
+
+iptables (1.4.1.1-3) unstable; urgency=low
+
+  * added missing libipq. Fixes numerous FTBS reported by Steve Langasek
+    and others. Thanks. closes: #494216
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 24 Aug 2008 19:52:26 -0400
+
+iptables (1.4.1.1-2) unstable; urgency=low
+
+  * fixed /bin/dash unnerving in howtos/Makefile. Reported by Daniel
+    Schepler. Thanks. closes: #493440
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 02 Aug 2008 19:14:13 -0400
+
+iptables (1.4.1.1-1) unstable; urgency=medium
+
+  * New upstream release
+  * removed kernel header dependency, fixed FTBS reported by Lucas
+    Nussbaum. Fixed upstream. Thanks. closes: #482502
+  * removed all pomng extensions: TARPIT, IPV4OPTSSTRIP and ipv4options
+  * changed standards version from 3.7.3 to 3.8.0
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 12 Jul 2008 05:28:33 -0400
+
+iptables (1.4.0-4) unstable; urgency=low
+
+  * fixed FTBFS reported by Lucas Nussbaum. Thanks. sid switched from
+    2.6.24 to 2.6.25 kernel header packages. closes: #479930
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed, 07 May 2008 22:15:18 -0400
+
+iptables (1.4.0-3) unstable; urgency=low
+
+  * removed erroneous libc6-dev dependency, fixes ia64 and aphla builds
+  * fixed more hyphenations in man pages
+  * added correct copyright notices, reported by Justin Pryzby. Thanks.
+    closes: #290185
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 18 Feb 2008 12:26:49 -0500
+
+iptables (1.4.0-2) unstable; urgency=low
+
+  * added missing ipq_set_verdict.3 information. Reported and fixed by
+    Luca Bedogni. Thanks. closes: #419650
+  * added -tblah segfault fix. Reported and fixed by Michael Spang.
+    Thanks. closes: #458042
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 08 Feb 2008 00:08:05 -0500
+
+iptables (1.4.0-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 07 Feb 2008 00:20:34 -0500
+
+iptables (1.3.8.0debian1-1) unstable; urgency=low
+
+  * New upstream release
+  * The 1.3.7 and 1.3.8 releases combined fix 35 upstream bugs! Reported
+    by Fei Xie and fixed upstream. Thanks. closes: #433990
+  * extensions removed upstream: TRACE, ROUTE, connlimit, rpc
+  * removed extraneous libselinux linking. Reported and fixed by
+    Martin Orr. Thanks. closes: #431180
+  * fixed numreous manpage speeling and grammer erors. Reparted and fixd
+    all up by A. Costa and aspell and gvim. Thx! closes: #410250 #410252
+  * removed patches for stuff fixed upstream: recent-man, hashlimit.man,
+    iptables-rename-fix, replace-pad_cdir, svn-2006-10-21
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 28 Jul 2007 19:22:20 -0400
+
+iptables (1.3.6.0debian1-5) unstable; urgency=high
+
+  * cleaned dirty iptables/, fixes diff bloat and compilation problems
+    Reported by Jan Wanger. Thanks.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed, 22 Nov 2006 22:42:21 -0500
+
+iptables (1.3.6.0debian1-4) unstable; urgency=high
+
+  * fixes errant /etc/{hosts,networks} entry padding. Reported by John
+    Darrah and fixed by Pablo Neira Ayuso. Thanks. closes: #398082
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 19 Nov 2006 21:51:18 -0500
+
+iptables (1.3.6.0debian1-3) unstable; urgency=high
+
+  * fixes broken rename-chain option in iptables and ip6tables. Reported
+    by Martin Clauss and Simon Natterer. Fixed by Krzysztof Oledzki.
+    Thanks. closes: #397012
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  9 Nov 2006 05:58:51 -0500
+
+iptables (1.3.6.0debian1-2) unstable; urgency=low
+
+  * physdev-truncated.man.patch: fixed misssed instance of the error
+  * debian/rules: fixed manpage mangling and moved it to scripts/manregex
+  * iptables.8: added missing ipt_recent match arguments
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 29 Oct 2006 14:03:13 -0500
+
+iptables (1.3.6.0debian1-1) unstable; urgency=low
+
+  * New upstream release
+  * synched with upstream SVN 2006-10-21
+    + fixed "wierd" spelling error in iptables.c
+    + fixed iptables segfault when given empty --log-prefix
+    + adds revision support to ip6tables
+    + adds support port range match to libip6t_multiport
+    + adds endian annotation types to fix compilation for
+      kernels > 2.6.18
+  * ipv6 updates in SVN by Rémi Denis-Courmont fixes the ip6tables port
+    range bug reported by Alexander Dreweke. Thanks. closes: #329775
+  * debian/control: added info about missing kernel extensions
+  * bumped standards version to 3.7.2, no changes
+  * updated to patch-o-matic-ng-20061021 source
+  * updated to kernel 2.6.18 source, closes: #393138
+    + renames icmpv6 extension to icmp6
+    + adds connbytes, quota and statistic extensions
+  * enabled SELinux support and added build dependency on libselinux1-dev
+    + adds SECMARK and CONNSECMARK extensions
+  * iptables/Rules.make: link shared SE libs with gcc
+  * added numerous manpage fixes
+  * debian/changelog: missing leading dash, lintian cleanup
+  * removed pomng iprange patch, migrated upstream to linux kernel
+  * removed weird_character.patch, fixed upstream
+  * removed weird_spelling.patch, fixed upsteam in 1.3.6 and SVN
+  * removed link_with_gcc.patch, fixed upstream
+  * removed esp-test6.patch, fixed upstream
+  * removed atomic_t_silly_hack.patch, code moved somewhere or another
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 27 Oct 2006 19:39:57 -0400
+
+iptables (1.3.5.0debian1-1) unstable; urgency=low
+
+  * New upstream release
+    + added ipv6 state match support
+    + updated IPsec (policy match) support
+    + added in-kernel string match support
+    + fixed ipv6 owner match
+    + read upstream changelog v1.3.4 and v1.3.5 entries for more
+  * updated to Linux kernel 2.6.17 source
+  * updated to patch-o-matic-ng-20060812 source
+  * combined upstream sources into an orig.tar.gz
+  * removed build time patching and prep.sh script
+  * removed Suggests: iproute
+  * removed bzip2 and html2text build dependencies
+  * removed ippool, deprecated
+  * removed example script directory, unmaintained examples
+  * removed README.Debian, too confusing
+  * removed debian/iptables.postinst
+  * pomng kernel extensions removed upstream: IPMARK, NETLINK, TCPLAG,
+    XOR, account, condition, dstlimit, fuzzy, geoip, ip6t_ULOG, ipp2p,
+    mport, nth, osf, pool, psd, quota, random, time
+  * replaced debian/copyright GPL paste with stubs
+  * updated debian/copyright source URLs
+  * Thanks for the invaluable help Rémi Denis-Courmont.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 20 Aug 2006 21:29:33 -0400
+
+iptables (1.3.3-2) unstable; urgency=low
+
+  * added pomng exclude hack to prep.sh
+  * excluded pomng's ip_queue_vwmark. Thanks ubuntu.
+  * updated README.Debian
+  * removed Suggests for ipmasq
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  6 Aug 2005 18:01:31 -0400
+
+iptables (1.3.3-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  4 Aug 2005 22:08:27 -0400
+
+iptables (1.3.2-1) unstable; urgency=low
+
+  * New upstream release
+  * removed libipt_physdev.c and libip6t_physdev.c from weird_*.patch
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 24 Jul 2005 21:03:39 -0400
+
+iptables (1.3.1-2) unstable; urgency=low
+
+  * added missing 2.6.12 kernel headers
+  * added libip6t_physdev.c to weird_spelling.patch
+  * added libip6t_physdev.c to weird_character.patch
+  * updated README.Debian, removed dead firewall package names
+    and added a disclaimer about such packages, closes: #307934
+  * removed iptables-dev's build dependency on iptables, closes: #288193
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 19 Jun 2005 19:15:36 -0400
+
+iptables (1.3.1-1) unstable; urgency=low
+
+  * New upstream release, closes: #299638
+  * build with 2.6.12 kernel source and patch-o-matic-ng-20050618
+  * hashlimit module added upstream, closes: #312374
+  * removed example ppp scripts, closes: #287346
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 18 Jun 2005 20:45:11 -0400
+
+iptables (1.2.11-10) unstable; urgency=medium
+
+  * fixed scripts/prep.sh: patching and patch ordering
+  * fixed a bashism reported by Geller Sandor in Bug#283822. Thanks.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed,  1 Dec 2004 19:11:34 -0500
+
+iptables (1.2.11-9) unstable; urgency=medium
+
+  * another prep.sh tweak for patch ordering
+  * Bug#283721, Policy match save code puts in line feed that makes
+    iptables-restore error, reported and fixed by Matthew Grant. Thanks.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 30 Nov 2004 23:04:01 -0500
+
+iptables (1.2.11-8) unstable; urgency=medium
+
+  * fixed broken atomic_t_silly_hack.patch
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun,  7 Nov 2004 16:12:22 -0500
+
+iptables (1.2.11-7) unstable; urgency=medium
+
+  * oops, corrected prep.sh for arch specific patches again
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  6 Nov 2004 22:46:20 -0500
+
+iptables (1.2.11-6) unstable; urgency=medium
+
+  * corrected prep.sh so arch specific patches are applied
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  6 Nov 2004 12:22:25 -0500
+
+iptables (1.2.11-5) unstable; urgency=low
+
+  * 1.2.11-3 never really existed, changelog entry removed
+  * restored missing all/###-man_pages.patch
+  * Closes:#279285, Compile fails - declaration after code, reported and
+    fixed by  Kevin Shanahan. Thanks. all/###-libpt_time_struct.patch
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed,  3 Nov 2004 22:40:26 -0500
+
+iptables (1.2.11-4) unstable; urgency=medium
+
+  * Closes: #219686, CAN-2004-0986, modprobe load error, reported by
+    Faheem Mitha, fixed by upstream. Thanks. (modprobe.patch)
+  * added missing upstream changelogs
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 31 Oct 2004 18:56:52 -0500
+
+iptables (1.2.11-2) unstable; urgency=low
+
+  * Closes: #263154, upstream fix, corrects segfault on hostnames that
+    resolve to multiple IPs. Reported by guillot. Thanks.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue,  3 Aug 2004 22:09:55 -0400
+
+iptables (1.2.11-1) unstable; urgency=low
+
+  * new upstream release
+    * Closes: #256975, new upstream release
+    * Closes: #229892, include man page additions for new extensions
+    * Closes: #248605: iptables CONNMARK update
+    * Closes: #218837: corrects limit module for sparc64
+    * obviates minor_buffer_overflows.patch and 64_32.patch
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  9 Jul 2004 01:04:58 -0400
+
+iptables (1.2.9-10) unstable; urgency=low
+
+  * Closes: #246037, added default logging level to man pages, requested
+    by Max Vozeler. Thanks.
+  * conslidated all man page patches to 003-man_pages.patch.
+  * added 006-64_32.patch, CVS pull, Sparc64 and HPPA makefile clean up
+    for 64/32-bit builds. Reported by Igor Genibel. Thanks.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 15 Jun 2004 20:38:42 -0400
+
+iptables (1.2.9-9) unstable; urgency=low
+
+  * Closes: #248605, s390 FTBS, reported by Andreas Henriksson. Thanks.
+    Removed extraneous patch from the s390 directory.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 15 May 2004 08:07:12 -0400
+
+iptables (1.2.9-8) unstable; urgency=low
+
+  * Closes: #247056, hppa (and s390) FTBFS, reported by Lamont Jones.
+    Thanks. Resynced local patches.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun,  2 May 2004 22:26:03 -0400
+
+iptables (1.2.9-7) unstable; urgency=low
+
+  * Closes: #246554, debian/rules missing KERNEL_DIR for install target,
+    reported by Paul Hampson. Thanks.
+  * removed the debian/install kludge for the brain flub noted above
+  * removed owner module support for version 2.4.19 and lower kernels
+  * removed dead code from examples/oldinitscript and corrected logical
+    errors, some discovered by by Adam Heath. Thanks.
+  * updated kernel source to 2.4.26
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  1 May 2004 07:25:19 -0400
+
+iptables (1.2.9-6) unstable; urgency=low
+
+  * updated iptable's description in debian/control
+  * renamed local patches and updated descriptions in README
+  * added 002-weird_character.patch to accept dashes in interface names.
+    This problem has been reported numerous times over the years.
+  * updated 001-spell_weird.patch to include libipt_physdev.c
+  * altered prep.sh to check build/stamp/prep
+  * fixed this changelog, which was doubled at some point
+  * updated doc-base files
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 13 Mar 2004 13:33:33 -0500
+
+iptables (1.2.9-5) unstable; urgency=low
+
+  * added 005-atomic_t_silly_hack.patch for hppa and s390. Explicitly
+    declare atomic_t typedef in ip_conntrack_icmp.h.  FTBFS reported by
+    Lamont Jones. Thanks. (see: #232418)
+  * updated to kernel 2.4.25 headers
+  * removed failed ip6tables owner module detection
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 29 Feb 2004 09:24:44 -0500
+
+iptables (1.2.9-4) unstable; urgency=low
+
+  * added Suggests: iproute
+  * updated package descriptions
+  * removed iptables 1.2.9rc1 changelog
+  * updated patch-o-matic to 20031219
+  * updated kernel headers to 2.4.24
+  * added patches/004-minor_buffer_overflows.patch
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 10 Feb 2004 20:08:55 -0500
+
+iptables (1.2.9-3) unstable; urgency=low
+
+  * removed include/libulog/. Reported by rv@eychenne.org. Thanks.
+    (closes: #226740)
+  * updated toplevel README
+  * added linux kernel copyright info to debian/copyright
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  9 Jan 2004 18:21:29 -0500
+
+iptables (1.2.9-2) unstable; urgency=low
+
+  * updated README.Debian
+  * added ip6tables owner module detection
+  * removed debian/iptables.prerm
+  * added linux kenel source 2.4.23
+  * removed linux kernel sources: 2.4.20 2.4.20 2.6.0-test9
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 30 Dec 2003 14:55:40 -0500
+
+iptables (1.2.9-1) unstable; urgency=low
+
+  * new upstream release, 1.2.9 final
+  * removed local physdev patch, corrected upstream
+  * dropped p-o-m connbytes
+  * updated ppp example scripts from Kiryanov Vasiliy. Thanks.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun,  2 Nov 2003 20:53:31 -0500
+
+iptables (1.2.9-0rc1+1) unstable; urgency=low
+
+  * this is a test upload
+  * new upstream release
+  * removed local ROUTE patch, corrected upstream
+  * added local physdev patch, see Bug#207954
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 27 Oct 2003 16:17:11 -0500
+
+iptables (1.2.8-8) unstable; urgency=low
+
+  * corrected distro
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 19 Oct 2003 14:32:49 -0400
+
+iptables (1.2.8-7) unstable; urgency=low
+
+  * corrected control file for priority and kernel versions, again
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 19 Oct 2003 09:03:36 -0400
+
+iptables (1.2.8-6) unstable; urgency=low
+
+  * updated z_owner, thanks to Eddie and Godwin
+  * changed Priority to important, Bug#206685
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 18 Oct 2003 16:18:39 -0400
+
+iptables (1.2.8-5) unstable; urgency=low
+
+  * updated z_owner patch to handle 2.6.0-X kernels
+  * updated package description, sync'd kerenel versions
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 17 Oct 2003 13:17:37 -0400
+
+iptables (1.2.8-4) unstable; urgency=low
+
+  * added bzip2 build dependecy
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 22 Jun 2003 23:41:05 -0400
+
+iptables (1.2.8-3) unstable; urgency=low
+
+  * added bzip2 build dependency
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 22 Jun 2003 22:36:30 -0400
+
+iptables (1.2.8-2) unstable; urgency=low
+
+  * added ROUTE target corrections from Cedric de Launois
+  * added reduced kernel source archives, netfilter only
+  * removed extraneous "the" from iptables.8
+  * removed kernel source build dependencies
+  * changed all description kernel versions to 2.4.xx
+  * rewrote prep.sh
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 22 Jun 2003 18:56:36 -0400
+
+iptables (1.2.8-1) unstable; urgency=low
+
+  * New upstream release
+  * update to patch-o-matic-20030107
+  * added Kiryanov Vasiliy's ppp example scripts
+  * removed 000-iptables-1.2.7a-tcpmss.patch, corrected upstream
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 30 May 2003 06:10:01 -0400
+
+iptables (1.2.7-12) unstable; urgency=low
+
+  * moved iptables-dev to section devel
+  * removed owner module information from README.Debian
+  * restored local lintian overrides
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 23 Mar 2003 04:22:56 -0500
+
+iptables (1.2.7-11) unstable; urgency=low
+
+  * added Goswin Brederlow's owner module detection patch
+  * removed owner module alternatives
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 22 Mar 2003 12:58:03 -0500
+
+iptables (1.2.7-10) unstable; urgency=low
+
+  * use kernel-source-2.4.20 instead of kernel-headers-2.4.20
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed,  5 Feb 2003 04:07:14 -0500
+
+iptables (1.2.7-9) unstable; urgency=low
+
+  * added a temporary ugly hack for Bug #171167, alternate owner
+    plug-in for 2.4.20+ kernels. See README.Debian for details.
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 26 Jan 2003 15:17:23 -0500
+
+iptables (1.2.7-8) unstable; urgency=low
+
+  * corrected -dev include dirs
+  * removed init.d, /var/lib/iptables, and debconf-ization
+  * added Suggests: ipmasq
+  * rewrote README.Debian
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  7 Dec 2002 14:31:40 -0500
+
+iptables (1.2.7-7) unstable; urgency=low
+
+  * Provide HOWTOs in English. Oops.
+  * cosmetic bug in initd_{auto,}save, s/iptables/\$iptables_command/
+  * prime the pump in the init.d with "ip{6}tables -nL"
+  * remove leading space in debconf template
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 22 Sep 2002 21:28:28 -0400
+
+iptables (1.2.7-6) unstable; urgency=low
+
+  * init.d script $libdir correction, Bug#160646
+  * created libip{6,}tables.a for iptables-dev, Bug#160490
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 12 Sep 2002 13:54:40 -0400
+
+iptables (1.2.7-5) unstable; urgency=low
+
+  * blah, correct Maintainer and Standards Version
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun,  8 Sep 2002 00:44:10 -0400
+
+iptables (1.2.7-4) unstable; urgency=low
+
+  * let's try uploading the correct packages
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  7 Sep 2002 23:50:58 -0400
+
+iptables (1.2.7-3) unstable; urgency=low
+
+  * changed topdir Makefile, default to cat README
+  * corrected debian/*.install and dh_install* calls
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  7 Sep 2002 22:56:39 -0400
+
+iptables (1.2.7-2) unstable; urgency=low
+
+  * init.d, remove errant debugging enable_ipv6=true
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  6 Sep 2002 23:53:25 -0400
+
+iptables (1.2.7-1) unstable; urgency=low
+
+  * added wacky source+patch build system
+  * updated to debhelper 4
+  * init.d, dropped iptables_command variable, added enable_ipv6 variable
+  * added --mss port/range fix
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  6 Sep 2002 06:33:07 -0400
+
+iptables (1.2.6a-6) unstable; urgency=low
+
+  * debian/iptables.init:
+    * initd_save: s/Savinging/Saving/, #148284
+    * init_load and initd_save: abort missing <ruleset> gracefully
+    * added initd_abort
+    * s/$@/$*/g parameter change
+    * corrected sed call problem, #149241
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  6 Jun 2002 23:57:59 -0400
+
+iptables (1.2.6a-5) unstable; urgency=high
+
+  * removed ownercmd patch, closes: 142649
+  * removed postinst init.d call, closes: 142791
+  * corrected source URIs in copyright
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 14 Apr 2002 10:44:57 -0400
+
+iptables (1.2.6a-4) unstable; urgency=high
+
+  * removed MARK_operations patch, severe breakage
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon,  8 Apr 2002 22:41:32 -0400
+
+iptables (1.2.6a-3) unstable; urgency=high
+
+  * posinst: merged in missing bits from 1.2.5-x and remove bogus "/1"
+  * undo MARK and REJECT changes, severe breakage
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed,  3 Apr 2002 14:38:12 -0500
+
+iptables (1.2.6a-2) unstable; urgency=low
+
+  * corrected typo and bug in initd_autosave()
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon,  1 Apr 2002 06:38:01 -0500
+
+iptables (1.2.6a-1) unstable; urgency=medium
+
+  * New upstream release, closes: 140202
+  * upstream man page update, closes: 137933
+  * upstream SEGV fix, closes: 134518
+  * new init.d setup, changes:
+    * {en,dis}able via debconf rc.d symlink management, closes: 139282
+    * deprecated "save_active" and "save_inactive"
+    * accept "load <ruleset>" instead of "[ruleset name]"
+    * added uniform policy compliant output, closes: 140400
+    * removed init.d clear from dev scripts, closes: 139102
+    * deprecated enable_iptables_initd and iptables_prerm_default
+  * replaced README.Debian
+  * chmod /etc/default/iptables 0644, closes: 1.2.73
+  * build depend on kernel 2.4.18 source
+  * adjusted update-rc.d runlevels, closes: 140428
+  * updated pom patch handling, more extension modules, closes: 117536
+  * removed debian/ip6tables*.8
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 31 Mar 2002 22:54:25 -0500
+
+iptables (1.2.5-7) unstable; urgency=low
+
+  * iptables.c: upstream patch for proto_num segfault
+  * init.d, shut down rc.d change from K10 to K90, closes: #135599
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  1 Mar 2002 15:59:23 -0500
+
+iptables (1.2.5-6) unstable; urgency=low
+
+  * removed extraneous -e in echo call, closes: #133838
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 14 Feb 2002 13:28:06 -0500
+
+iptables (1.2.5-5) unstable; urgency=low
+
+  * diginix inspired most-of-pom build
+  * debian/control: Build-Depends + kernel-source-2.4.17
+  * debian/control: corrected section override disparity warning
+  * init.d adjustments, increased verbosity, warn for no active/inactive
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed, 13 Feb 2002 12:49:12 -0500
+
+iptables (1.2.5-4) unstable; urgency=low
+
+  * /etc/default/iptables was still confusing people
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  7 Feb 2002 13:04:41 -0500
+
+iptables (1.2.5-3) unstable; urgency=low
+
+  * use explicit init.d variable defaults, closes: #132464
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue,  5 Feb 2002 11:23:58 -0500
+
+iptables (1.2.5-2) unstable; urgency=low
+
+  * used a silver bullet on /var/state/iptables/, closes: #130710
+  * default to 'nothing' instead of halt before start/stop in init.d
+    because halt effectively disables all IP traffic.
+  * allow saved ruleset filenames as init.d arguments, load the ruleset
+  * Added text to disavow any sense of security afforded by merely
+    installing the iptables package. iptables a tool that can be used
+    to configure firewalls, among other things. The package is most
+    defintely not a one-stop-system-security-solution. closes: #130729
+  * updated README and descriptions (control)
+  * added netfilter-extensions and netfilter-hacking HOWTOs
+  * resurrected ip6tables-{sav,restor}e.8 from an older package
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat,  2 Feb 2002 23:44:14 -0500
+
+iptables (1.2.5-1) unstable; urgency=low
+
+  * new upstream release
+  * moved /var/state/iptables to /var/lib/iptables, closes: #130337
+  * moved state dir definitions from default/iptables to init.d/iptables
+  * corrected autosave behavior
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed, 23 Jan 2002 13:36:58 -0500
+
+iptables (1.2.4-4) unstable; urgency=low
+
+  * official upload with new init.d setup
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun, 20 Jan 2002 19:24:43 -0500
+
+iptables (1.2.4-3.2) unstable; urgency=low
+
+  * added optional ip6tables support init.d
+  * changed prerm script init.d call default from "nothing" to "clear"
+  * adjust file permissions on "default" file and state dir in postinst
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 17 Jan 2002 20:58:00 -0500
+
+iptables (1.2.4-3.1) unstable; urgency=low
+
+  * README.Debian update
+  * debian/rules: remove dh_testroot from clean target
+  * s/wierd/weird/ in ip{,6}tables.c, see Bug #102771
+  * indicate -C option not available in manpage/help, see Bug #108199
+  * added init.d script
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 15 Jan 2002 19:10:12 -0500
+
+iptables (1.2.4-3) unstable; urgency=low
+
+  * gcc linking patch by LaMont Jones
+  * Debian README update
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 13 Dec 2001 07:47:48 -0500
+
+iptables (1.2.4-2) unstable; urgency=low
+
+  * corrected upstream changelog compilation
+  * debian/control: corrected Sections
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  9 Nov 2001 00:46:03 -0500
+
+iptables (1.2.4-1) unstable; urgency=low
+
+  * new upstream version
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  1 Nov 2001 11:19:05 -0500
+
+iptables (1.2.3-2) unstable; urgency=low
+
+  * Everett Coleman II's <gcc80x86@colemanTECH.tzo.com>
+    string_to_number() correction for libipt_TOS.c
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 22 Sep 2001 14:10:45 -0400
+
+iptables (1.2.3-1) unstable; urgency=low
+
+  * new upstream version
+  * debian/changelog: removed emacs mode settings
+  * added /usr/share/doc/iptables/changelog.gz
+  * Olivier Baudron's <Olivier.Baudron@ens.fr> string_to_number() /
+    --log-level corrections for iptables.c, libip6t_LOG.c, and
+    libip6t_length.c
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue,  4 Sep 2001 10:41:29 -0400
+
+iptables (1.2.2-10) unstable; urgency=low
+
+  * ip6tables.c: correct IP6T_LIB_DIR path
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 13 Aug 2001 07:01:15 -0400
+
+iptables (1.2.2-9) unstable; urgency=low
+
+  * debian/rules: extraneous MAKE caused build failures on some archs
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 11 Aug 2001 16:47:07 -0400
+
+iptables (1.2.2-8) unstable; urgency=low
+
+  * debian/rules: move EXTRA_VARS to correct KERNEL_DIR build failures
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 10 Aug 2001 10:23:03 -0400
+
+iptables (1.2.2-7) unstable; urgency=low
+
+  * Makefile: set LIBDIR and BINDIR
+  * ip6tables.c: set IP6T_LIB_DIR
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed,  8 Aug 2001 04:47:56 -0400
+
+iptables (1.2.2-6) unstable; urgency=low
+
+  * replace HTML guides with sgml2html (linuxdoc-tools) processed SGML,
+    closes: #107872
+  * debian/changelog: updated source location, author names, et cetera
+  * debian/rules: s/EXTRAVARS/EXTRA_VARS/g
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon,  6 Aug 2001 22:58:22 -0400
+
+iptables (1.2.2-5) unstable; urgency=low
+
+  * debian/rules:
+    * set $(EXTRAVARS) on command line before $(MAKE) (corrects
+      all variable settings, including LIBDIR, closes: #107839)
+    * use find/xarg in clean target to remove *.{a,o,so}
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon,  6 Aug 2001 19:22:42 -0400
+
+iptables (1.2.2-4) unstable; urgency=low
+
+  * debian/control: updated package descriptions and upgrade standards
+    version to 3.5.6.0
+  * restore original Makefile, all target and evironment variable hacks
+    moved to debian/rules
+  * reverted to libc6-dev kernel headers (unresolved issues here)
+  * 1.2.2-3 changelog updates:
+    * REJECT.c: CVS code corrects reject-with output (#99728, #105271)
+    * iptables.8: CVS code corrects man page formatting (#97079)
+    * debian/control: Build-Depend on kernel-headers-2.4.7
+    * debian/rules: remove object files with the clean target and use
+      kernel-headers-2.4.7 for KERNEL headers
+    * enabled libipq build
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri,  3 Aug 2001 20:41:13 -0400
+
+iptables (1.2.2-3) unstable; urgency=low
+
+  * debian/rules: converted from debmake to debhelper
+  * applied fixes from CVS tree, closes: #99728, #97079, #105271
+  * added iptables-dev package, closes: #106689, #101493
+  * README.Debian: update
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue, 31 Jul 2001 22:45:45 -0400
+
+iptables (1.2.2-2) unstable; urgency=low
+
+  * removed debian/rules bash expansions, Closes: #98794
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 26 May 2001 12:26:55 -0400
+
+iptables (1.2.2-1) unstable; urgency=low
+
+  * new upstream version
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 11 May 2001 14:02:25 -0400
+
+iptables (1.2.1a-2) unstable; urgency=low
+
+  * restore ip6tables, patch provided by Marc Martinez
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed, 25 Apr 2001 00:05:26 -0400
+
+iptables (1.2.1a-1) unstable; urgency=low
+
+  * new upstream release and enabled save/restore, Closes: #94211
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 19 Apr 2001 21:02:20 -0400
+
+iptables (1.2.1-1) unstable; urgency=low
+
+  * new upstream release, Closes: #85318
+  * removed symlinks to bins
+  * applied debian/patch-ULOG (minor build issue)
+
+ -- Laurence J. Lane <ljlane@debian.org>  Fri, 16 Mar 2001 16:37:27 -0500
+
+iptables (1.2-10) unstable; urgency=low
+
+  * bins and libs moved from /usr to /, provided symlinks, Closes: #89529
+  * added lintian overrides for shared-lib-without-dependency-information
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed, 14 Mar 2001 04:24:47 -0500
+
+iptables (1.2-9) unstable; urgency=low
+
+  * change to libc6's kernel 2.4 headers so sparc can build
+
+ -- Laurence J. Lane <ljlane@debian.org>  Wed,  7 Mar 2001 13:04:14 -0500
+
+iptables (1.2.7) unstable; urgency=low
+
+  * --rename-chain correction by sfrost@debian.org, closes: #84275
+  * debian/rules custom KERNEL_DIR example, closes: #86617
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon, 19 Feb 2001 10:11:16 -0500
+
+iptables (1.2-7) unstable; urgency=low
+
+  * Build-Depend on kernel-headers-2.4.0-test11, closes: #85871
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 17 Feb 2001 07:44:46 -0500
+
+iptables (1.2-6) unstable; urgency=low
+
+  * Corrected modprobe call, closes: #85299
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  8 Feb 2001 22:33:09 -0500
+
+iptables (1.2-5) unstable; urgency=low
+
+  * Added Build-Depends, closes #84764
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sun,  4 Feb 2001 11:46:44 -0500
+
+iptables (1.2-4) unstable; urgency=low
+
+  * Recompiled without patch-o-matic headers (closes: #81902)
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu, 11 Jan 2001 07:03:38 -0500
+
+iptables (1.2-3) unstable; urgency=low
+
+  * Corrected ip6tables lib path (closes: #81403)
+  * Added temporary ip6tables.8.gz
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue,  9 Jan 2001 19:59:40 -0500
+
+iptables (1.2-2) unstable; urgency=low
+
+  * Removed iptables-{save,restore}.8
+  * Corrected orig.tar.gz source upload
+
+ -- Laurence J. Lane <ljlane@debian.org>  Tue,  9 Jan 2001 08:28:55 -0500
+
+iptables (1.2-1) unstable; urgency=low
+
+  * New maintainer
+  * Enabled ip6tables build
+
+ -- Laurence J. Lane <ljlane@debian.org>  Mon,  8 Jan 2001 19:51:02 -0500
+
+iptables (1.1.2-1.0) unstable; urgency=low
+
+  * Non-maintainer upload
+  * New upstream release
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 14 Oct 2000 13:15:34 -0400
+
+iptables (1.1.1-1.1) unstable; urgency=low
+
+  * Non-maintainer upload
+  * Bypass kernel patch checks in Makefile, see Bug#67397
+
+ -- Laurence J. Lane <ljlane@debian.org>  Thu,  5 Oct 2000 17:34:53 -0400
+
+iptables (1.1.1-1.0) unstable; urgency=low
+
+  * Non-maintainer upload
+  * New upstream release
+  * Added Packet Filtering and NAT HOWTOs
+
+ -- Laurence J. Lane <ljlane@debian.org>  Sat, 15 Jul 2000 22:44:17 -0400
+
+iptables (1.1.0-1) unstable; urgency=low
+
+  * New upstream release
+
+ -- Christoph Lameter <christoph@lameter.com>  Sun, 14 May 2000 12:09:55 -0700
+
+iptables (1.0.0-3) unstable; urgency=low
+
+  * Remove Makefile.orig (closes: #63434)
+
+ -- Christoph Lameter <christoph@lameter.com>  Wed,  3 May 2000 11:23:33 -0700
+
+iptables (1.0.0-2) unstable; urgency=low
+
+  * make distclean rather than make clean in debian/rules to wipe out
+    platform specific dependendies before shipping source. (closes: #62967)
+
+ -- Christoph Lameter <christoph@lameter.com>  Mon, 24 Apr 2000 12:12:39 -0700
+
+iptables (1.0.0-1) unstable; urgency=low
+
+  * Added some more docs.
+  * Rewrote copyright file
+  * Upstream final 1.0.0 release.
+
+ -- Christoph Lameter <christoph@lameter.com>  Sun, 26 Mar 2000 19:19:19 -0800
+
+iptables (1.0.0alpha-1) unstable; urgency=low
+
+  * Initial release.
+
+ -- Christoph Lameter <christoph@lameter.com>  Sun, 26 Mar 2000 18:49:18 -0800

debian/compat

+9

debian/control

+Source: iptables
+Section: net
+Priority: important
+Maintainer: Laurence J. Lane <ljlane@debian.org>
+Build-Depends: debhelper (>= 9), autoconf, automake, libtool (>=2.2.6), libnfnetlink-dev, libnetfilter-conntrack-dev, libnetfilter-conntrack3, dh-autoreconf
+Standards-Version: 3.9.5
+Homepage: http://www.netfilter.org/
+
+Package: iptables
+Architecture: linux-any
+Depends: ${misc:Depends}, ${shlibs:Depends}, libxtables10 (=${binary:Version})
+Description: administration tools for packet filtering and NAT
+ iptables is the userspace command line program used to configure
+ the Linux packet filtering ruleset. It is targeted towards system
+ administrators. Since Network Address Translation is also configured
+ from the packet filter ruleset, iptables is used for this, too. The
+ iptables package also includes ip6tables. ip6tables is used for
+ configuring the IPv6 packet filter
+
+Package: libxtables10
+Architecture: linux-any
+Depends: ${misc:Depends}, ${shlibs:Depends}
+Replaces: iptables (<< 1.4.16.3-3)
+Breaks: iptables (<< 1.4.16.3-3)
+Description: netfilter xtables library
+ The user-space interface to the Netfilter xtables kernel framework.
+
+Package: iptables-dev
+Architecture: linux-any
+Priority: optional
+Depends: ${misc:Depends}, iptables (=${binary:Version})
+Conflicts: iptables (<<1.4.2-2)
+Breaks: linux-libc-dev (<< 3.5)
+Section: devel
+Description: iptables development files
+ iptables is used to setup, maintain, and inspect the tables of
+ packet filter rules in the Linux kernel. This package contains
+ the available library (libipq, libiptc, libxtables), header,
+ documentation and related files for iptables development.

debian/copyright

+Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
+Upstream-Name: iptables
+Upstream-Contact: Netfilter Developer List <netfilter@vger.kernel.org>
+Source: http://ftp.netfilter.org/
+
+Files: iptables/*.c
+Copyright: 2000-2002, the netfilter coreteam <coreteam@netfilter.org>
+                      Paul 'Rusty' Russell <rusty@rustcorp.com.au>
+                      Marc Boucher <marc+nf@mbsi.ca>
+                      James Morris <jmorris@intercode.com.au>
+                      Harald Welte <laforge@gnumonks.org>
+                      Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+License: GPL-2
+
+Files: extensions/libip6t_DNAT.c
+Copyright: 2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_DNPT.c
+Copyright: 2012-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_MASQUERADE.c
+Copyright: 2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_NETMAP.c
+Copyright: 2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_REDIRECT.c
+Copyright: 2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_REJECT.c
+Copyright: 2000, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+License: GPL-2
+
+Files: extensions/libip6t_SNAT.c
+Copyright: 2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_SNPT.c
+Copyright: 2012-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libip6t_mh.c
+Copyright: 2006, USAGI/WIDE Project
+License: GPL-2
+
+Files: extensions/libipt_CLUSTERIP.c
+Copyright: 2003, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libipt_ECN.c
+Copyright: 2002, by Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libipt_REJECT.c
+Copyright: 2000, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+License: GPL-2
+
+Files: extensions/libipt_TTL.c
+Copyright: 2000, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libipt_ULOG.c
+Copyright: 2000, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libipt_ttl.c
+Copyright: 2000, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libxt_AUDIT.c
+Copyright: 2010-2011, Thomas Graf <tgraf@redhat.com>
+           2010-2011, Red Hat, Inc.
+License: GPL-2
+
+Files: extensions/libxt_CHECKSUM.c
+Copyright: 2002, Harald Welte <laforge@gnumonks.org>
+           2010, Red Hat, Inc
+License: GPL-2
+
+Files: extensions/libxt_CLASSIFY.c
+Copyright: 2003-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_CONNMARK.c
+Copyright: 2002, 2004, MARA Systems AB <http://www.marasystems.com> by Henrik Nordstrom <hno@marasystems.com>
+License: GPL-2
+
+Files: extensions/libxt_CONNSECMARK.c
+Copyright: 2006, Red Hat, Inc., James Morris <jmorris@redhat.com>
+License: GPL-2
+
+Files: extensions/libxt_CT.c
+Copyright: 2010-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_DSCP.c
+Copyright: 2000-2002, Matthew G. Marsh <mgm@paktronix.com>
+                      Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libxt_HMARK.c
+Copyright: 2012, Hans Schillstrom <hans.schillstrom@ericsson.com>
+           2012, Pablo Neira Ayuso <pablo@netfilter.org>
+License: GPL-2
+
+Files: extensions/libxt_IDLETIMER.c
+Copyright: 2010, Nokia Corporation
+License: GPL-2
+
+Files: extensions/libxt_LED.c
+Copyright: 2008, Adam Nielsen <a.nielsen@shikadi.net>
+License: GPL-2
+
+Files: extensions/libxt_NFQUEUE.c
+Copyright: 2005, by Harald Welte <laforge@netfilter.org>
+License: GPL-2
+
+Files: extensions/libxt_RATEEST.c
+Copyright: 2008-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_SECMARK.c
+Copyright: 2006, Red Hat, Inc., James Morris <jmorris@redhat.com>
+License: GPL-2
+
+Files: extensions/libxt_SET.c
+Copyright: 2000-2002, Joakim Axelsson <gozem@linux.nu>
+                      Patrick Schaaf <bof@bof.de>
+                      Martin Josefsson <gandalf@wlug.westbo.se>
+           2003-2010, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+License: GPL-2
+
+Files: extensions/libxt_SYNPROXY.c
+Copyright: 2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_TCPMSS.c
+Copyright: 2000, Marc Boucher
+License: GPL-2
+
+Files: extensions/libxt_TCPOPTSTRIP.c
+Copyright: 2007, Sven Schnelle <svens@bitebene.org>
+           2007, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: extensions/libxt_TEE.c
+Copyright: 2007, Sebastian Claßen <sebastian.classen [at] freenet.ag>
+           2007-2010, Jan Engelhardt <jengelh [at] medozas de>
+License: GPL-2
+
+Files: extensions/libxt_TOS.c
+Copyright: 2007, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: extensions/libxt_TPROXY.c
+Copyright: 2002-2008, BalaBit IT Ltd.
+License: GPL-2
+
+Files: extensions/libxt_addrtype.c
+Copyright: 2003-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_bpf.c
+Copyright: 2013, Google, Inc.
+License: GPL-2
+
+Files: extensions/libxt_cluster.c
+Copyright: 2009, Pablo Neira Ayuso <pablo@netfilter.org>
+License: GPL-2
+
+Files: extensions/libxt_connmark.c
+Copyright: 2002, 2004, MARA Systems AB <http://www.marasystems.com> by Henrik Nordstrom <hno@marasystems.com>
+License: GPL-2
+
+Files: extensions/libxt_conntrack.c
+Copyright: 2001, Marc Boucher (marc@mbsi.ca).
+           2007-2008, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: extensions/libxt_dccp.c
+Copyright: 2005, by Harald Welte <laforge@netfilter.org>
+License: GPL-2
+
+Files: extensions/libxt_devgroup.c
+Copyright: 2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_dscp.c
+Copyright: 2002, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libxt_ecn.c
+Copyright: 2002, Harald Welte <laforge@netfilter.org>
+           2011, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_hashlimit.c
+Copyright: 2003-2004, Harald Welte <laforge@netfilter.org>
+License: GPL-2
+
+Files: extensions/libxt_osf.c
+Copyright: 2003+, Evgeniy Polyakov <zbr@ioremap.net>
+License: GPL-2
+
+Files: extensions/libxt_owner.c
+Copyright: 2007-2008, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: extensions/libxt_policy.c
+Copyright: 2005-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_rateest.c
+Copyright: 2008-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_sctp.c
+Copyright: 2003, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: extensions/libxt_set.c
+Copyright: 2000-2002, Joakim Axelsson <gozem@linux.nu>
+                      Patrick Schaaf <bof@bof.de>
+                      Martin Josefsson <gandalf@wlug.westbo.se>
+           2003-2010, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+License: GPL-2
+
+Files: extensions/libxt_socket.c
+Copyright: 2007, BalaBit IT Ltd.
+License: GPL-2
+
+Files: extensions/libxt_statistic.c
+Copyright: 2006-2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: extensions/libxt_string.c
+Copyright: 2000, Emmanuel Roger <winfield@freegates.be>
+           2005-08-05, Pablo Neira Ayuso <pablo@eurodev.net>
+License: GPL-2
+
+Files: extensions/libxt_time.c
+Copyright: 2007, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: extensions/libxt_tos.c
+Copyright: 2007, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: extensions/libxt_u32.c
+Copyright: 2002, Don Cohen <don-netf@isis.cs3-inc.com>
+           2007, CC Computer Consultants GmbH
+License: GPL-2
+
+Files: include/linux/netfilter/ipset/ip_set.h
+Copyright: 2000-2002, Joakim Axelsson <gozem@linux.nu>
+                      Patrick Schaaf <bof@bof.de>
+                      Martin Josefsson <gandalf@wlug.westbo.se>
+           2003-2011, Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+License: GPL-2
+
+Files: include/linux/netfilter/xt_AUDIT.h
+Copyright: 2010-2011, Thomas Graf <tgraf@redhat.com>
+           2010-2011, Red Hat, Inc.
+License: GPL-2
+
+Files: include/linux/netfilter/xt_CHECKSUM.h
+Copyright: 2002, Harald Welte <laforge@gnumonks.org>
+           2010, Red Hat Inc
+License: GPL-2
+
+Files: include/linux/netfilter/xt_DSCP.h
+Copyright: 2002, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: include/linux/netfilter/xt_IDLETIMER.h
+Copyright: 2004, 2010,  Nokia Corporation
+License: GPL-2
+
+Files: include/linux/netfilter/xt_NFQUEUE.h
+Copyright: 2005, Harald Welte <laforge@netfilter.org>
+License: GPL-2
+
+Files: include/linux/netfilter/xt_connmark.h
+Copyright: 2002, 2004, MARA Systems AB <http://www.marasystems.com> by Henrik Nordstrom <hno@marasystems.com>
+License: GPL-2
+
+Files: include/linux/netfilter/xt_conntrack.h
+Copyright: 2001, Marc Boucher (marc@mbsi.ca)
+License: GPL-2
+
+Files: include/linux/netfilter/xt_dscp.h
+Copyright: 2002, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: include/linux/netfilter/xt_ecn.h
+Copyright: 2002, Harald Welte <laforge@netfilter.org>
+License: GPL-2
+
+Files: include/linux/netfilter/xt_osf.h
+Copyright: 2003+, Evgeniy Polyakov <johnpol@2ka.mxt.ru>
+License: GPL-2
+
+Files: include/linux/netfilter_ipv4.h
+Copyright: 1998, Rusty Russell
+License: GPL-2
+
+Files: include/linux/netfilter_ipv4/ip_queue.h
+Copyright: 2000, James Morris
+License: GPL-2
+
+Files: include/linux/netfilter_ipv4/ipt_ECN.h
+Copyright: 2002, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: include/linux/netfilter_ipv4/ipt_TTL.h
+Copyright: 2000, Harald Welte <laforge@netfilter.org>
+License: GPL-2
+
+Files: include/linux/netfilter_ipv4/ipt_ULOG.h
+Copyright: 2000-2002, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: include/linux/netfilter_ipv4/ipt_ttl.h
+Copyright: 2000, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: include/linux/netfilter_ipv6.h
+Copyright: 1998, Rusty Russell
+           1999, David Jeffery
+License: GPL-2
+
+Files: iptables/iptables-apply
+Copyright: 2006, Martin F. Krafft <madduck@madduck.net>
+           2010, GW <gw.2010@tnode.com or http://gw.tnode.com/>
+License: Artistic-2
+
+Files: iptables/iptables-save.c
+Copyright: 1999, Paul 'Rusty' Russell <rusty@rustcorp.com.au>
+           2000-2002, Harald Welte <laforge@gnumonks.org>
+License: GPL-2
+
+Files: iptables/iptables-xml.c
+Copyright: 2006, Ufo Mechanic <azez@ufomechanic.net>
+License: GPL-2
+
+Files: libiptc/libip4tc.c
+Copyright: 1999, Paul ``Rusty'' Russell
+License: GPL-2
+
+Files: libiptc/libip6tc.c
+Copyright: 1999, Paul ``Rusty'' Russell
+License: GPL-2
+
+Files: libiptc/libiptc.c
+Copyright: 1999, Paul ``Rusty'' Russell
+           2000-2004, by the Netfilter Core Team <coreteam@netfilter.org>
+           2003, 2004, Harald Welte <laforge@netfilter.org>
+           2008, Jesper Dangaard Brouer <hawk@comx.dk>
+License: GPL-2
+
+Files: libxtables/xtables.c
+Copyright: 2000-2006, by the netfilter coreteam <coreteam@netfilter.org>
+License: GPL-2
+
+Files: libxtables/xtoptions.c
+Copyright: 2011, Jan Engelhardt
+License: GPL-2
+
+Files: utils/nfsynproxy.c
+Copyright: 2013, Patrick McHardy <kaber@trash.net>
+License: GPL-2
+
+Files: utils/pf.os
+Copyright: 2000-2003, Michal Zalewski <lcamtuf@coredump.cx>
+           2003, Mike Frantzen <frantzen@w4g.org>
+License:
+ Permission to use, copy, modify, and distribute this software for any
+ purpose with or without fee is hereby granted, provided that the above
+ copyright notice and this permission notice appear in all copies.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+
+License: GPL-2
+ This program is free software; you can redistribute it
+ and/or modify it under the terms of the GNU General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later
+ version.
+ .
+ This program is distributed in the hope that it will be
+ useful, but WITHOUT ANY WARRANTY; without even the implied
+ warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+ PURPOSE.  See the GNU General Public License for more
+ details.
+ .
+ You should have received a copy of the GNU General Public
+ License along with this package; if not, write to the Free
+ Software Foundation, Inc., 51 Franklin St, Fifth Floor,
+ Boston, MA  02110-1301 USA
+ .
+ On Debian systems, the full text of the GNU General Public
+ License version 2 can be found in the file
+ `/usr/share/common-licenses/GPL-2'.
+
+License: Artistic-2
+ 			 The "Artistic License"
+ .
+ 				Preamble
+ .
+ The intent of this document is to state the conditions under which a
+ Package may be copied, such that the Copyright Holder maintains some
+ semblance of artistic control over the development of the package,
+ while giving the users of the package the right to use and distribute
+ the Package in a more-or-less customary fashion, plus the right to make
+ reasonable modifications.
+ .
+ Definitions:
+ .
+ 	"Package" refers to the collection of files distributed by the
+ 	Copyright Holder, and derivatives of that collection of files
+ 	created through textual modification.
+ .
+ 	"Standard Version" refers to such a Package if it has not been
+ 	modified, or has been modified in accordance with the wishes
+ 	of the Copyright Holder as specified below.
+ .
+ 	"Copyright Holder" is whoever is named in the copyright or
+ 	copyrights for the package.
+ .
+ 	"You" is you, if you're thinking about copying or distributing
+ 	this Package.
+ .
+ 	"Reasonable copying fee" is whatever you can justify on the
+ 	basis of media cost, duplication charges, time of people involved,
+ 	and so on.  (You will not be required to justify it to the
+ 	Copyright Holder, but only to the computing community at large
+ 	as a market that must bear the fee.)
+ .
+ 	"Freely Available" means that no fee is charged for the item
+ 	itself, though there may be fees involved in handling the item.
+ 	It also means that recipients of the item may redistribute it
+ 	under the same conditions they received it.
+ .
+ 1. You may make and give away verbatim copies of the source form of the
+ Standard Version of this Package without restriction, provided that you
+ duplicate all of the original copyright notices and associated disclaimers.
+ .
+ 2. You may apply bug fixes, portability fixes and other modifications
+ derived from the Public Domain or from the Copyright Holder.  A Package
+ modified in such a way shall still be considered the Standard Version.
+ .
+ 3. You may otherwise modify your copy of this Package in any way, provided
+ that you insert a prominent notice in each changed file stating how and
+ when you changed that file, and provided that you do at least ONE of the
+ following:
+ .
+     a) place your modifications in the Public Domain or otherwise make them
+     Freely Available, such as by posting said modifications to Usenet or
+     an equivalent medium, or placing the modifications on a major archive
+     site such as uunet.uu.net, or by allowing the Copyright Holder to include
+     your modifications in the Standard Version of the Package.
+ .
+     b) use the modified Package only within your corporation or organization.
+ .
+     c) rename any non-standard executables so the names do not conflict
+     with standard executables, which must also be provided, and provide
+     a separate manual page for each non-standard executable that clearly
+     documents how it differs from the Standard Version.
+ .
+     d) make other distribution arrangements with the Copyright Holder.
+ .
+ 4. You may distribute the programs of this Package in object code or
+ executable form, provided that you do at least ONE of the following:
+ .
+     a) distribute a Standard Version of the executables and library files,
+     together with instructions (in the manual page or equivalent) on where
+     to get the Standard Version.
+ .
+     b) accompany the distribution with the machine-readable source of
+     the Package with your modifications.
+ .
+     c) give non-standard executables non-standard names, and clearly
+     document the differences in manual pages (or equivalent), together
+     with instructions on where to get the Standard Version.
+ .
+     d) make other distribution arrangements with the Copyright Holder.
+ .
+ 5. You may charge a reasonable copying fee for any distribution of this
+ Package.  You may charge any fee you choose for support of this
+ Package.  You may not charge a fee for this Package itself.  However,
+ you may distribute this Package in aggregate with other (possibly
+ commercial) programs as part of a larger (possibly commercial) software
+ distribution provided that you do not advertise this Package as a
+ product of your own.  You may embed this Package's interpreter within
+ an executable of yours (by linking); this shall be construed as a mere
+ form of aggregation, provided that the complete Standard Version of the
+ interpreter is so embedded.
+ .
+ 6. The scripts and library files supplied as input to or produced as
+ output from the programs of this Package do not automatically fall
+ under the copyright of this Package, but belong to whoever generated
+ them, and may be sold commercially, and may be aggregated with this
+ Package.  If such scripts or library files are aggregated with this
+ Package via the so-called "undump" or "unexec" methods of producing a
+ binary executable image, then distribution of such an image shall
+ neither be construed as a distribution of this Package nor shall it
+ fall under the restrictions of Paragraphs 3 and 4, provided that you do
+ not represent such an executable image as a Standard Version of this
+ Package.
+ .
+ 7. C subroutines (or comparably compiled subroutines in other
+ languages) supplied by you and linked into this Package in order to
+ emulate subroutines and variables of the language defined by this
+ Package shall not be considered part of this Package, but are the
+ equivalent of input as in Paragraph 6, provided these subroutines do
+ not change the language in any way that would cause it to fail the
+ regression tests for the language.
+ .
+ 8. Aggregation of this Package with a commercial distribution is always
+ permitted provided that the use of this Package is embedded; that is,
+ when no overt attempt is made to make this Package's interfaces visible
+ to the end user of the commercial distribution.  Such use shall not be
+ construed as a distribution of this Package.
+ .
+ 9. The name of the Copyright Holder may not be used to endorse or promote
+ products derived from this software without specific prior written permission.
+ .
+ 10. THIS PACKAGE IS PROVIDED "AS IS" AND WITHOUT ANY EXPRESS OR
+ IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ .
+ 				The End

debian/iptables-dev.install

+usr/include
+usr/share/man/man3
+lib/lib*.so
+lib/pkgconfig usr/lib
+include/linux/netfilter_ipv4/ip_queue.h usr/include/linux/netfilter_ipv4/
+

debian/iptables.docs

+INCOMPATIBILITIES

debian/iptables.install

+lib/libip*.so.*
+usr/sbin/xtables-multi sbin
+usr/sbin/ip6tables sbin
+usr/sbin/ip6tables-restore sbin
+usr/sbin/ip6tables-save sbin
+usr/sbin/iptables sbin
+usr/sbin/iptables-restore sbin
+usr/sbin/iptables-save sbin
+usr/sbin/nf* usr/sbin
+lib/xtables
+iptables/iptables-apply usr/sbin
+iptables/iptables.xslt usr/share/iptables
+usr/share/man/man8
+usr/share/man/man1

debian/iptables.links

+/usr/sbin/iptables-apply /usr/sbin/ip6tables-apply
+/usr/share/man/man8/iptables-apply.8.gz /usr/share/man/man8/ip6tables-apply.8.gz
+/sbin/xtables-multi /usr/bin/iptables-xml

debian/iptables.lintian-overrides

+iptables binary: package-name-doesnt-match-sonames libip4tc0 libip6tc0 libipq0 libiptc0

debian/iptables.manpages

+iptables/*.8
+debian/*.8

debian/libxtables10.install

+lib/libxtables*.so.*

debian/nfnl_osf.8

+.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
+.\"
+.\" Standard preamble:
+.\" ========================================================================
+.de Sp \" Vertical space (when we can't use .PP)
+.if t .sp .5v
+.if n .sp
+..
+.de Vb \" Begin verbatim text
+.ft CW
+.nf
+.ne \\$1
+..
+.de Ve \" End verbatim text
+.ft R
+.fi
+..
+.\" Set up some character translations and predefined strings.  \*(-- will
+.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
+.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
+.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
+.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
+.\" nothing in troff, for use with C<>.
+.tr \(*W-
+.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
+.ie n \{\
+.    ds -- \(*W-
+.    ds PI pi
+.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
+.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
+.    ds L" ""
+.    ds R" ""
+.    ds C` ""
+.    ds C' ""
+'br\}
+.el\{\
+.    ds -- \|\(em\|
+.    ds PI \(*p
+.    ds L" ``
+.    ds R" ''
+'br\}
+.\"
+.\" Escape single quotes in literal strings from groff's Unicode transform.
+.ie \n(.g .ds Aq \(aq
+.el       .ds Aq '
+.\"
+.\" If the F register is turned on, we'll generate index entries on stderr for
+.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
+.\" entries marked with X<> in POD.  Of course, you'll have to process the
+.\" output yourself in some meaningful fashion.
+.ie \nF \{\
+.    de IX
+.    tm Index:\\$1\t\\n%\t"\\$2"
+..
+.    nr % 0
+.    rr F
+.\}
+.el \{\
+.    de IX
+..
+.\}
+.\" ========================================================================
+.\"
+.IX Title "NFNL_OSF 8"
+.TH NFNL_OSF 8 "2012-10-27" "nfnl_osf" "nfnl_osf"
+.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
+.\" way too many mistakes in technical documents.
+.if n .ad l
+.nh
+.SH "NAME"
+nfnl_osf \- load and unload os fingerprint database
+.SH "SYNOPSIS"
+.IX Header "SYNOPSIS"
+load and unload osf fingerprint database for the netfilter osf extension
+.SH "DESCRIPTION"
+.IX Header "DESCRIPTION"
+nffl_osf has no official man page.  Look at the osf module in \fB\f(BIiptables\-extensions\fB\|(8)\fR for more information.
+.SH "SEE ALSO"
+.IX Header "SEE ALSO"
+\&\fIiptables\-extensions\fR\|(8)

debian/patches/0101-changelog.patch

+Author: ljlane
+Description: iptables source doesn't include a changelog.
+ This is a compilation of the external changelog files taken
+ from ftp.netfilter.org.
+
+--- /dev/null
++++ b/Changelog
+@@ -0,0 +1,3505 @@
++iptables v1.4.21 Changelog:
++======================================================================
++Changes from 1.4.20:
++
++Eric Dumazet (1):
++      xt_socket: add --nowildcard flag
++
++Florian Westphal (3):
++      extensions: libxt_socket: update man page
++      doc: add libnetfilter_queue pointer to libxt_NFQUEUE.man
++      doc: merge ip6table man pages into ipv4 ones
++
++Jozsef Kadlecsik (1):
++      extensions: libxt_set, libxt_SET: check the set family too
++
++Kevin Cernekee (1):
++      ip6tables: Use consistent exit code for EAGAIN
++
++Laurence J. Lane (8):
++      iptables: libxt_hashlimit.man: correct address
++      iptables: libxt_conntrack.man extraneous commas
++      iptables: libip(6)t_REJECT.man default icmp types
++      iptables: iptables-xm1.1 correct man section
++      iptables: libxt_recent.{c,man} dead URL
++      iptables: libxt_string.man add examples
++      extensions: libxt_LOG: use generic syslog reference in manpage
++      iptables: extensions/GNUMakefile.in use CPPFLAGS
++
++Lutz Jaenicke (1):
++      iptables: correctly reference generated file
++
++Pablo Neira Ayuso (7):
++      Merge branch 'stable-1.4.20'
++      Merge branch 'stable-1.4.20'
++      ip[6]tables: fix incorrect alignment in commands_v_options
++      build: add software version to manpage first line at configure stage
++      extensions: libxt_cluster: add note on arptables-jf
++      utils: nfsynproxy: fix error while compiling the BPF filter
++      iptables 1.4.21 release
++
++Patrick McHardy (2):
++      extensions: add SYNPROXY extension
++      utils: add nfsynproxy tool
++
++Phil Oester (4):
++      iptables: state match incompatibilty across versions
++      libxtables: xtables_ipmask_to_numeric incorrect with non-CIDR masks
++      iptables: improve chain name validation
++      iptables: spurious error in load_extension
++
++stephen hemminger (1):
++      xtables: trivial spelling fix
++
++
++iptables v1.4.20 Changelog:
++======================================================================
++Changes from 1.4.19.1:
++
++
++Alexey Perevalov (1):
++      doc: clarify DEBUG usage macro
++
++Andy Spencer (1):
++      iptables: use autoconf to process .in man pages
++
++Eric Leblond (1):
++      configure: display summary
++
++Florian Westphal (2):
++      extensions: libipt_ULOG: man page should mention NFLOG as replacement
++      extensions: libxt_connlabel: use libnetfilter_conntrack
++
++Jozsef Kadlecsik (2):
++      Introduce a new revision for the set match with the counters support
++      libxt_CT: Add the "NOTRACK" alias
++
++Mart Frauenlob (7):
++      libip6t_mh: Correct command to list named mh types in manpage
++      extensions: libxt_DNAT: rename IPv4 manpage and tell about IPv6 support
++      extensions: libxt_REDIRECT: rename IPv4 manpage and tell about IPv6 support
++      extensions: libxt_NETMAP: rename IPv4 manpage and tell about IPv6 support
++      extensions: libxt_SNAT: rename IPv4 manpage and tell about IPv6 support
++      extensions: libxt_MASQUERADE: rename IPv4 manpage and tell about IPv6 support
++      extensions: libxt_LOG: rename IPv4 manpage and tell about IPv6 support
++
++Pablo Neira Ayuso (7):
++      extensions: libxt_LED: fix parsing of delay
++      Merge branch 'stable'
++      Merge branch 'stable'
++      ip{6}tables-restore: fix breakage due to new locking approach
++      libxt_recent: restore minimum value for --seconds
++      iptables-xml: fix parameter parsing (similar to 2165f38)
++      iptables 1.4.20 release
++
++Patrick McHardy (1):
++      extensions: add copyright statements
++
++Phil Oester (7):
++      xtables: improve get_modprobe handling
++      ip[6]tables: Add locking to prevent concurrent instances
++      iptables: Fix connlabel.conf install location
++      ip6tables: don't print out /128
++      libip6t_LOG: target output is different to libipt_LOG
++      build: additional include path required after UAPI changes
++      iptables: iptables-xml: Fix various parsing bugs
++
++Russell Senior (1):
++      libxt_recent: restore reap functionality to recent module
++
++Willem de Bruijn (1):
++      build: fail in configure on missing dependency with --enable-bpf-compiler
++
++holger@eitzenberger.org (1):
++      extensions: libxt_NFQUEUE: add --queue-cpu-fanout parameter
++
++
++
++iptables v1.4.19.1 Changelog:
++======================================================================
++Changes from 1.4.19:
++
++
++Florian Westphal (1):
++      Revert "extensions: add connlabel match" duplicate
++
++Michael Roth (1):
++      doc: mention SNAT in INPUT chain since kernel 2.6.36
++
++Pablo Neira Ayuso (2):
++      build: bump version to 1.4.19
++      iptables 1.4.19.1 release
++
++
++
++iptables v1.4.19 Changelog:
++======================================================================
++Changes from 1.4.18:
++
++
++Florian Westphal (3):
++      libxt_NFQUEUE: fix bypass option documentation
++      extensions: add connlabel match
++      extensions: add connlabel match
++
++Mart Frauenlob (3):
++      ip[6]tables: show --protocol instead of --proto in usage
++      libxt_recent: Fix missing space in manpage for --mask option
++      extensions: libxt_multiport: Update manpage to list valid protocols
++
++Nicolas Dichtel (1):
++      utils: nfnl_osf: use the right nfnetlink lib
++
++Pablo Neira Ayuso (11):
++      libip6t_NETMAP: Use xtables_ip6mask_to_cidr and get rid of libip6tc dependency
++      Revert "build: resolve link failure for ip6t_NETMAP"
++      libxt_osf: fix missing --ttl and --log in save output
++      libxt_osf: fix bad location for location in --genre
++      libip6t_SNPT: add manpage
++      libip6t_DNPT: add manpage
++      Merge branch 'stable'
++      utils: updates .gitignore to include nfbpf_compile
++      extensions: libxt_bpf: clarify --bytecode argument
++      libxtables: fix parsing of dotted network mask format
++      build: bump version to 1.4.19
++
++Patrick McHardy (1):
++      libxt_conntrack: fix state match alias state parsing
++
++Willem de Bruijn (2):
++      extensions: add libxt_bpf extension
++      utils: nfbpf_compile
++
++
++
++iptables v1.4.18 Changelog:
++======================================================================
++Changes from 1.4.17:
++
++
++Florian Westphal (1):
++      doc: rpfilter: invert option should have own paragraph
++
++Jan Engelhardt (11):
++      build: resolve link failure for ip6t_NETMAP
++      doc: fixup omissions in ip6tables-restore.8
++      doc: document iptables-restore's -t option
++      doc: document iptables-restore's -v option
++      doc: document iptables-restore's -M option
++      doc: document iptables-restore's -h option
++      doc: name the supported log levels for ipt_LOG
++      doc: mention -m in the manpage
++      doc: document the -4 and -6 options
++      extensions: S/DNPT: add missing save function
++      build: bump SONAME for libxtables
++
++Jozsef Kadlecsik (3):
++      Introduce match/target aliases
++      Add the "state" alias to the "conntrack" match
++      Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
++
++Pablo Neira Ayuso (7):
++      iptables: remove unused leftover definitions
++      libxtables: add xtables_rule_matches_free
++      libxtables: add xtables_print_num
++      Merge branch 'stable' into 'master'
++      doc: document nat table for IPv6
++      doc: iptables provides up to 5 independent tables
++      build: bump version to 1.4.18
++
++Ulrich Weber (3):
++      extensions: libip6t_DNPT: fix wording in DNPT target
++      extension: libip6t_DNAT: allow port DNAT without address
++      extensions: libip6t_DNAT: set IPv6 DNAT --to-destination
++
++
++
++
++iptables v1.4.17 Changelog:
++======================================================================
++Changes from 1.4.16.3:
++
++
++Florian Westphal (1):
++      libxt_time: add support to ignore day transition
++
++Jozsef Kadlecsik (1):
++      Manpage update: matches are evaluated in the order they are specified.
++
++Pablo Neira Ayuso (2):
++      Merge branch 'next' branch that contains new features scheduled for     Linux kernel 3.7
++      bump version to 1.4.17
++
++Patrick McHardy (7):
++      Convert the NAT targets to use the kernel supplied nf_nat.h header
++      extensions: add IPv6 MASQUERADE extension
++      extensions: add IPv6 SNAT extension
++      extensions: add IPv6 DNAT target
++      extensions: add IPv6 REDIRECT extension
++      extensions: add IPv6 NETMAP extension
++      extensions: add NPT extension
++
++Tom Eastep (1):
++      extensions: libxt_statistic: Fix save output
++
++
++
++iptables v1.4.16.3 Changelog:
++======================================================================
++Changes from 1.4.16.2:
++
++
++Jan Engelhardt (2):
++      build: remove symlink-only extensions from static object list
++      build: resolve compile abort in libxt_limit on RHEL5
++
++Pablo Neira Ayuso (1):
++      bump iptables to 1.4.16.3
++
++
++
++iptables v1.4.16.2 Changelog:
++======================================================================
++Changes from 1.4.16.1:
++
++
++Jan Engelhardt (1):
++      iptables: restore NOTRACK functionality, target aliasing
++
++Pablo Neira Ayuso (1):
++      bump version to 1.4.16.2
++
++
++
++iptables v1.4.16.1 Changelog:
++======================================================================
++Changes from 1.4.16:
++
++
++Pablo Neira Ayuso (2):
++      iptables: fix standard target
++      bump version to 1.4.16.1
++
++
++
++iptables v1.4.16 Changelog:
++======================================================================
++Changes from 1.4.15:
++
++Andreas Schwab (1):
++      libxt_tcp: print space before, not after "flags:"
++
++Jan Engelhardt (23):
++      iptables-restore: warn about -t in rule lines
++      doc: grammatical updates to libxt_SET
++      libxt_u32: do bounds checking for @'s operands
++      libxt_devgroup: consolidate devgroup specification parsing
++      libxt_devgroup: guard against negative numbers
++      libxt_LED: guard against negative numbers
++      libxt_*limit: avoid division by zero
++      Merge remote-tracking branch 'nf/stable'
++      build: support for automake-1.12
++      build: separate AC variable replacements from xtables.h
++      build: have `make clean` remove dep files too
++      libxtables: consolidate preference logic
++      iptables: support for target aliases
++      libxt_NOTRACK: replace as an alias to CT --notrack
++      iptables: support for match aliases
++      libxt_state: replace as an alias to xt_conntrack
++      Merge branch 'master' of git://git.inai.de/iptables
++      doc: clean up interpunction in state list for xt_conntrack
++      doc: deduplicate extension descriptions into a new manpage
++      doc: trim "state" manpage and reference conntrack instead
++      doc: have NOTRACK manpage point to CT instead
++      doc: mention iptables-apply in the SEE ALSO sections
++      Merge branch 'master' of git://git.inai.de/iptables
++
++Jozsef Kadlecsik (1):
++      New set match revision with --return-nomatch flag support
++
++Michal Kubeek (1):
++      libip6t_frag: match any frag id by default
++
++Pablo Neira Ayuso (6):
++      include: add missing linux/netfilter_ipv4/ip_queue.h
++      ip[6]tables-restore: cleanup to reduce one level of indentation
++      include: add missing linux/netfilter_ipv4/ip_queue.h
++      iptables: fix wrong error messages
++      extensions: libxt_addrtype: fix type in help message
++      bump version to 1.4.16
++
++
++
++iptables v1.4.15 Changelog:
++======================================================================
++Changes from 1.4.14:
++
++
++Denys Fedoryshchenko (1):
++      libxt_recent: add --mask netmask
++
++Eldad Zack (1):
++      libxt_recent: remove unused variable
++
++Florian Westphal (2):
++      libxt_devgroup: add man page snippet
++      libxt_hashlimit: add support for byte-based operation
++
++Hans Schillstrom (3):
++      extensions: add HMARK target
++      libxt_HMARK: fix output of iptables -L
++      libxt_HMARK: correct a number of errors introduced by Pablo's rework
++
++Pablo Neira Ayuso (6):
++      libxtables: add xtables_ip[6]mask_to_cidr
++      libxt_HMARK: fix ct case example
++      iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)
++      Revert "iptables-restore: move code to add_param_to_argv, cleanup (fix gcc-4.7)"
++      iptables-restore: fix parameter parsing (shows up with gcc-4.7)
++      bump version to 1.4.15
++
++
++iptables v1.4.14 Changelog:
++======================================================================
++Changes from 1.4.13:
++
++
++Florian Westphal (3):
++      ip(6)tables-restore: make sure argv is NULL terminated
++      extensions: libxt_rateest: output all options in save hook
++      tests: add rateest match rules
++
++Miguel GAIO (1):
++      libiptc: fix retry path in TC_INIT
++
++Pablo Neira Ayuso (3):
++      libxt_CT: add --timeout option
++      libipt_ULOG: fix --ulog-cprange
++      Bump version to 1.4.14
++
++
++
++iptables v1.4.13 Changelog:
++======================================================================
++Changes from 1.4.12.2:
++
++
++Florian Westphal (1):
++      extensions: add rpfilter module
++
++Franz Flasch (2):
++      iptables: missing free() in function cache_add_entry()
++      iptables: missing free() in function delete_entry()
++
++Jonh Wendell (1):
++      libiptc: Returns the position the entry was inserted
++
++Maciej enczykowski (1):
++      src: mark newly opened fds as FD_CLOEXEC (close on exec)
++
++Pablo Neira Ayuso (7):
++      Revert "libiptc: Returns the position the entry was inserted"
++      extensions: add nfacct match
++      Bump version to 1.4.13
++
++
++Patrick McHardy (1):
++      extensions: add IPv6 capable ECN match extension
++
++
++
++iptables v1.4.12.2 Changelog:
++======================================================================
++Changes from 1.4.12.1:
++
++
++Florian Westphal (2):
++      libxt_NFQUEUE: fix --queue-bypass ipt-save output
++      libxt_connbytes: fix handling of --connbytes FROM
++
++Jan Engelhardt (17):
++      xtoptions: fill in fallback value for nvals
++      libxt_statistic: link with -lm
++      libxt_RATEEST: link with -lm
++      build: scan for unreferenced symbols
++      iptables: move kernel version find routing into libxtables
++      Merge branch 'stable' of git://dev.medozas.de/iptables
++      Merge branch 'stable'
++      build: sort file list before build
++      doc: fix undesired newline in ip6tables-restore(8)
++      ip6tables-restore: implement missing -T option
++      doc: document iptables-restore's -T option
++      build: restore build order of modules
++      build: make check stage not fail when building statically
++      libipt_SAME: set PROTO_RANDOM on all ranges
++      doc: clarification on the meaning of -p 0
++      libiptc: provide separate pkgconfig files
++      nfnl_osf: add missing libnfnetlink_CFLAGS to compile process
++
++Pablo Neira Ayuso (1):
++      Bump version to 1.4.12.2
++
++Richard Weinberger (1):
++      xtoptions: simplify xtables_parse_interface
++
++Thomas Jarosch (1):
++      libxtables: Fix file descriptor leak in xtables_lmap_init on error
++
++Tom Eastep (2):
++      libxt_conntrack: improve error message on parsing violation
++      libxt_CONNSECMARK: fix spacing in output
++
++
++
++iptables v1.4.12.1 Changelog:
++======================================================================
++Changes from 1.4.12:
++
++
++Bernard Massot (1):
++      doc: fix typo in libxt_TRACE
++
++Dwight Davis (1):
++      libxt_string: fix space around arguments
++
++Fernando Luis Vzquez Cao (1):
++      libxt_TOS: update linux kernel version list for backported fix
++
++Jan Engelhardt (36):
++      extensions: use multi-target registration
++      libxt_TCPMSS: restore build with IPv6-less libcs
++      libxt_string: define _GNU_SOURCE for strnlen
++      build: workaround broken linux-headers on RHEL-5
++      build: strengthen check for overlong lladdr components
++      build: abort autogen on subcommand failure
++      libipq: add pkgconfig file
++      libxt_u32: fix missing allowance for inversion
++      libxt_set: update man page about kernel support on the feature
++      libxt_tcp: always print the mask parts
++      libxt_set: put differing variable names in directly
++      doc: clarify libxt_connlimit defaults
++      libxt_conntrack: remove one misleading comment
++      libxt_dccp: restore missing XTOPT_INVERT tags for options
++      libxt_dccp: fix deprecated intrapositional ordering of !
++      libxt_dccp: spell out option name on save
++      libxt_dccp: provide man pages options in short help too
++      libxt_dccp: fix random output of ! on --dccp-option
++      libxt_dscp: restore inversion support
++      libxt_hashlimit: default htable-expire must be in milliseconds
++      libxt_conntrack: fix --ctproto 0 output
++      xtoptions: flag use of XTOPT_POINTER without XTOPT_PUT
++      libip6t_frag: restore inversion support
++      libxt_hashlimit: remove inversion from hashlimit rev 0
++      libip6t_hbh: restore setting IP6T_OPTS_LEN flag
++      libip6t_dst: restore setting IP6T_OPTS_LEN flag
++      libipt_ttl: document that negation is available
++      libxt_owner: restore inversion support
++      libxt_physdev: restore inversion support
++      libxt_policy: remove superfluous inversion
++      tests: add negation tests for libxt_statistic
++      libxt_hashlimit: observe new default gc-expire time when saving
++      libxt_string: simplify hex output routine
++      libxt_string: replace hex codes by char equivalents
++      src: remove unused IPTABLES_MULTI define
++      libxt_string: escape the escaping char too
++
++Pablo Neira Ayuso (1):
++      Bump version to 1.4.12.1
++
++Patrick McHardy (1):
++      Merge branch 'master' of git://dev.medozas.de/iptables
++
++
++
++iptables v1.4.12 Changelog:
++======================================================================
++Changes from 1.4.11.1:
++
++
++Fernando Luis Vazquez Cao (1):
++      doc: document IPv6 TOS mangling bug in old Linux kernels
++
++Jakub Zawadzki (1):
++      doc: fix group range in libxt_NFLOG's man
++
++Jan Engelhardt (23):
++      doc: include matches/targets in manpage again
++      libipt_LOG: fix ignoring all but last flags
++      libxt_RATEEST: use guided option parser
++      iptables: consolidate target/match init call
++      extensions: support for per-extension instance "global" variable space
++      libxt_rateest: abolish global variables
++      libxt_RATEEST: abolish global variables
++      libip6t_HL: fix option names from ttl -> hl
++      libxt_state: fix regression about inversion of main option
++      libxt_hashlimit: use a more obvious expiry value by default
++      build: bump soversion for recent data structure change
++      build: attempt to fix building under Linux 2.4
++      doc: mention multiple verbosity flags
++      build: install modules in arch-dependent location
++      doc: fix version string in ip6tables.8
++      doc: the -m option cannot be inverted
++      iptables: restore negation for -f
++      libxtables: properly reject empty hostnames
++      libxtables: ignore whitespace in the multiaddress argument parser
++      option: remove last traces of intrapositional negation
++      libxtables: set clone's initial data to NULL
++      libxt_conntrack: restore network-byte order for v1,v2
++      libxt_conntrack: move more data into the xt_option_entry
++
++Jiri Popelka (5):
++      iptables: Coverity: DEADCODE
++      iptables: Coverity: NEGATIVE_RETURNS
++      iptables: Coverity: REVERSE_INULL
++      iptables: Coverity: VARARGS
++      iptables: Coverity: RESOURCE_LEAK
++
++Martin F. Krafft (1):
++      iptables-apply: select default rule file depending on call name
++
++Massimo Maggi (1):
++      libxt_RATEEST: fix userspacesize field
++
++Patrick McHardy (4):
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Bump version to 1.4.12
++
++
++
++iptables v1.4.11.1 Changelog:
++======================================================================
++Changes from 1.4.11:
++
++
++Elie De Brauwer (1):
++      doc: fix trivial typo in libipt_SNAT
++
++Jan Engelhardt (13):
++      libxt_owner: restore inversion support
++      build: remove dead code parts
++      build: fix installation of symlinks
++      build: fix absence of xml translator in IPv6-only builds
++      doc: update GPL license text
++      doc: iptables-xml should be in manpage section 1
++      build: move basic preprocessor flags to regular_CPPFLAGS
++      build: move kinclude's preprocessor flags to kinclude_CPPFLAGS
++      src: move all libiptc pieces into its directory
++      src: move all iptables pieces into a separate directory
++      tests: add some sample rulesets to test save-restore cycle
++      option: fix ignored negation before implicit extension loading
++      build: re-add missing CPPFLAGS for libiptc
++
++Maciej Żenczykowski (1):
++      xtables-multi: fix absence of xml translator in IPv6-only builds
++
++Mike Frysinger (1):
++      build: move remaining preprocessor flags to CPPFLAGS
++
++Patrick McHardy (1):
++      Bump version to 1.4.11.1
++
++Vlad Dogaru (1):
++      doc: fix MASQUERADE section of man page
++
++
++
++iptables v1.4.11 Changelog:
++======================================================================
++Changes from 1.4.10:
++
++
++Changli Gao (1):
++      iptables: fix the dead loop when meeting unknown options
++
++Florian Westphal (3):
++      libxt_conntrack: fix --ctdir save/dump output format
++      libxt_time: fix random --datestart skips
++      extensions: libxt_NFQUEUE: add v2 revision with --queue-bypass option
++
++JP Abgrall (1):
++      libxt_quota: make sure uint64 is not truncated
++
++Jan Engelhardt (218):
++      libxtables: change option precedence order to be intuitive
++      libxt_TOS: avoid an undesired overflowing computation
++      iptables: fix longopt reecognition and workaround getopt(3) behavior
++      Revert "Revert "libxtables: change option precedence order to be intuitive""
++      Merge branch 'master' of git://dev.medozas.de/iptables into m2
++      iptables: reset options at the start of each command
++      iptables: do not emit orig_opts twice
++      include: update files with headers from Linux 2.6.37-rc1
++      TPROXY: add support for revision 1
++      socket: add support for revision 1
++      build: fix globbing of extensions in other locales
++      libxt_owner: output numeric IDs when save is requested
++      Merge commit 'v1.4.10'
++      build: stop on error in subcommand
++      src: const annotations
++      xt_comment: remove redundant cast
++      src: use C99/POSIX types
++      iptables: abort on empty interface specification
++      xtables: reorder num_old substraction for clarity
++      ip[6]tables: only call match's parse function when option char is in range
++      ip[6]tables: only call target's parse function when option char is in range
++      extensions: remove no longer necessary default: cases
++      libxt_sctp: fix a typo
++      libipt_CLUSTERIP: const annotations
++      libxtables: do some option structure checking
++      libxt_quota: print negation when it has been selected
++      libxt_connlimit: reword help text to say prefix length
++      libxt_connlimit: add a --connlimit-upto option
++      libxt_connlimit: support for dstaddr-supporting revision 1
++      libxt_connlimit: remove duplicate member that caused size change
++      libxt_quota: clarifications on matching
++      iptables: improve error reporting with extension loading troubles
++      libxt_u32: enclose argument in quotes
++      xtables: set custom opts to NULL on free
++      iptables: warn when parameter limit is exceeded
++      iptables: remove bogus address-of
++      iptables: remove more redundant casts
++      iptables: do not print trailing whitespaces
++      src: collect do_command variables in a struct
++      src: move large default: block from do_command6 into its own function
++      src: share iptables_command_state across the two programs
++      src: deduplicate find_proto function
++      src: move OPT_FRAGMENT to the end so the list can be shared
++      src: put shared option flags into xshared
++      src: deduplicate and simplify implicit protocol extension loading
++      src: unclutter command_default function
++      src: move jump option handling from do_command6 into its own function
++      src: move match option handling from do_command6 into its own functions
++      iptables: fix error message for unknown options
++      iptables: fix segfault target option parsing
++      ip6tables: spacing fixes for -o argument
++      libxt_devgroup: option whitespace update following v1.4.10-49-g7386635
++      extensions: fix indent of vtable
++      doc: fix wrong sentence about negation in xt_limit
++      doc: fix misspelling of "field"
++      extensions: remove redundant init functions
++      Remove unused CVS expanded keywords
++      libip6t_dst: remove unimplemented --dst-not-strict
++      libip6t_hbh: remove unimplemented --hbh-not-strict
++      extensions: add missing checks for specific flags
++      libipt_ECN: set proper option flags
++      doc: mention other possible nf_loggers for TRACE
++      doc: fix odd partial sentence in libipt_TTL
++      libxt_quota: require --quota to be specified
++      doc: rateest options can be optional
++      libxtables: fix memory scribble beyond end of array
++      iptables: fix an inversion
++      doc: add VERSION section to manpages
++      extensions: add missing checks for specific flags (2)
++      libxtables: guided option parser
++      libxt_CHECKSUM: use guided option parser
++      libxt_socket: use guided option parser
++      libxtables: provide better final_check
++      libxt_CONNSECMARK: use guided option parser
++      libxtables: XTTYPE_UINT32 support
++      libxt_cpu: use guided option parser
++      libxtables: min-max option support
++      libxt_cluster: use guided option parser
++      libxtables: XTTYPE_UINT8 support
++      libip[6]t_HL: use guided option parser
++      libip[6]t_hl: use guided option parser
++      libxtables: XTTYPE_UINT32RC support
++      libip[6]t_ah: use guided option parser
++      libip6t_frag: use guided option parser
++      libxt_esp: use guided option parser
++      libxtables: XTTYPE_STRING support
++      libip[6]t_REJECT: use guided option parser
++      libip6t_dst: use guided option parser
++      libip6t_hbh: use guided option parser
++      libip[6]t_icmp: use guided option parser
++      libip6t_ipv6header: use guided option parser
++      libipt_ECN: use guided option parser
++      libipt_addrtype: use guided option parser
++      libxt_AUDIT: use guided option parser
++      libxt_CLASSIFY: use guided option parser
++      libxt_DSCP: use guided option parser
++      libxt_LED: use guided option parser
++      libxt_SECMARK: use guided option parser
++      libxt_TCPOPTSTRIP: use guided option parser
++      libxt_comment: use guided option parser
++      libxt_helper: use guided option parser
++      libxt_physdev: use guided option parser
++      libxt_pkttype: use guided option parser
++      libxt_state: use guided option parser
++      libxt_time: use guided option parser
++      libxt_u32: use guided option parser
++      doc: avoid duplicate entries in manpage
++      libxtables: XTTYPE_MARKMASK32 support
++      libxt_MARK: use guided option parser
++      libxt_CONNMARK: use guided option parser
++      libxtables: XTTYPE_UINT64 support
++      libxt_quota: use guided option parser
++      libxtables: linked-list name<->id map
++      libxt_devgroup: use guided option parser
++      libipt_realm: use guided option parser
++      libxtables: XTTYPE_UINT16RC support
++      libxt_length: use guided option parser
++      libxt_tcpmss: use guided option parser
++      libxtables: XTTYPE_UINT8RC support
++      libxtables: XTTYPE_UINT64RC support
++      libxt_connbytes: use guided option parser
++      libxtables: XTTYPE_UINT16 support
++      libxt_CT: use guided option parser
++      libxt_NFQUEUE: use guided option parser
++      libxt_TCPMSS: use guided option parser
++      libxtables: pass struct xt_entry_{match,target} to x6 parser
++      libxt_string: use guided option parser
++      libxtables: XTTYPE_SYSLOGLEVEL support
++      libip[6]t_LOG: use guided option parser
++      libxtables: XTTYPE_ONEHOST support
++      libxtables: XTTYPE_PORT support
++      libxt_TPROXY: use guided option parser
++      libipt_ULOG: use guided option parser
++      build: bump libxtables ABI version
++      libxt_TEE: use guided option parser
++      xtoptions: respect return value in xtables_getportbyname
++      libxt_TOS: use guided option parser
++      libxt_tos: use guided option parser
++      extensions: remove unused TOS code
++      libxtables: XTTYPE_PORTRC support
++      libxt_udp: use guided option parser
++      libxt_dccp: use guided option parser
++      libxt_tos: add inversion support back again
++      libxtables: fix assignment in wrong offset (XTTYPE_UINT*RC)
++      libxt_u32: add missing call to xtables_option_parse
++      extensions: remove bogus use of XT_GETOPT_TABLEEND
++      libxt_owner: remove ifdef IPT_COMM_OWNER
++      libxtables: output name of extension on rev detect failure
++      extensions: const annotations
++      libxt_statistic: streamline and document possible placement of negation
++      libxt_statistic: increase precision on create and dump
++      libxtables: XTTYPE_DOUBLE support
++      libxt_statistic: use guided option parser
++      libxt_IDLETIMER: use guided option parser
++      libxt_NFLOG: use guided option parser
++      libxtables: support for XTTYPE_PLENMASK
++      libxt_connlimit: use guided option parser
++      libxt_recent: use guided option parser
++      libxtables: do not overlay addr and mask parts, and cleanup
++      libxtables: flag invalid uses of XTOPT_PUT
++      libxtables: XTTYPE_PLEN support
++      libxt_hashlimit: use guided option parser
++      libxtables: XTTYPE_HOSTMASK support
++      libxt_policy: use guided option parser
++      libxt_owner: use guided option parser
++      libxt_osf: use guided option parser
++      libxt_multiport: use guided option parser
++      libipt_NETMAP: use guided option parser
++      libxt_limit: use guided option parser
++      libxtables: XTTYPE_PROTOCOL support
++      libxt_ipvs: use guided option parser
++      doc: S/DNAT allows to omit IP addresses
++      libxt_conntrack: use guided option parser
++      libip6t_mh: use guided option parser
++      libip6t_rt: use guided option parser
++      libxtables: XTTYPE_ETHERMAC support
++      libxt_mac: use guided option parser
++      libipt_CLUSTERIP: use guided option parser
++      libxt_iprange: use guided option parser
++      libipt_DNAT: use guided option parser
++      libipt_SNAT: use guided option parser
++      libipt_MASQUERADE: use guided option parser
++      libipt_REDIRECT: use guided option parser
++      libipt_SAME: use guided option parser
++      src: replace old IP*T_ALIGN macros
++      src: combine default_command functions
++      libxt_policy: option table fixes, improved error tracking
++      libxtables: avoid running into .also checks when option not used
++      libxt_policy: use XTTYPE_PROTOCOL type
++      libxtables: collapse double protocol parsing
++      libipt_[SD]NAT: flag up module name on error
++      libipt_[SD]NAT: avoid false error about multiple destinations specified
++      libxt_conntrack: correct printed module name
++      libxt_conntrack: fix assignment to wrong member
++      libxt_conntrack: resolve erroneous rev-2 port range message
++      libip6t_rt: rt-0-not-strict should take no arg
++      libxtables: retract _NE types and use a flag instead
++      libxt_quota: readd missing XTOPT_PUT request
++      libxtables: check for negative numbers in xtables_strtou*
++      libxt_rateest: streamline case display of units
++      doc: add some coded option examples to libxt_hashlimit
++      doc: make usage of libxt_rateest more obvious
++      doc: clarify that -p all is a special keyword only
++      doc: use .IP list for TCPMSS
++      doc: remove redundant .IP calls in libxt_time
++      libxt_ipvs: restore network-byte order
++      libxt_u32: --u32 option is required
++      libip6t_rt: restore --rt-type storing
++      libxtables: more detailed error message on multi-int parsing
++      libxtables: use uintmax for xtables_strtoul
++      libxtables: make multiint parser have greater range
++      libxtables: unclutter xtopt_parse_mint
++      libxtables: have xtopt_parse_mint interpret partially-spec'd ranges
++      libxt_NFQUEUE: avoid double attempt at parsing
++      libxt_NFQUEUE: add mutual exclusion between qnum and qbal
++      libxt_time: always ignore libc timezone
++      libxt_time: --utc and --localtz are mutually exclusive
++      libxt_time: deprecate --localtz option, document kernel TZ caveats
++
++Jozsef Kadlecsik (3):
++      Fix listing/saving the new revision of the SET target
++      Fix set match/target direction parser
++      SET target revision 2 added
++
++Li Yewang (1):
++      xtables: fix typo in error message of xtables_register_match()
++
++Lutz Jaenicke (2):
++      libipt_REDIRECT: "--to-ports" is not mandatory
++      libxt_devgroup: actually set XT_DEVGROUP_OPT_???GROUP flags
++
++Maciej Zenczykowski (20):
++      man pages: allow underscores in match and target names
++      mark newly opened fds as FD_CLOEXEC (close on exec)
++      xtables_ip6addr_to_numeric: fix typo in comment
++      xtables: delay (statically built) match/target initialization
++      v4: rename init_extensions() to init_extensions4()
++      v6: rename init_extensions() to init_extensions6()
++      xtables.h: init_extensions() no longer exists
++      v4: rename for_each_chain() to for_each_chain4()
++      v6: rename for_each_chain() to for_each_chain6()
++      v4: rename flush_entries() to flush_entries4()
++      v6: rename flush_entries() to flush_entries6()
++      v4: rename delete_chain() to delete_chain4()
++      v6: rename delete_chain() to delete_chain6()
++      v4: rename print_rule() to print_rule4()
++      v6: rename print_rule() to print_rule6()
++      v4: rename do_command() to do_command4()
++      v6: rename do_command() to do_command6()
++      move 'int line' definition from ip6?tables.c into xtables.c
++      convert ip6?tables-multi to actually use their own header files
++      Don't load ip6?_tables module when already loaded
++
++Maciej Żenczykowski (3):
++      Add --ipv4/-4 and --ipv6/-6 support to ip6?tables{,-restore}.
++      Move common parts of libext{4,6}.a into libext.a
++      combine ip6?tables-multi into xtables-multi
++
++Mark Montague (1):
++      iptables: documentation for iptables and ip6tables "security" tables
++
++Max Kellerman (1):
++      xtables: use strspn() to check if string needs to be quoted
++
++Pablo Neira Ayuso (1):
++      libxt_cluster: fix inversion in the cluster match
++
++Patrick McHardy (16):
++      Revert "libxtables: change option precedence order to be intuitive"
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      extensions: libxt_conntrack: add support for specifying port ranges
++      extensions: add extension for devgroup match
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
++      Merge branch 'opts' of git://dev.medozas.de/iptables
++      Merge branch 'opts' of git://dev.medozas.de/iptables
++      Merge branch 'floating/opts' of git://dev.medozas.de/iptables
++      Merge branch 'opts' of git://dev.medozas.de/iptables
++      Merge branch 'opts' of git://dev.medozas.de/iptables
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'opts' of git://dev.medozas.de/iptables
++      Merge branch 'floating/opts' of git://dev.medozas.de/iptables
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Bump version to 1.4.11
++
++Rob Leslie (1):
++      iptables-restore: resolve confusing policy error message
++
++Stefan Tomanek (2):
++      ip(6)tables-multi: unify subcommand handling
++      iptables: add -C to check for existing rules
++
++Stephen Beahm (1):
++      libipt_REDIRECT: avoid dereference of uninitialized pointer
++
++Thomas Graf (2):
++      libxt_AUDIT: add AUDIT target
++      iptables: add manual page section for AUDIT target
++
++Wes Campaigne (4):
++      libxtables: avoid confusing use of ai_protocol=IPPROTO_IPV6
++      xtables: fix excessive memory allocation in host_to_ipaddr
++      xtables: fix the broken detection/removal of redundant addresses
++      xtables: use all IPv6 addresses resolved from a hostname
++
++
++
++iptables v1.4.10 Changelog:
++======================================================================
++Changes from 1.4.9:
++
++
++Changli Gao (1):
++      libxt_quota: don't ignore the quota value on deletion
++
++Eric Dumazet (2):
++      extensions: REDIRECT: add random help
++      extension: add xt_cpu match
++
++Hannes Eder (1):
++      libxt_ipvs: user-space lib for netfilter matcher xt_ipvs
++
++Jan Engelhardt (11):
++      doc: let man(1) autoalign the text in xt_cpu
++      doc: remove extra empty line from xt_cpu
++      doc: minimal spelling updates to xt_cpu
++      all: consistent syntax use in struct option
++      doc: consistent use of markup
++      xtables: remove unnecessary cast
++      build: fix static linking
++      iptables-xml: resolve compiler warnings
++      iptables: limit chain name length to be consistent with targets
++      libiptc: build with -Wl,--no-as-needed
++      libiptc: add Libs.private to pkgconfig files
++
++Luciano Coelho (2):
++      extensions: add idletimer xt target extension
++      extensions: libxt_IDLETIMER: use xtables_param_act when checking options
++
++Michael S. Tsirkin (1):
++      extensions: libxt_CHECKSUM extension
++
++Patrick McHardy (6):
++      extensions: libipt_LOG/libip6t_LOG: support macdecode option
++      extensions: fix compilation of the new CHECKSUM target
++      Merge branch 'master' into iptables-next
++      Merge branch 'master' into iptables-next
++      Merge branch 'iptables-next'
++      Bump version to 1.4.10
++
++
++
++iptables v1.4.9 Changelog:
++======================================================================
++Changes from 1.4.8:
++
++
++Adam Nielsen (1):
++      extensions: add the LED target
++
++Eric Dumazet (1):
++      extensions: REDIRECT: add random help
++
++Jan Engelhardt (10):
++      utils: add missing include flags to Makefile
++      doc: xt_string: correct copy-and-pasting in manpage
++      doc: xt_hashlimit: fix a typo
++      doc: xt_LED: nroff formatting requirements
++      includes: sync header files from Linux 2.6.35-rc1
++      xtables: another try at chain name length checking
++      xtables: remove xtables_set_revision function
++      libxt_hashlimit: always print burst value
++      libxt_conntrack: do print netmask
++      xt_quota: also document negation
++
++Jozsef Kadlecsik (1):
++      libxt_set: new revision added
++
++Luciano Coelho (2):
++      extensions: libxt_rateest: fix typo in the man page
++      extensions: libxt_rateest: fix bps options for iptables-save
++
++Patrick McHardy (5):
++      Revert "Revert "Merge branch 'iptables-next'""
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
++      Bump version to 1.4.9
++
++Samuel Ortiz (1):
++      extensions: libxt_quota.c: Support option negation
++
++Shan Wei (2):
++      xt_sctp: Trace DATA chunk that supports SACK-IMMEDIATELY extension
++      xt_sctp: support FORWARD_TSN chunk type
++
++
++
++iptables v1.4.8 Changelog:
++======================================================================
++Changes from 1.4.7:
++
++
++Dmitry V. Levin (3):
++      extensions: REDIRECT: fix --to-ports parser
++      iptables: add noreturn attribute to exit_tryhelp()
++      extensions: MASQUERADE: fix --to-ports parser
++
++Jan Engelhardt (9):
++      libxt_comment: avoid use of IPv4-specific examples
++      libxt_CT: add a manpage
++      iptables: correctly check for too-long chain/target/match names
++      doc: libxt_MARK: no longer restricted to mangle table
++      doc: remove claim that TCPMSS is limited to mangle
++      libxt_recent: add a missing space in output
++      doc: add manpage for libxt_osf
++      libxt_osf: import nfnl_osf program
++      extensions: add support for xt_TEE
++
++Karl Hiramoto (1):
++      iptables: optionally disable largefile support
++
++Pablo Neira Ayuso (1):
++      CT: fix --ctevents parsing
++
++Patrick McHardy (7):
++      extensions: add CT extension
++      libxt_CT: print conntrack zone in ->print/->save
++      Merge branch 'master' of git://dev.medozas.de/iptables into iptables-next
++      xtables: fix compilation when debugging is enabled
++      Merge branch 'iptables-next'
++      Revert "Merge branch 'iptables-next'"
++      Bump version to 1.4.8
++
++Simon Lodal (1):
++      libxt_conntrack: document --ctstate UNTRACKED
++
++Vincent Bernat (1):
++      iprange: fix xt_iprange v0 parsing
++
++
++
++iptables v1.4.7 Changelog:
++======================================================================
++Changes from 1.4.6:
++
++
++Dmitry V. Levin (1):
++      libip4tc: Add static qualifier to dump_entry()
++
++Jan Engelhardt (8):
++      libipq: build as shared library
++      recent: reorder cases in code (cosmetic cleanup)
++      doc: fix recent manpage to reflect actual supported syntax
++      doc: fix limit manpage to reflect actual supported syntax
++      doc: mention requirement of additional packages for ipset
++      policy: fix error message showing wrong option
++      includes: header updates
++      Lift restrictions on interface names
++
++Patrick McHardy (1):
++      iptables 1.4.7
++
++
++
++iptables v1.4.6 Changelog:
++======================================================================
++Changes from 1.4.5:
++
++
++Jan Engelhardt (20):
++      iptables: manpage updates for augmented -Z syntax
++      doc: mention maximum mark size in manpages
++      Support for nommu arches
++      realm: remove static initializations
++      libiptc: remove unused functions
++      libiptc: avoid strict-aliasing warnings
++      iprange: do accept non-ranges for xt_iprange v1
++      iprange: warn on reverse range
++      iprange: roll address parsing into a loop
++      iprange: do accept non-ranges for xt_iprange v1 (log)
++      iprange: warn on reverse range (log)
++      libiptc: fix wrong maptype of base chain counters on restore
++      iptables: fix undersized deletion mask creation
++      style: reduce indent in xtables_check_inverse
++      libxtables: hand argv to xtables_check_inverse
++      iptables/extensions: make bundled options work again
++      CONNMARK: print mark rules with mask 0xffffffff as set instead of xset
++      iptables: take masks into consideration for replace command
++      doc: explain experienced --hitcount limit
++      doc: name resolution clarification
++
++Mohit Mehta (1):
++      iptables: expose option to zero packet/byte counters for a specific rule
++
++Olaf Rempel (1):
++      build: restore --disable-ipv6 functionality on system w/o v6 headers
++
++Patrick McHardy (7):
++      Merge branch 'zero' of git://dev.medozas.de/iptables
++      MARK: print mark rules with mask 0xffffffff as --set-mark instead of --set-xmark
++      DNAT: fix incorrect check during parsing
++      extensions: add osf extension
++      conntrack: fix --expires parsing
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Bump version to v1.4.6
++
++Tim Small (1):
++      doc: update TCPMSS manpage with Linux 2.6.25 changes
++
++sobtwmxt (1):
++      doc: fix typo in length manpage
++
++
++
++iptables v1.4.5 Changelog:
++======================================================================
++Changes from 1.4.4:
++
++
++Florian Westphal (1):
++      libxt_NFQUEUE: add new v1 version with queue-balance option
++
++Jan Engelhardt (18):
++      xt_conntrack: revision 2 for enlarged state_mask member
++      libxt_helper: fix invalid passed option to check_inverse
++      libiptc: split v4 and v6
++      extensions: collapse registration structures
++      iptables: allow for parse-less extensions
++      iptables: allow for help-less extensions
++      extensions: remove empty help and parse functions
++      xtables: add multi-registration functions
++      extensions: collapse data variables to use multi-reg calls
++      xtables: warn of missing version identifier in extensions
++      COMMIT_NOTES: notice to check for soversion bumps
++      build: order of dependent libs is sensitive
++      multi binary: allow subcommand via argv[1]
++      build: fix struct size mismatch
++      build: combine iptables-multi and iptables-static
++      build: build only iptables-multi
++      Merge branch 'stable'
++      manpages: more fixes to minuses, hyphens, dashes
++
++Laurence J. Lane (1):
++      manpage: fix lintian warnings
++
++Michael Granzow (1):
++      iptables: accept multiple IP address specifications for -s, -d
++
++Patrick McHardy (2):
++      man: fix incorrect plural in libipt_set.man
++      Bump version number to 1.4.5
++
++Trent W. Buck (1):
++      ipt_set: fix a typo in the manpage
++
++
++iptables v1.4.4 Changelog:
++======================================================================
++Changes from 1.4.3.2:
++
++
++Frank Tobin (1):
++      libxt_tcp: fix a manpage syntax typo
++
++Ian Bruce (1):
++      libxt_tcp: manpage corrections and suggestions
++
++Jan Engelhardt (15):
++      Add new COMMIT_NOTES document
++      xtables: use extern "C"
++      extensions: add const qualifiers in print/save functions
++      iptables: replace open-coded sizeof by ARRAY_SIZE
++      addrtype: fix one manpage type
++      manpages: do not include v4-only modules in ip6tables manpage
++      libip6t_policy: remove redundant functions
++      policy: use direct xt_policy_info instead of ipt/ip6t
++      policy: merge ipv6 and ipv4 variant
++      build: fix manpage collection
++      extensions: use NFPROTO_UNSPEC for .family field
++      DNAT/SNAT: add manpage documentation for --persistent flag
++      extensions: remove redundant casts
++      iptables: close open file descriptors
++      manpages: markup corrections
++
++Jozsef Kadlecsik (1):
++      Updated set/SET match and target to support multiple ipset protocols.
++
++Pablo Neira Ayuso (2):
++      extensions: add `cluster' match support
++      xtables: fix segfault if incorrect protocol name is used
++
++Patrick McHardy (3):
++      SNAT/DNAT: add support for persistent multi-range NAT mappings
++      Merge branch 'stable' of git://dev.medozas.de/iptables
++      Bump version
++
++kd6lvw (1):
++      libxt_connlimit: initialize v6_mask
++
++
++
++iptables v1.4.3.2 Changelog:
++======================================================================
++Changes from 1.4.3.1:
++
++
++Jan Engelhardt (12):
++      libxt_tcpmss: fix an inversion while parsing --mss
++      iptables-multi: support "iptables-static" as a callable name
++      libxtables: reorder .version member
++      build: do not run ldconfig for DESTDIR installations
++      build: add configure option to disable ip6tables
++      build: add configure option to disable ipv4 iptables
++      libxtables: provide IPv6 zero address variable
++      iptables: print negation extrapositioned
++      Merge commit 'v1.4.3'
++      Merge branch 'plus'
++      CLASSIFY: document non-standard interpretation behavior
++      libxt_conntrack: properly output negation symbol
++
++Pablo Neira Ayuso (1):
++      build: bump version to 1.4.3.2
++
++
++iptables v1.4.3.1 Changelog:
++======================================================================
++Changes from 1.4.3:
++
++
++Jan Engelhardt (2):
++      iptables-save: minor corrections to the manpage markup
++      libxt_hashlimit: add missing space for iptables-save output
++
++Pablo Neira Ayuso (2):
++      build: bump version to 1.4.3.1
++      iptables: refer to dmesg if we hit EINVAL
++
++Peter Volkov (2):
++      libxtables: fix compile error due to incomplete change
++      build: fix linker issue when LDFLAGS contains --as-needed
++
++
++
++iptables v1.4.3 Changelog:
++======================================================================
++Changes from 1.4.2:
++
++
++Bart De Schuymer (1):
++      man: fix physdev manpage
++
++Christian Perle (1):
++      libxt_policy: cannot set spi/reqid numbers higher than 0x7fffffff
++
++Christoph Paasch (1):
++      libiptc: avoid compile warnings for iptc_insert_chain
++
++Daniel Drake (1):
++      libxt_owner: add more spaces to output
++
++Eric Leblond (1):
++      xt_NFLOG: Set default NFLOG qthreshold to 0
++
++Jamal Hadi Salim (12):
++      libxtables: Introduce global params structuring
++      libxtables: define xtables_free_opts()
++      libxtables: Add exit_error cb to xtables_globals
++      libxtables: Make ip6tables, iptables and iptables-xml use xtables_globals
++      libxtables: Replace direct exit_error() calls inside libxtables
++      libxtables: simple aliasing macro for exit_error
++      libxtables: set names of programs
++      libxtables: add xtables_set_revision
++      libxtables: make iptables and ip6tables use xtables_free_opts
++      libxtables: consolidate merge_options into xtables_merge_options
++      libxtables: consolidate init calls into one function
++      libxtables: general follow-up cleanup
++
++Jan Engelhardt (84):
++      Move libipt_recent to libxt_recent
++      libxt_recent: add IPv6 support
++      manpage: use separate paragraphs for command syntax
++      manpage: explain what rule-specification is
++      libiptc: remove typedef indirection
++      libiptc: remove indirections
++      libiptc: remove unused iptc_get_raw_socket and iptc_check_packet
++      libiptc: use hex output for hookmask
++      libxt_conntrack: respect -n option during ruledump
++      libiptc: make sockfd a per-handle thing
++      libxt_conntrack: dump ctdir
++      src: reuse the global modprobe_program variable
++      src: use NFPROTO_ constants
++      src: remove inclusion of iptables.h
++      doc: fix a typo in libip6t_REJECT.man
++      libiptc: guard chain index allocation for different malloc implementations
++      src: remove unused include files
++      iptables-save: output ! in position according to manpage
++      rateest: guard against segfault
++      env: augment deprecation notice
++      build: resolve autotools suggestions
++      doc: put iptables version into manpage
++      doc: resynchronize markup in iptables,ip6tables.8.in
++      doc: escape minus sign in manpages
++      build: use regular = assignments in Makefile
++      build: remove non-portable rule
++      doc: escape minus sign in manpage (2)
++      doc: augment ICMP manpage by type/code syntax
++      src: remove redundant returns at end of void-returning functions
++      src: remove redundant casts
++      libxt_owner: use correct UID/GID boundaries
++      extensions: use UINT_MAX constants over open-coded bits (1/2)
++      extensions: use UINT_MAX constants over open-coded numbers (2/2)
++      libxtables: prefix/order - fw_xalloc
++      libxtables: prefix/order - modprobe and xtables.ko loading
++      libxtables: prefix/order - match/target loading
++      libxtables: prefix/order - libdir
++      libxtables: prefix/order - strtoui
++      libxtables: prefix/order - program_name
++      libxtables: prefix/order - param_act
++      libxtables: prefix/order - ipaddr/ipmask to ascii output
++      libxtables: prefix/order - ascii to ipaddr/ipmask input
++      libxtables: prefix - misc functions
++      libxtables: prefix - parse and escaped output func
++      libxtables: prefix/order - move check_inverse to xtables.c
++      libxtables: prefix/order - move parse_protocol to xtables.c
++      libbxtables: prefix names and order it #1
++      libxtables: prefix names and order it #2
++      libxtables: prefix names and order #3
++      libxtables: move afinfo around
++      Merge branch 'origin/master'
++      libxtables: recognize IP6TABLES_LIB_DIR old-style environment variable
++      build: move -ldl to proper LDADD
++      libxtables: remove unused XT_LIB_DIR macro
++      libxtables: decouple non-xtables parts from header
++      src: remove iptables_rule_match indirection macro
++      src: remove unused ipt_tryload macro
++      libxtables: move compat defines to xtables.c
++      src: consolidate duplicate code in iptables/internal.h
++      libxtables: use const for vars holding literals
++      libxt_string: fix undefined behavior/incorrect patlen calculation
++      libxtables: flush before fork
++      libipq: add missing doc for NF_ values
++      build: restructure Makefile for include/ directory
++      libipq: fix compile error
++      build: remove unneeded -ldl from iptables_xml_LDADD
++      libiptc: make library available as a shared library
++      build: trigger reconfigure when extensions/GNUmakefile.in changes
++      doc: do not put IPv4 doc into ip6tables.8
++      doc: resynchronize manpage with in-code help
++      libxtables: inline and remove unused OPTION_OFFSET macro
++      libxtables: prefix exit_error to xtables_error
++      extensions: remove unwanted/add needed includes for IPv6 exts
++      extensions: remove unwanted/add needed includes for IPv4 exts
++      libxt_policy: use bounded strtoui
++      include: resynchronize headers with 2.6.29-rc5
++      extensions: add missing limits.h include
++      iptables: turn deprecation warning into enforcing mode
++      Merge commit 'nf/master'
++      libxt_connbytes: minor manpage adustments
++      libxt_connbytes: document nf_ct_acct behavior
++      libxtables: add -I/-L flags to pkgconfig files
++      libxt_comment: output quotes must be escaped in
++      iptables-save: module loading corrections
++
++Jesper Dangaard Brouer (3):
++      libiptc: fix chain rename bug in libiptc
++      libiptc: fix whitespaces and typos
++      libiptc: give credits to my self
++
++Jir Moravec (1):
++      libxt_TOS: fix compilation error
++
++KOVACS Krisztian (2):
++      Add iptables support for the TPROXY target
++      Add iptables support for the socket match
++
++Marc Fournier (1):
++      doc: fix option typo in libxt_multiport
++
++Pablo Neira Ayuso (5):
++      iptables: fix error reporting with wrong/missing arguments
++      state: report spaces in the state list parsing
++      iptables: refer to dmesg when we hit error
++      string: fix wrong pattern length calculation
++      iptables: fix broken options-merging during libxtables rework
++
++Patrick McHardy (5):
++      Add SCTP/DCCP support to NAT targets
++      Bump version to 1.4.3-rc1
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Merge branch 'master' of git://dev.medozas.de/iptables
++      Bump version to 1.4.3
++
++Shaul Karl (1):
++      doc: fix one layout issue in iptables-restore.8
++
++Stephen Hemminger (1):
++      iptables: Add limits.h to get INT_MIN, INT_MAX, ...
++
++Thomas Jarosch (2):
++      Fix compile error in libxt_iprange.c using gcc 4.3.2
++      Fix compile warnings using gcc 4.3.2
++
++
++iptables v1.4.2 Changelog:
++======================================================================
++Changes from 1.4.2-rc1:
++
++Jan Engelhard (1):
++	build: fix iptables-static build
++
++Jan Engelhardt (26):
++	build: do not install ip{,6}tables.h
++	Merge branch 'master' of vishnu.netfilter.org:/data/git/iptables
++	manpages: name and markup fixes
++	src: remove dependency on libiptc headers
++	src: drop libiptc from installation
++	iptables-restore: fix segmentation fault with -tanything
++	libxt_recent: do not allow both --set and --rttl
++	Put xtables.c into its own library, libxtables.so
++	manpages: correct erroneous markup
++	physdev: remove extra space in output
++	Warn about use of DROP in nat table
++	Synchronize invert flag order with manpages
++	build: fix dependency tracking for xtables.h.in
++	build: fix initext.c dependency
++	manpages: add missing --rsource,--rdest options to libxt_recent.man
++	manpages: add missing rateest documentation
++	manpages: add missing rateest match documentation
++	libxt_mac: flatten casts in libxt_mac
++	libxt_iprange: fix option names
++	src: use regular includes
++	src: Update comments
++	build: prepare make tarball for git 1.6.0
++	libxt_recent: do allow --rttl for --update
++	src: update comments part II
++	build: run ldconfig on `make install`
++	doc: remove mentions of NAT in ip6tables manpage
++
++Jesper Dangaard Brouer (1):
++	libiptc: remove old fixme
++
++Pablo Sebastian Greco (1):
++	mark: fix invalid iptables-save output
++
++Patrick McHardy (2):
++	manpages: fix another typo in tcp manpage
++	v1.4.2
++
++Phil Oester (3):
++	iptables-save: fix hashlimit output
++	libxt_dscp: fix save of negated dscp match rules
++	src: Missing limits.h includes
++
++WANG Cong (1):
++	manpages: Fix a typo in tcp man page
++
++
++
++iptables v1.4.1-rc1 Changelog:
++======================================================================
++Changes from 1.4.0:
++
++Peter Warasin:
++	Fix CONNMARK mask initialisation
++
++Jesper Dangaard Brouer:
++	Inline functions iptcc_is_builtin() and set_changed()
++	Introduce a counter for number of user defined chains
++	Solving scalability issue: for chain list "name" searching
++
++Patrick McHardy:
++	Add RATEEST target extension
++	Add rateest match extension
++	Remove obsolete file
++	Add netfilter.h
++	Remove compiler.h inclusions
++	Retry ruleset dump when kernel returns EAGAIN
++
++Pablo Neira Ayuso:
++	Cleanup several code wraparounds
++	Check for malloc() return value in merge_opts()
++	Check for merge_opts() return value
++
++Jan Engelhardt:
++	Converts the iptables build infrastructure to autotools
++	Introduce strtonum()
++	Introduce common error messages
++	Add libxt_owner
++	Add libxt_tos
++	Add libxt_TOS
++	Add libxt_MARK r2
++	Add libxt_connmark r1
++	Print warning when dlopen fails
++	Add libxt_conntrack r0
++	Bunch o' renames
++	Rename overlapping function names
++	Add more libxt_hashlimit checks
++	Add libxt_mark r1
++	Add libxt_iprange r0
++	Add libxt_iprange r1
++	Give preference to iptables header files
++	Build adjustments
++	Add libxt_CONNMARK revision 1
++	Add libxt_conntrack revision 1
++	libxt_owner: UID/GID range support
++	Fix compilation of iptables-static build
++	Correct the family member value of libxt_mark revision 1
++	Makefile: add a "tarball" target
++	Drop -W from CFLAGS and some tiny code cleanups
++	Fix -Wshadow warnings and clean up xt_sctp.h
++	Update the libxt_owner manpage with the UID/GID-range feature
++	Fix all remaining warnings (missing declarations, missing prototypes)
++	xtables.h: move non-exported parts to internal.h
++	Add support for xt_hashlimit match revision 1
++	Combine IP{,6}T_LIB_DIR into XTABLES_LIBDIR
++	manpages: fix broken markup (missing close tags)
++	manpages: grammar and spelling
++	manpages: update to reflect fine-grained control
++	configure: split --enable-libipq from --enable-devel
++	Import iptables-apply
++	Add all necessary header files - compilation fix for various cases
++	Install libiptc header files because xtables.h depends on it
++	iptables: use C99 lists for struct options
++	RATEEST: add manpage
++	Implement AF_UNSPEC as a wildcard for extensions
++	Combine ipt and ip6t manpages
++	Resolve warnings on 64-bit compile
++	Wrap dlopen code into NO_SHARED_LIBS
++	Remove support for compilation of conditional extensions
++	Resolve libipt_set warnings
++	Update documentation about building the package
++	configure.ac: AC_SUBST must be separate
++	Dynamically create xtables.h.in with version
++	configure.ac: remove already-defined variables
++	Remove old functions, constants
++	Properly initialize revision for ip6tables targets
++	Makefile.am: use PACKAGE_TARNAME
++	iptables out-of-tree build directory
++
++Sven Schnelle:
++	Add libxt_TCPOPTSTRIP
++
++Max Kellermann:
++	Fix REDIRECT manpage
++	Whitespace cleanup
++	Use size_t
++	Escape strings
++	Unescape parameters
++	Allow empty strings in argument parser
++	Fix gcc warnings
++
++Naohiro Ooiwa:
++	Fix define value of SCTP chunk type
++
++Filippo Zangheri:
++	Remove useless white spaces from iptables-xml manpages
++
++James King:
++	libxt_iprange: Fix IP validation logic
++
++Shan Wei:
++	iptables-save: remove unnecessary code
++
++Henrik Nordstrom:
++	Make iptables-restore usable over a pipe
++	Add support for --set-counters to iptables -P
++	iptables --list-rules command
++	iptables --list chain rulenum
++	Make --set-counters (-c) accept comma separated counters
++
++Jamie Strandboge:
++	Fix ip6tables dest address printing
++
++
++
++iptables v1.4.1.1 Changelog
++=====================================================================
++
++Henrik Nordstrom (1):
++	iptables: fix printing of line numbers with --line-numbers arg
++
++Jan Engelhardt (3):
++	ip6tables: fix printing of ipv6 network masks
++	build: fix `make install` when --disable-shared is used
++	iprange: kernel flags were not set
++
++Patrick McHardy (1):
++	v1.4.1.1
++
++
++
++iptables v1.4.1 Changelog
++======================================================================
++
++Filippo Zangheri (1):
++	removes useless white spaces from iptables-xml manpages.
++
++Gspr Lajos (1):
++	iptables: use C99 lists for struct options
++
++Henrik Nordstrom (5):
++	Make iptables-restore usable over a pipe
++	Add support for --set-counters to iptables -P
++	iptables --list-rules command
++	iptables --list chain rulenum
++	Make --set-counters (-c) accept comma separated counters
++
++James King (1):
++	[IPTABLES]: libxt_iprange: Fix IP validation logic
++
++Jamie Strandboge (1):
++	fix ip6tables dest address printing
++
++Jan Engelhardt (55):
++	Converts the iptables build infrastructure to autotools.
++	Introduce strtonum(), which works like string_to_number(), but passes
++	common error messages
++	libxt_owner
++	libxt_tos
++	libxt_TOS
++	libxt_MARK r2
++	libxt_connmark r1
++	print warning when dlopen fails
++	libxt_conntrack r0
++	bunch o' renames
++	rename overlapping function names
++	libxt_hashlimit checks
++	libxt_mark r1
++	libxt_iprange r0
++	libxt_iprange r1
++	Give preference to iptables header files
++	Build adjustments
++	libxt_CONNMARK revision 1
++	[IPTABLES]: libxt_conntrack revision 1
++	[IPTABLES]: libxt_owner: UID/GID range support
++	Fix compilation of iptables-static build
++	Correct the family member value of libxt_mark revision 1
++	Makefile: add a "tarball" target
++	Drop -W from CFLAGS and some tiny code cleanups
++	Fix -Wshadow warnings and clean up xt_sctp.h
++	Update the libxt_owner manpage with the UID/GID-range feature
++	Fix all remaining warnings (missing declarations, missing prototypes)
++	xtables.h: move non-exported parts to internal.h
++	Add support for xt_hashlimit match revision 1
++	Combine IP{,6}T_LIB_DIR into XTABLES_LIBDIR
++	manpages: fix broken markup (missing close tags)
++	manpages: grammar and spelling
++	manpages: update to reflect fine-grained control
++	configure: split --enable-libipq from --enable-devel
++	Add all necessary header files - compilation fix for various cases
++	Install libiptc header files because xtables.h depends on it
++	RATEEST: add manpage
++	Implement AF_UNSPEC as a wildcard for extensions
++	Combine ipt and ip6t manpages
++	Resolve warnings on 64-bit compile
++	Wrap dlopen code into NO_SHARED_LIBS
++	Remove support for compilation of conditional extensions
++	Resolve libipt_set warnings
++	Update documentation about building the package
++	configure.ac: AC_SUBST must be separate
++	Dynamically create xtables.h.in with version
++	configure.ac: remove already-defined variables
++	Remove old functions, constants
++	Makefile.am: use PACKAGE_TARNAME
++	iptables out-of-tree build directory
++	Update .gitignore
++	build: check for missing feature files
++	libxt_owner: add spaces to output
++	manpage updates
++
++Jesper Dangaard Brouer (3):
++	Inline functions iptcc_is_builtin() and set_changed().
++	Introduce a counter for number of user defined chains.
++	Solving scalability issue: for chain list "name"	searching.
++
++Kristof Provost (1):
++	REDIRECT: Allow symbolic port in REDIRECT --to-port
++
++Laszlo Attila Toth (1):
++	addrtype match: added revision 1
++
++Lutz Jaenicke (1):
++	Fix iptables-save output of libxt_owner match
++
++Martin F. Krafft (1):
++	Import iptables-apply
++
++Max Kellermann (7):
++	Fix REDIRECT manpage
++	whitespace cleanup
++	use size_t
++	escape strings
++	unescape parameters
++	allow empty strings in argument parser
++	fix gcc warnings
++
++Naohiro Ooiwa (1):
++	Fix define value of SCTP chunk type.
++
++Pablo Neira Ayuso (2):
++	- cleanup several code wraparounds
++	bump iptables version to prepare 1.4.1 release
++
++Patrick McHardy (16):
++	Add RATEEST target extension
++	Add rateest match extension
++	Remove obsolete file
++	Add netfilter.h
++	Remove compiler.h inclusions.
++	Retry ruleset dump when kernel returns EAGAIN.
++	Properly initialize revision for ip6tables targets
++	Bump version to 1.4.1-rc1
++	iptables 1.4.1-rc2
++	manpages: consistent syntax
++	Resync header files with kernel
++	Bump version
++	libiptc: move variable definitions to head of function
++	iptables-xml: sparse fixes
++	sparse warning fixes: integer used as pointer
++	v1.4.1
++
++Peter Warasin (1):
++	Fix CONNMARK mask initialisation
++
++Shan Wei (1):
++	iptables-save:remove unnecessary code.
++
++Sven Schnelle (1):
++	libxt_TCPOPTSTRIP
++
++Thomas Jacob (1):
++	Don't assume /bin/sh is bash
++
++Thomas Jarosch (1):
++	Add xtables version defines.
++
++Yasuyuki Kozakai (1):
++	Use s6_addr32 to access bits in int6_addr instead of incompatible name
++
++
++
++iptables v1.4.0 Changelog
++======================================================================
++Changes from 1.4.0rc1:
++
++- Don't use dlfcn.h if NO_SHARED_LIBS is defined
++	[ Mike Frysinger ]
++
++- Fix showing help text for matches/targets with revision as user
++	[ Patrick McHardy ]
++
++- Print warnings to stderr
++	[ Max Kellermann ]
++
++- Fix sscanf type errors
++	[ Patrick McHardy ]
++
++- Always print mask in iptables-save
++	[ Jan Engelhardt ]
++
++- Don't silenty exit on failure to open /proc/net/{ip,ip6}_tables_names
++	[ Victor Stinner ]
++
++- Adds --table to iptables-restore
++	[ Peter Warasin ]
++
++- Make DO_MULTI=1 work for ip6tables* binaries
++	[ Hann-huei Chiou ]
++
++- Add ip6tables-{save,restore} to non-experimental target, fix strict aliasing
++warnings
++	[ Patrick McHardy ]
++
++- Introducing libxt_*.man files. Sorted matches and modules
++	[ Laszlo Attila Toth ]
++
++- Install ip6tables-{save,restore} manpages
++	[ Patrick McHardy ]
++
++- Performance optimization in sorting chain during pull-out
++	[ Jesper Dangaard Brouer ]
++
++- Fix sockfd use accounting for kernels without autoloading
++	[ Patrick McHardy ]
++
++- use <linux/types.h>
++	[ Jan Engelhardt ]
++
++- Fix make/compile error for iptables-1.4.0rc1
++	[ Jesper Dangaard Brouer ]
++
++- Fix for --random option in DNAT and REDIRECT
++	[ Tom Eastep ]
++
++- Document xt_statistic
++	[ Stefano Sabatini ]
++
++- sctp: fix - mistake to pass a pointer where array is required
++	[ Li Zefan ]
++
++- Fix connlimit output for inverted --connlimit-above: ! > is <=, not <
++	[ Patrick McHardy ]
++
++- Add NFLOG manpage
++	[ Patrick McHardy ]
++
++- Move libipt_DSCP.man to libxt_DSCP.man for ip6tables.8
++	[ Yasuyuki Kozakai ]
++
++- Unifies libip[6]t_CONNSECMARK.man to libxt_CONNSECMARK.man
++	[ Yasuyuki Kozakai ]
++
++- Moves libipt_CLASSYFY.man to libxt_CLASSYFY.man for ip6tables.8
++	[ Yasuyuki Kozakai ]
++
++- fix check_inverse() call
++	[ Jan Engelhardt ]
++
++- Bump version to 1.4.0 final
++	[ Pablo Neira Ayuso ]
++
++
++
++iptables v1.4.0rc1 Changelog
++======================================================================
++Changes from 1.3.8:
++
++- Add support for generic xtables infrastructure (improved IPv6 support!)
++	[ Yasuyuki Kozakai ]
++
++- Deletes empty ->final_check() functions
++	[ Jan Engelhardt ]
++
++- Fix sparse warnings: non-C99 array declaration, incorrect function prototypes
++	[ Patrick McHardy ]
++
++- Remove last vestiges of NFC
++	[ Peter Riley ]
++
++- Make @msg argument a const char *, just like printf
++	[ Jan Engelhardt ]
++
++- Makes it possible to omit extra_opts of matches/targets if unnecessary
++	[ Jan Engelhardt ]
++
++- Fix "iptables getsockopt failed strangely" when querying revisions for non-existant matches and targets
++	[ Patrick McHardy]
++
++- Introduces DEST_IPT_LIBDIR in Makefile
++	[ Yasuyuki Kozakai ]
++
++- Change default KERNEL_DIR location and add KBUILD_OUTPUT
++	[ Sven Wegener ]
++
++- Removes obsolete KERNEL_64_USERSPACE_32 definitions
++	[ Yasuyuki Kozakai ]
++
++- Fix unused function warning
++	[ Patrick McHardy ]
++
++
++
++iptables v1.3.8 Changelog
++======================================================================
++
++- Fix build error of conntrack match
++	[Yasuyuki Kozakai]
++
++- Remove whitespace in ip6tables.c
++	[Yasuyuki Kozakai]
++
++- `-p all' and `-p 0' should be allowed in ip6tables
++	[Yasuyuki Kozakai]
++
++- hashlimit doc update
++	[Jan Engelhardt]
++
++- add --random option to DNAT and REDIRECT
++	[Patrick McHardy]
++
++- Makefile uses POSIX conform directory check
++	[Roy Marples]
++
++- Fix missing newlines in iptables-save/restore output
++	[Pavol Rusnak]
++
++- Update quota manpage for SMP
++	[Phil Oester]
++
++- Output for unspecified proto is `all' instead of `0'
++	[Phil Oester]
++
++- Fix iptables-save with --random option
++	[Patrick McHardy]
++
++- Remove unnecessary IP_NAT_RANGE_PROTO_RANDOM ifdefs
++	[Patrick McHardy]
++
++- Remove libnsl from LDLIBS
++	[Patrick McHardy]
++
++- Fix problem with iptables-restore and quotes
++	[Pablo Neira Ayuso]
++
++- Remove unnecessary includes
++	[Patrick McHardy]
++
++- Fix --modprobe parameter
++	[Maurice van der Pot]
++
++- ip6tables-restore should output error of modprobe after failed to load
++	[Yasuyuki Kozakai]
++
++- Add random option to SNAT
++	[Eric Leblond]
++
++- Fix missing space in error message
++	[Patrick McHardy]
++
++- Fixes for manpages of tcp, udp, and icmp{,6}
++	[Yasuyuki Kozakai]
++
++- Add ip6tables mh extension
++	[Masahide Nakamura]
++
++- Fix tcpmss manpage
++	[Patrick McHardy]
++
++- Add ip6tables TCPMSS extension
++	[Arnaud Ebalard]
++
++- Add UDPLITE multiport support
++	[Patrick McHardy]
++
++- Fix missing space in ruleset listing
++	[Patrick McHardy]
++
++- Remove extensions for unmaintained/obsolete patchlets
++	[Patrick McHardy]
++
++- Fix greedy debug grep
++	[Patrick McHardy]
++
++- Fix type in manpage
++	[Thomas Aktaia]
++
++- Fix compile/install error for iptables-xml with DO_MULTI=1
++	[Lutz Jaenicke]
++
++
++
++iptables v1.3.7 Changelog
++======================================================================
++
++Bugs fixed since 1.3.6:
++
++- Fix compilation error with linux 2.6.19
++	[ Patrick McHardy ]
++
++- Fix LOG target segfault with --log-prefix ""
++	[ Mike Frysinger, Bugzilla #516 ]
++
++- Fix conflicting getsockopt optname values for IP6T_SO_GET_REVISION_{MATCH,TARGET}
++	[ Yasuyuki KOZAKAI ]
++
++- Fix -E (rename) in iptables/ip6tables
++	[ Krzysztof Piotr Oledzki ]
++
++- Fix /etc/network usage
++	[ Pablo Neira ]
++
++- Fix iptables-save not printing -s/-d ! 0/0
++	[ Patrick McHardy ]
++
++- Fix ip6tables-save unnecessarily printing -s/-d options for zero prefix length
++	[ Daniel De Graaf ]
++
++New features since 1.3.6:
++
++- Add revision support for ip6tables
++	[ R?mi Denis-Courmont ]
++
++- Add port range support for ip6tables multiport match
++	[ R?mi Denis-Courmont ]
++
++- Add sctp match extension for ip6tables
++	[ Patrick McHardy ]
++
++- Add iptables-xml tool
++	[ Amin Azez ]
++
++- Add hashlimit support for ip6tables (needs kernel > 2.6.19)
++	[ Patrick McHardy ]
++
++- Use /limodules/$(shell uname -r)/build instead of /usr/src/linux to look for kernel source
++	[ Patrick McHardy ]
++
++- Add NFLOG target extension for iptables/ip6tables (needs kernel > 2.6.19)
++	[ Patrick McHardy ]
++
++
++
++iptables v1.3.6 Changelog
++======================================================================
++
++Bugs fixed since 1.3.5:
++
++- Fix segfault on loading of invalid counters in ip[6]tables-restore
++	[ Bugzilla #437, Olaf Rempel ]
++
++- Fix double-free if a single match is used multiple times within a single rule
++	[ Bugzilla #440, Harald Welte ]
++
++- Don't try to resolve "-p all" using getprotoent()
++	[ Bugzilla #446, Harald Welte ]
++
++- Refuse never matching protocol specifications for ip6tables
++	[ Yasuyuki Kozakai ]
++
++- Fix iptables-save output of osf match
++	[ Daniel De Graaf ]
++
++- Fix esp/connbytes detection with newer kernels (x_tables)
++	[ Harald Welte ]
++
++- Fix loading of IPCMv6 match shared library
++	[ Yasuyuki Kozakai ]
++
++- Refuse invalid esp match SPI ranges
++	[ Yasuyuki Kozakai ]
++
++- Fix out-of-bounds memory access when the unsupported "check" command was used
++	[ Bugzilla #463, Larry Stefani, Harald Welte ]
++
++- Fix out-of-bounds memory access when the "-c" option was used
++	[ Bugzilla #462, Larry Stefani, Harald Welte ]
++
++- Fix "Unknown error 4294967295" message
++	[ Bugzilla #460, Patrick McHardy ]
++
++- Use lower-case letters for realm match output
++	[ Simon Lodal ]
++
++- Fix example in connlimit manpage
++	[ Phil Oester ]
++
++- Refuse IP addresses as arguments to REDIRECT target
++	[ Bugzilla #482, Phil Oester ]
++
++- Fix set match negation
++	[ Jozsef Kadlecsik ]
++
++- Fix some compiler warnings
++	[ Bugzilla #457, Phil Oester ]
++
++- Refuse port ranges in ip6tables multiport match
++	[ Bugzilla #451, Phil Oester ]
++
++- Force user to specify --ipcmv6-type if ipcmv6 match is used
++	[ Bugzilla #461, Yasuyuki Kozakai ]
++
++- Fix libiptc symbol clash
++	[ Bugzilla #456, Phil Oester ]
++
++- Remove "hoho" message
++	[ Pierre-Yves Ritschard ]
++
++- Handle CIDR notation more sanely
++	[ Bugzilla #422, Phil Oester ]
++
++- Fix chain reference increment bug
++	[ Jesper Brouer ]
++
++- Fix counter clearing for policy counters
++	[ Bugzilla #502, Andy Gay ]
++
++- Remove warnings about interface names with non-alphanumeric characters
++	[ Patrick McHardy ]
++
++New features since 1.3.5:
++
++- Support multiple matches of the same type within a single rule
++	[ Jozsef Kadlecsik ]
++
++- DCCP/SCTP support for multiport match (needs kernel >= 2.6.18)
++	[ Patrick McHardy ]
++
++- SELinux SECMARK target (needs kernel >= 2.6.18)
++	[ James Morris ]
++
++- SELinux CONNSECMARK target (needs kernel >= 2.6.18)
++	[ James Morris ]
++
++- Add documentation for DNAT target :<port> syntax
++	[ Evan Miller ]
++
++- Add new exit value to indicate concurrency issues
++	[ Jesper Dangaard Brouer ]
++
++- Use gcc to build shared objects
++	[ Bugzilla #454, Phil Oester ]
++
++- Update quota match for version in current kernel, fix -D (needs kernel >= 2.6.18)
++	[ Phil Oester ]
++
++- Update MARK target documentation to include --and-mask/--or-mask
++	[ Eric Leblond ]
++
++- Add support for statistic match (needs kernel >= 2.6.18)
++	[ Patrick McHardy ]
++
++- Optionally read realm values from /etc/iproute2/rt_realms
++	[ Simon Lodal ]
++
++iptables v1.3.5 Changelog
++======================================================================
++This version requires kernel >= 2.4.0
++This version recommends kernel >= 2.4.18
++
++Bugs fixed from 1.3.4:
++
++- Fix conntrack --ctproto option in iptables-save
++	[ Phil Oester ]
++
++- Fix string match '--from' option in iptables-save
++	[ Michael Rash ]
++
++- Fix option parser of ttl match
++	[ Patrick McHardy ]
++
++- Get rid of gcc-4 warnings
++	[ Patrick McHardy ]
++
++- Fix spelling of 'address' in DNAT/SNAT manpage section
++	[ MJ Anthony ]
++
++- Fix 'tcp-rst' parsing in REJECT target
++	[ Torsten Hilbrich ]
++
++- Fix probing for supported revisions
++	[ Jones Desougi ]
++
++- Fix compilation of iptables on [old] systems that don't have IPT_F_GOTO
++	[ Harald Welte ]
++
++- Only set revisions on real targets, not on jumps
++	[ Pablo Neira ]
++
++- Fix memory leak in TC_COMMIT() of libiptc
++	[ Markus Sundberg ]
++
++- Correctly propagate errors of setsockopt to calling function
++	[ Harald Welte ]
++
++- Fix connbytes match iptables-save
++	[ Unknown ]
++
++- Fix sctp match compilation against recent kernel headers
++	[ Harald Welte ]
++
++- Fix conntrack match compilation against 2.4.0 kernel headers
++	[ Harald Welte ]
++
++Changes from 1.3.4:
++
++- Add support for ip6tables connmark match and target
++	[ Harald Welte ]
++
++- Add support for ip6tables state match
++	[ Harald Welte ]
++
++- Add support for new policy ip[6]tables match
++	[ Patrick McHardy ]
++
++- Major manpage update
++	[ Yasuyuki Kozakai ]
++
++- Remove ippool support, it has been deprecated by ipset long time ago
++	[ Harald Welte ]
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic-ng/snapshot)
++
++
++iptables v1.3.4 Changelog
++======================================================================
++This version requires kernel >= 2.4.0
++This version recommends kernel >= 2.4.18
++
++Bugs fixed from 1.3.3:
++
++- Fix parsing of NFQUEUE queue numbers
++	[ Eric Leblond ]
++
++- Add documentation of --queue-num parameter to NFQUEUE manpage
++	[ Eric Leblond ]
++
++- Fix 'hash-init' parameter of CLUSTERIP target
++	[ KOVACS Krisztian ]
++
++- Fix CONNMARK match and target: Marks are now always 32bit
++	[ Deti Fliegl ]
++
++- Print error message when multiple "--to" DNAT/SNAT args are used
++	with kernel >= 2.6.10
++		[ Phil Oester ]
++
++- Fix compilation of connbytes match with 2.6.14 kernel
++	[ Harald Welte ]
++
++- Fix address inversion of conntrack match
++	[ Tom Eastep ]
++
++- Fix sorting of chain names
++	[ Robert de Barth ]
++
++Changes from 1.3.2:
++
++- Add support for DCCP port and type matching
++	[ Harald Welte ]
++
++- Add support for new in-kernel string match
++	[ Pablo Neira ]
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic-ng/snapshot)
++
++
++iptables v1.3.3 Changelog
++======================================================================
++This version requires kernel >= 2.4.0
++This version recommends kernel >= 2.4.18
++
++Bugs fixed from 1.3.2:
++
++- Fix use-after-free in merge_options()
++	[ Markus Sundberg ]
++
++- Fix support for SNAT and DNAT to ICMP ID ranges
++	[ Patrick McHardy ]
++
++Changes from 1.3.2:
++
++- Add support for new NFQUEUE targets for IPv4 and IPv6
++	[ Harald Welte ]
++
++- Minor manpage updates
++	[ Harald Welte ]
++
++- Fix numberous gcc-4 warnings throughout the code
++	[ Harald Welte ]
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic-ng/snapshot)
++
++
++iptables v1.3.2 Changelog
++======================================================================
++This version requires kernel >= 2.4.0
++This version recommends kernel >= 2.4.18
++
++Bugs fixed from 1.3.1:
++
++- Fix TCPLAG version
++	[ Torsten Luettgert ]
++
++- More error checking in SET target
++	[ Michal Pokrywka ]
++
++- Fix optflags value for OPT_LINENUMBERS
++	[ Jonas Berlin ]
++
++- Allow NULL init function in ip6tables plugins
++	[ Jonas Berlin ]
++
++- Don't allow newlines in LOG prefix
++	[ Phil Oester ]
++
++- Introduce ip_conntrack_old_tuple to userspace header copy
++	[ Pablo Neira ]
++
++- Fix connbytes command line parsing bug
++	[ Piotrek Kaczmarek ]
++
++- Ignore unknown arguments in libipt_ULOG
++	[ Patrick McHardy ]
++
++- Correct error in multiport manpage wrt. "--ports"
++	[ Rusty Russell ]
++
++- Fix CONNMARK save/restore
++	[ Tom Eastep, Pawel Sikora ]
++
++- Make sure chain name doesn't start with '!'
++	[ Yasuyuki Kozakai ]
++
++- Prevent user to specify negative ports in SNAT/DNAT
++	[ Yasuyuki Kozakai ]
++
++- Fix deletion of targets where kernel size != userspace size
++	[ Pablo Neira ]
++
++- Fix save/restore of '! --uid-owner squid' problem in ip6t_owner
++	[ Harald Welte ]
++
++Changes from 1.3.1:
++
++- Add ``--log-uid'' option to ip6t_LOG target
++	[ Patrick McHardy ]
++
++- Improve REDIRECT manpage
++	[ Jonas Berlin ]
++
++- Add a number of missing manpage snippets
++	[ Jonas Berlin ]
++
++- Include FIN bit in mask of "--syn" bits
++	[ Harald Welte ]
++
++- Release previously merged options from merge_opts(), reduces memory-usage of
++	ipt ables-restore dramatically
++	[ Pablo Neira ]
++
++- OSF: changes to support connector notifications
++	[ Evgeniy Polyakov ]
++
++- Reduce code replication of parse_interface()
++	[ Yasuyuki Kozakai ]
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic-ng/snapshot)
++
++
++iptables v1.3.1 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs fixed from 1.3.0:
++
++- Fix CLUSTERIP rule deletion
++	[ Pablo Neira ]
++
++- Fix libip6t_random compilation
++	[ Harald Welte ]
++
++- Fix CONNMARK on 32bit userspace / 64bit kernel archs
++	[ Pablo Neira ]
++
++Changes from 1.3.0:
++
++- remove bogus NFC_* stuff in iptables
++	[ Pablo Neira ]
++
++- libiptc: don't sort builtin chains, restores iptables-1.2.x sort order
++	[ Olaf Rempel ]
++
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic-ng/snapshot)
++
++
++iptables v1.3.0 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs fixed from 1.3.0rc1:
++
++- Fix realm match save/restore issue
++	[ Harald Welte ]
++
++- Fix hashlimit rule deletion from userspace
++	[ Samuel Jean ]
++
++- Fix hashlimit parameter handling / iptables-save
++	[ Nikolai Malykh ]
++
++- Fix multiport inversion
++	[ Phil Oester ]
++
++Bugs fixed from 1.2.11:
++
++- Fix compilation on systems where /bin/sh != bash
++	[ Jozsef Kadlecsik ]
++
++- Fix setting lib_dir in ip*tables-{save,restore}
++	[ Martin Josefsson ]
++
++- Fix module-autoloading in certain cases
++	[ Harald Welte ]
++
++- libipt_TTL: limit range of valid TTL to 0-255
++	[ Maciej Soltysiak ]
++
++- libip6t_HL: limit range of valid HL to 0-255
++	[ Maciej Soltysiak ]
++
++- libip{6}t_limit: Fix half-working limit invert check
++	[ Phil Oester ]
++
++- libipt_connbytes: Update to use the IP_CONNTRACK_ACCT counters
++	[ Harald Welte ]
++
++- libipt_conntrack: Fix typo
++	[ Phil Oester ]
++
++- libipt_dstlimit: Fix half-working invert check
++	[ Phil Oester ]
++
++- libipt_helper: Prevent user from using --helper multiple times
++	[ Nicolas Bouliane ]
++
++- libipt_iprange: Print error message if --dst-range used twice
++	[ Nicolas Bouliane ]
++
++- libipt_nth: Fix help message syntax
++	[ Harald Welte ]
++
++- libipt_psd: Fix option parsing
++	[ Pablo Neira ]
++
++- libipt_random: Fix help message syntax
++	[ Harald Welte ]
++
++- libipt_realm: Fix inversion of options
++	[ Simon Lodal ]
++
++- libipt_time: Fix C++ style delayed variable definition
++	[ Olivier Clerget ]
++
++- libipt_time: Print message about time match not adhering daylight saving
++	[ Phil Oester ]
++
++- libipt_tos: Print Error message if --tos is specified twice
++	[ Nicolas Bouliane ]
++
++- libipt_ttl: Cleanup ttl option parsing
++	[ Phil Oester ]
++
++- libipt_u32: Fix option parsing
++	[ Piotr Gasid'o ]
++
++
++Changes from 1.2.11:
++
++- libiptc: complete rewrite for performance reasons
++	[ Harald Welte, Martin Josefsson ]
++
++- introduce "DO_MULTI=1" mode to build a muilti-call binary
++	[ Bastiaan Bakker ]
++
++- code cleanup, use C99 initializers
++	[ Harald Welte, Pablo Neira ]
++
++- Extension revision number support (if kernel supports the getsockopts).
++	[ Rusty Russell ]
++
++- Don't need ipt_entry_target()/ip6t_entry_target().
++	[ Rusty Russell ]
++
++- Don't re-initialize libiptc/libip6t unless modprobe attempt succeeds.
++	[ Rusty Russell ]
++
++- Implement IPTABLES_LIB_DIR and IP6TABLES_LIB_DIR environment variables
++	[ Rusty Russell ]
++
++- Add manpage section about 'raw' table
++	[ Harald Welte ]
++
++
++- libip{6}t_ROUTE: add ROUTE --tee mode
++	[ Patrick Schaaf ]
++
++- libip{6}t_multiport: Print Error message when `!' is used
++	[ Patrick McHardy, Phil Oester ]
++
++- New libip6t_physdev Match
++	[ Bart De Schuymer ]
++
++- libipt_CLUSTERIP: Fix compiler warning about const
++	[ Harald Welte ]
++
++- libipt_DNAT: Print Error message if `:' is used for port range
++- libipt_SNAT: Print Error message if `:' is used for port range
++	[ Phil Oester ]
++
++- libipt_LOG: Add --log-uid option
++	[ John Lange ]
++
++- libipt_MARK: add bitwise operators
++	[ Henrik Nordstrom, Rusty Russell ]
++
++- libipt_SET: Update to ipset2
++	[ Jozsef Kadlecsik ]
++
++- libipt_account: Update to 0.1.16
++	[ Piotr Gasid'o ]
++
++- New libipt_comment Match
++	[ Brad Fisher ]
++
++- New libipt_hashlimit Match, supersedes dstlimit
++	[ Harald Welte ]
++
++- libipt_ttl: Use string_to_number()
++	[ Rusty Russell ]
++
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic-ng/snapshot)
++
++
++iptables v1.2.11 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++
++Bugx Fixed from 1.2.10:
++
++- fix compilation on systems where /bin/sh != bash
++	[ Jozsef Kadlecsik ]
++
++Bugs Fixed from 1.2.9:
++
++- physdev match: fix new structure layout for kernel > 2.6.0-test8
++	[ Bart De Schuymer ]
++
++- Better 64bit / 32bit split architecture detection
++- IPv6 LOG target: Fix compiler warnings on 64bit
++- LOG target: Fix compiler warnings on 64bit
++- IPv6 MARK target: Use full 64bit mark on 64bit archs
++- MARK target: Use full 64bit mark on 64bit archs
++- SAME target: Fix 64bit/32bit splitarch problems
++- ULOG target: Fix 64bit/32bit splitarch problems
++- conntrack match: Fix 64bit/32bit splitarch problem
++- IPv6 limit match: Fix 64bit/32bit splitarch problem
++- limit match: Fix 64bit/32bit splitarch problem
++- IPv6 mark match: Use full 64bit mark on 64bit archs
++- mark match: Use full 64bit mark on 64bit archs
++- owner match: Fix compiler warnings on 64bit
++	[ Martin Jofsefsson ]
++
++- connbytes match: Fix signedness / unsigned issue
++	[ Martin Josefsson ]
++
++- connlimit match: Fix '/0' netmask
++	[ David Ahern ]
++
++- ipv6 owner match: fix possibly not zero terminated string
++- helper match: fix possibly not zero terminated string
++- recent match: fix possibly not zero terminated string
++	[ Karsten Desler ]
++
++- ICMP match: fix '--icmp-type any' case
++	[ Harald Welte ]
++
++- CONNMARK target: major update (add mark/mask matching)
++	[ Henrik Nordstrom ]
++
++- DSCP target: Fix cosmetic help message problem
++	[ Maciej Soltysiak ]
++
++- string match: Fix iptables-save/restore for ascii strings with spaces
++	[ Michael Rash ]
++
++- ip(6)tables-restore: Make sure matches are used in the same order
++	[ Martin Josefsson ]
++
++- ip(6)tables-restore: Fix '--verbose' option
++- ip(6)tables-restore: Add '--test' option
++- ip(6)tables-restore: Complain about missing 'COMMIT'
++	[ Martin Josefsson ]
++
++- ip(6)tables-restore: Allow embedding of quote character in quoted strings
++	[ Michael Rash ]
++
++- libipq: Protect against spoofed queue messages (check if sender is kernel)
++	[ Harald Welte ]
++
++
++Changes from 1.2.9:
++
++- time match: add 'datestart' and 'datestop' parameters
++	[ Fabrice Marie ]
++
++- modular manpage build, depending on actually compiled-in features
++	[ Henrik Nordstrom ]
++
++- additional documentation in manpage snippets formerly missing
++	[ Harald Welte ]
++
++- support new CLUSTERIP Target
++	[ Harald Welte ]
++
++- support new account match
++	[ Piotr Gasid'o ]
++
++- support new connrate match
++	[ Nuuti Kotivuori ]
++
++- support new dstlimit match
++	[ Harald Welte ]
++
++- support new 'set' match / 'SET' target
++	[ Jozsef Kadlecsik ]
++
++- osf match: add support for netlink reporting
++	[ Evgeniy Polyakov ]
++
++- new SCTP protocol match
++	[ Kiran Kumar ]
++
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic/)
++
++Please also note: Since Kernel 2.6.x is out, we now use patch-o-matic-ng,
++distributed as seperate package: (ftp://ftp.netfilter.org/pupatch-o-matic-ng)
++
++
++iptables v1.2.10 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs Fixed from 1.2.9:
++
++- physdev match: fix new structure layout for kernel > 2.6.0-test8
++	[ Bart De Schuymer ]
++
++- Better 64bit / 32bit split architecture detection
++- IPv6 LOG target: Fix compiler warnings on 64bit
++- LOG target: Fix compiler warnings on 64bit
++- IPv6 MARK target: Use full 64bit mark on 64bit archs
++- MARK target: Use full 64bit mark on 64bit archs
++- SAME target: Fix 64bit/32bit splitarch problems
++- ULOG target: Fix 64bit/32bit splitarch problems
++- conntrack match: Fix 64bit/32bit splitarch problem
++- IPv6 limit match: Fix 64bit/32bit splitarch problem
++- limit match: Fix 64bit/32bit splitarch problem
++- IPv6 mark match: Use full 64bit mark on 64bit archs
++- mark match: Use full 64bit mark on 64bit archs
++- owner match: Fix compiler warnings on 64bit
++	[ Martin Jofsefsson ]
++
++- connbytes match: Fix signedness / unsigned issue
++	[ Martin Josefsson ]
++
++- connlimit match: Fix '/0' netmask
++	[ David Ahern ]
++
++- ipv6 owner match: fix possibly not zero terminated string
++- helper match: fix possibly not zero terminated string
++- recent match: fix possibly not zero terminated string
++	[ Karsten Desler ]
++
++- ICMP match: fix '--icmp-type any' case
++	[ Harald Welte ]
++
++- CONNMARK target: major update (add mark/mask matching)
++	[ Henrik Nordstrom ]
++
++- DSCP target: Fix cosmetic help message problem
++	[ Maciej Soltysiak ]
++
++- string match: Fix iptables-save/restore for ascii strings with spaces
++	[ Michael Rash ]
++
++- ip(6)tables-restore: Make sure matches are used in the same order
++	[ Martin Josefsson ]
++
++- ip(6)tables-restore: Fix '--verbose' option
++- ip(6)tables-restore: Add '--test' option
++- ip(6)tables-restore: Complain about missing 'COMMIT'
++	[ Martin Josefsson ]
++
++- ip(6)tables-restore: Allow embedding of quote character in quoted strings
++	[ Michael Rash ]
++
++- libipq: Protect against spoofed queue messages (check if sender is kernel)
++	[ Harald Welte ]
++
++
++Changes from 1.2.9:
++
++- time match: add 'datestart' and 'datestop' parameters
++	[ Fabrice Marie ]
++
++- modular manpage build, depending on actually compiled-in features
++	[ Henrik Nordstrom ]
++
++- additional documentation in manpage snippets formerly missing
++	[ Harald Welte ]
++
++- support new CLUSTERIP Target
++	[ Harald Welte ]
++
++- support new account match
++	[ Piotr Gasid'o ]
++
++- support new connrate match
++	[ Nuuti Kotivuori ]
++
++- support new dstlimit match
++	[ Harald Welte ]
++
++- support new 'set' match / 'SET' target
++	[ Jozsef Kadlecsik ]
++
++- osf match: add support for netlink reporting
++	[ Evgeniy Polyakov ]
++
++- new SCTP protocol match
++	[ Kiran Kumar ]
++
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic/)
++
++Please also note: Since Kernel 2.6.x is out, we now use patch-o-matic-ng,
++distributed as seperate package: (ftp://ftp.netfilter.org/pupatch-o-matic-ng)
++
++
++iptables v1.2.9 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs Fixed from 1.2.8:
++
++- ip(6)tables-save/restore: fix memory leaks
++	[ Harald Welte, Martin Josefsson ]
++- ip6tables: fix printout of odd length netmasks
++	[ Mikko Markus Torni ]
++- condition match: fix iptables-save
++	[ Stephane Ouellette ]
++- fuzzy match: fix ip(6)tables-save
++	[ Hime Aguiar e Oliveira Jr. ]
++- mac match: fix ip(6)tables-save if used inverted (!)
++	[ David Zambonini, Martin Josefsson ]
++- ip6tables udp match: check for invalid port ranges
++	[ Thomas Poehnitz ]
++- LOG target: fix iptables-save (save loglevel numerically)
++	[ Thomas Woerner ]
++- mport match: fix iptables-save (save numerically)
++	[ Thomas Woerner ]
++- libipq: fix ipq_id_t definition on 'real' 64bit/64bit architectures
++	[ Ryan Veety ]
++- libip6tc: fix ipv6_prefix_length endianness bugs
++	[ Mikko Markus Torni ]
++- MASQUERADE target: don't accept negative port numbers
++	[ Yasuyuki Kozakai ]
++- physdev match: fix new structure layout for kernel > 2.6.0-test8
++	[ Bart De Schuymer ]
++
++Changes from 1.2.8:
++
++- build plugins for connlimit, iprange, realm, CLASSIFY, CONNMARK, NETMAP
++	[ Harald Welte ]
++- libip(6)tc: Speedup due to inceremental chain cache updates
++	[ Harald Welte ]
++- recent match: Update to version 0.3.1 that was submitted to the kernel
++	[ Stephen Frost ]
++- physdev match: add --physdev-is-{in,out,bridge} option
++	[ Bart de Schuymer ]
++- REJECT target: add support for ICMP administratively prohibited
++	[ Maciej Soltysiak ]
++- conntrack match: add suport for CONFIRMED / unconfirmed state
++	[ Harald Welte ]
++- ROUTE target: new option: continue traversal
++	[ Cedric de Launois ]
++- varios cosmetic cleanups
++	[ Stephane Ouellette ]
++- iptables/libiptc: add support for the new 'raw' table
++	[ Jozsef Kadlecsik ]
++
++Please note: Since version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic/)
++
++
++iptables v1.2.8 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs Fixed from 1.2.7a:
++
++- fix ip6tables-save function of 'length' match
++	[ Gerry Skerbitz ]
++- fix ip6tables-save function of 'mac' match
++	[ Kristian Gronfeldt Sorensen ]
++- fix iptables-save function of 'ULOG' target
++	[ Jimmy Hedman ]
++- fix iptables-save function of 'conntrack' match
++	[ Lutz Pressler ]
++- fix iptables-save function of 'length' match
++	[ Gerry Skerbitz ]
++- fix iptables-save function of 'mac' match
++	[ Kristian Gronfeldt Sorense ]
++- fix iptables-save function of 'mark' match
++	[ Harald Welte ]
++- fix iptables-save function of 'owner' match
++	[ Costa Tsaousis ]
++- fix iptables-save function of 'pool' match
++	[ Oskar Berggren ]
++- fix iptables-save function of 'tcpmss' match
++	[ Michael Schwendt ]
++- fix iptables-save function of 'tos' match
++	[ Harald Welte ]
++- fix save/print function of 'connmark' match
++	[ Harald Welte ]
++- fix error message when invalid TCP flag is specified with 'tcp' match
++	[ Aaron Sethman ]
++
++Changes from 1.2.7a:
++
++- updated version of the ROUTE target
++	[ Cedric de Launois ]
++- updated version of the 'recent' match
++	[ Stephen Frost ]
++- update the RPC conntrack match, extend it to support filtering on procedures
++	[ Ian (Larry) Latter ]
++- add support for hexstrings to the 'string' match
++	[ Michael Rash ]
++- have iptables-restore print the line number in case of an error
++	[ Illes Marci ]
++- big iptables.8 manpage update
++	[ Herve Eychenne ]
++- print loglevel human-readable in ip6tables 'LOG' target
++	[ Michael Schwendt ]
++- print loglevel human-readable in 'LOG' target
++	[ Michael Schwendt ]
++- remove bogus code from 'ecn' match
++	[ Stephane Ouellette ]
++- be more specific in help message of 'helper' match
++	[ Herve Eychenne ]
++- fix semantic problem that '-p icmp -m icmp' was matching icmp type 0 instead
++	of 'any'
++	[ Harald Welte ]
++- fix iptables rename-chain option
++	[ Maciej Soltysiak ]
++- remove libipulog from iptables since it is distributed with ulogd
++	[ Harald Welte ]
++- support new ip6tables 'HL' target
++	[ Maciej Soltysiak ]
++- support new ip6tables 'condition' match
++	[ Stephane Ouellette ]
++- support new ip6tables 'fuzzy' match
++	[ Maciej Soltysiak ]
++- support new ip6tables 'hoplimit' match
++	[ Maciej Soltysiak ]
++- support new iptables 'CLASSIFY' target
++	[ unknown ]
++- support new iptables TARPIT target
++	[ Aaron Hopkins ]
++- support new iptables 'condition' match
++	[ Stephane Ouellette ]
++- support new iptables 'fuzzy' match
++	[ Hime Junior ]
++- support new iptables 'physdev' match (for 2.5.x bridging)
++	[ Bart de Schumyer ]
++- support new iptables 'u32' match (based on u32 tc filter)
++	[ Don Cohen ]
++
++Please note: As of version 1.2.7a, patch-o-matic is now no longer part of
++iptables but rather distributed as a seperate package
++(ftp://ftp.netfilter.org/pupatch-o-matic/)
++
++
++iptables v1.2.7a (== fixed 1.2.7) Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs Fixed from 1.2.6a:
++
++- fix compiler warning in userspace support for ipv6 REJECT target
++	[ Fabrice Marie ]
++- check for invalid portranges in tcp+udp helper (e.g. 2000:100)
++	[ Thomas Poehnitz ]
++- fix save save/restore functions of ip6tables tcp/udp extension
++	[ Harald Welte / Andras Kis-Szabo ]
++- check for invalid (out of range) nfmark values in MARK target
++	[ Alexey ??? ]
++- fix save function of MASQUERADE userspace support
++	[ A. van Schie ]
++- compile fixes for userspace suppot of experimental POOL target
++	[ ? ]
++- fix save function of userspace support for ah and esp match
++	[ ? ]
++- fix static build (NO_SHARED_LIBS)
++	[ Roberto Nibali ]
++- fix save/restore function of userspace support for mport match
++	[ Bob Hockney ]
++- update manpages to reflect recent changes
++	[ Herve Eychenne, Harald Welte ]
++- remove all remnants of the 'check' option
++	[ ? ]
++
++
++Changes from 1.2.6a:
++
++- patch-o-matic is now no longer part of iptables but rather distributed
++	as a seperate package (ftp://ftp.netfilter.org/pupatch-o-matic/)
++		[ Harald Welte ]
++- userspace support for dscp match and target
++	[ Harald Welte ]
++- userspace supprot for ecn match and target
++	[ Harald Welte ]
++- userspace support for helper match
++	[ Martin Josefsson ]
++- userspace supprot for conntrack match
++	[ Marc Boucher ]
++- userspace support for pkttype match
++	[ Martin Ludvig ]
++- userspace support for experimental ROUTE target
++	[ Cdric de Launois ]
++- userspace support for experimental ipv6 ahesp match
++	[ Andras Kis-Szabo ]
++- userspace support for experimental ipv6 option header match
++	[ Andras Kis-Szabo ]
++- userspace support for experimental ipv6 routing header match
++	[ Andras Kis-Szabo ]
++- add matching of process name to userspace support of owner match
++	[ Marc Boucher ]
++- new version of userspace support for 'recent' match
++	[ Stephen Frost ]
++
++
++iptables v1.2.6a (== fixed 1.2.6) Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs Fixed from 1.2.5:
++
++- Fix iptables segfault problem when using `!' without argument
++	[ Dionis Papavramidis, Harald Welte ]
++- Fix PSD match for psd-delay-threshold > 100
++	[ Steven Coenen, Dennis Koslowski ]
++- ip6tables alignment fixes
++	[ Andreas Herrmann ]
++- patch-o-matic:
++	- Fix NAT-related bug in TCP window tracking code
++		[ Jozsef Kadlecsik ]
++	- Fix support for DNAT of locally-originated connections (NAT in
++	  LOCAL_OUT)
++	  	[ Henrik Nordstrom, Harald Welte ]
++	- Fix string match (is now SMP safe)
++		[ Gianni Tedesco ]
++	- Fix TFTP conntrack/nat helper (now also catches first packet)
++		[ Magnus Boden ]
++
++Changes from 1.2.5:
++
++- Added global PREFIX makefile variable for all paths
++	[ Harald Welte ]
++- If compiled without any COPT_FLAGS, debugging is disabled.  To enable
++	debugging, use -DIPTC_DEBUG
++		[ Harald Welte ]
++- New ip6tables-restore and ip6tables-save manpage
++	[ Andras Kis-Szabo ]
++- Sync ip6tables-restore and ip6tables-save with iptables-restore
++	[ Andras Kis-Szabo ]
++- Sync ip6tables with iptables
++	[ Andras Kis-Szabo ]
++- mangle table attaches now to all five netfilter hooks
++	[ Brad Chapman, Harald Welte ]
++- iptables and ip6tables manpage updates
++	[ Herve Eychenne ]
++- patch-o-matic program now supports removal of already-applied patches
++	[ Bob Hockney ]
++- patch-o-matic program now supports patches to the userspace extensions
++	[ Fabrice Marie ]
++- patch-o-matic:
++	- Extend recent match to support multiple recent lists
++		[ Stephen Frost ]
++	- New GRE and PPTP connection tracking and NAT helper
++		[ Harald Welte ]
++	- New CONNMARK target for marking all packets within one connection
++		[ Henrik Nordstrom ]
++	- New conntrack match, enables matching on more conntrack informatin
++	  than state
++	  	[ Marc Boucher ]
++	- New DSCP match and target (DSCP header field obsoletes TOS)
++		[ Harald Welte ]
++	- New owner match extension: Match on process name
++		[ Marc Boucher ]
++	- Add support for bitwise AND / OR manipulation on nfmark
++		[ Fabrice Marie ]
++	- New experimental patch for disabling TCP connection tracking pickup
++		[ Harald Welte ]
++	- Add support for SACK in all NAT helpers
++		[ Harald Welte ]
++	- Make eggdrop botnet connection tracking support work with eggdrop
++	  v1.6.x
++	  	[ Magnus Sandin ]
++	- Add support to REJECT for sending icmp-unreachable messages
++	  from a fake source address
++	  	[ Fabrice Marie ]
++	- Add support for ntalk2 to talk NAT helper
++		[ Jozsef Kadlecsik ]
++	- Big update to newnat patch
++		[ Jozsef Kadlecsik, Paul P Komkoff ]
++
++iptables v1.2.6 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel >= 2.4.18
++
++Bugs Fixed from 1.2.5:
++
++- Fix iptables segfault problem when using `!' without argument
++	[ Dionis Papavramidis, Harald Welte ]
++- Fix PSD match for psd-delay-threshold > 100
++	[ Steven Coenen, Dennis Koslowski ]
++- ip6tables alignment fixes
++	[ Andreas Herrmann ]
++- patch-o-matic:
++	- Fix NAT-related bug in TCP window tracking code
++		[ Jozsef Kadlecsik ]
++	- Fix support for DNAT of locally-originated connections (NAT in
++	  LOCAL_OUT)
++	  	[ Henrik Nordstrom, Harald Welte ]
++	- Fix string match (is now SMP safe)
++		[ Gianni Tedesco ]
++	- Fix TFTP conntrack/nat helper (now also catches first packet)
++		[ Magnus Boden ]
++
++Changes from 1.2.5:
++
++- Added global PREFIX makefile variable for all paths
++	[ Harald Welte ]
++- If compiled without any COPT_FLAGS, debugging is disabled.  To enable
++	debugging, use -DIPTC_DEBUG
++		[ Harald Welte ]
++- New ip6tables-restore and ip6tables-save manpage
++	[ Andras Kis-Szabo ]
++- Sync ip6tables-restore and ip6tables-save with iptables-restore
++	[ Andras Kis-Szabo ]
++- Sync ip6tables with iptables
++	[ Andras Kis-Szabo ]
++- mangle table attaches now to all five netfilter hooks
++	[ Brad Chapman, Harald Welte ]
++- iptables and ip6tables manpage updates
++	[ Herve Eychenne ]
++- patch-o-matic program now supports removal of already-applied patches
++	[ Bob Hockney ]
++- patch-o-matic program now supports patches to the userspace extensions
++	[ Fabrice Marie ]
++- patch-o-matic:
++	- Extend recent match to support multiple recent lists
++		[ Stephen Frost ]
++	- New GRE and PPTP connection tracking and NAT helper
++		[ Harald Welte ]
++	- New CONNMARK target for marking all packets within one connection
++		[ Henrik Nordstrom ]
++	- New conntrack match, enables matching on more conntrack informatin
++	  than state
++	  	[ Marc Boucher ]
++	- New DSCP match and target (DSCP header field obsoletes TOS)
++		[ Harald Welte ]
++	- New owner match extension: Match on process name
++		[ Marc Boucher ]
++	- Add support for bitwise AND / OR manipulation on nfmark
++		[ Fabrice Marie ]
++	- New experimental patch for disabling TCP connection tracking pickup
++		[ Harald Welte ]
++	- Add support for SACK in all NAT helpers
++		[ Harald Welte ]
++	- Make eggdrop botnet connection tracking support work with eggdrop
++	  v1.6.x
++	  	[ Magnus Sandin ]
++	- Add support to REJECT for sending icmp-unreachable messages
++	  from a fake source address
++			[ Fabrice Marie ]
++	- Add support for ntalk2 to talk NAT helper
++		[ Jozsef Kadlecsik ]
++	- Big update to newnat patch
++		[ Jozsef Kadlecsik, Paul P Komkoff ]
++
++
++iptables v1.2.5 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel > 2.4.14
++
++Bugs Fixed from 1.2.4:
++
++- make iptables-restore accept --table as well as -t option
++	[ Andreas Ferber ]
++- make iptables-restore -v / --verbose option work
++	[ Marc Boucher ]
++- fix iptables-save problems with saving "ppp+" style interface wildcards
++	[ Harald Welte ]
++- make iptables accept '_' and '.' in interface names
++	[ Harald Welte ]
++- Kernel bugfixes in patch-o-matic:
++	 - Fix IRC NAT srcaddr fix (we used to nat DCC connectios to the
++	   address of the IRC server
++		[ Bob Hockney ]
++	- Fix potential Oops in TOS target module
++		[ Edward Killips ]
++	- Fix problem when raw socket has cloned skb while netfilter doing
++	  payload modification
++		 [ Rusty Russell ]
++	- Fix memory leak in ipchains redirect code
++		[ Rusty Russell ]
++	- Fix reintroduced ECN problem with unclean match
++		[ Guillaume Morin ]
++	- Fix MAC adress match problem with small udp packets
++		[ Harald Welte ]
++
++Changes from 1.2.4:
++
++- Whole patch-o-matic system restructured - now supports multiple patch
++	repositories (submitted, pending, base, extra, newnat).
++	[ Jozsef Kadlecsik ]
++- Add IPv6 support to the QUEUE target and libipq
++	[ Fernando Anton / James Morris ]
++- New patch-o-matic patches:
++	-New IPV4OPTSSTRIP target to strip IP options
++		[ Fabrice Marie ]
++	- New ipv6header match to match IPv6 header options
++		[ Brad Chapman / Andras Kis-Szabo ]
++	- New helper match to match RELATED connections on their conntrack
++		helper
++		[ Martin Josefsson ]
++	- New quota match to have fixed IP quotas
++		[ Sam Johnston ]
++	- New recent match to match recently seen packets
++		[ Stephen Frost ]
++
++
++iptables v1.2.4 Changelog
++======================================================================
++This version requires kernel >= 2.4.4
++This version recommends kernel > 2.4.9
++
++Bugs Fixed from 1.2.3:
++
++- make iptables-restore print error message instead of segfault when
++	processing broken / wrong input.
++	[ ]
++- string_to_number fix in LOG, IPv6 LOG, TOS and FTOS target
++	[ ]
++- fix iptables-save problems when saving MIRROR rules
++	[ Harald Welte ]
++- fix IPv6 ICMP problems [ ]
++- fix TTL increment in TTL target [ ]
++- Kernel bugfixes in patch-o-matic:
++	- Fix printing of inner-packet in ICMP error messages (LOG target)
++		[ ]
++	- Decrement TTL when using MIRROR target at PRE_ROUTING [ ]
++	- fix undiscovered REJECT checkentry() bug (alignment)
++	    [ Bert Hubert]
++
++Changes from 1.2.3:
++
++- New "make most-of-pom" feature for application of non-confliction
++	patches. This should be used instead of "make patch-o-matic" by most
++	users.
++	[ Harald Welte ]
++- iptables-save and iptables-restore now included in the default install;
++	They are n	- longer experimental for quite some time.
++	[ Harald Welte ]
++- synchronize ip6tables-save/restore with iptables-save/restore
++	[ Harald Welte ]
++- more precise save() function for ipt_limit rates
++	[ ]
++- new improved version of nth-match. Added support for multiple counters,
++	added support for matching on individual packets in the counter cycle
++	[ Richard Wagner ]
++- added manpage for ip6tables
++	[ ]
++- updated libipq documentation
++	[ ]
++- added timeout t	- libipq recv function
++	[ ]
++- New patch-o-matic patches:
++	- New random match
++		[ ]
++	- New ftp-fxp patch, imposes security risk but some people need it -sigh*
++		[ Magnus Sandin ]
++	- New H323 conntrack + nat modules
++		[ Jozsef Kadlecsik ]
++	- New version of tcp-window tracking patch, includes sysctl()
++		changeable timeouts
++		[ Jozsef Kadlecsik ]
++
++
++iptables v1.2.3 Changelog
++======================================================================
++This version requires kernel 2.4.4 or above.
++This version recommends kernel 2.4.9 or above.
++
++Bugs Fixed from 1.2.2:
++
++- fix ICMPv6 support for IPv6
++	[ Kis-Szab	- Andras ]
++- fix problems with REJECT and iptables-restore / iptables-save
++	[ Harald Welte ]
++- fix possible string overflow in psd match
++	[ Dennis Koslowski ]
++- fix string match compile problems
++	[ Gianni Tedesc	- ]
++- support interfaces with '_' (underscore) in device names
++	[ Harald Welte ]
++- support rules without target in iptables-save
++	[ Emmanuel Fleury ]
++- correct handling of "eth+" type interface names in iptables-save/restore
++	[ Harald Welte ]
++- d	- incremental checksumming when altering TTL in TTL target
++	[ Harald Welte ]
++- fix no-srr case in ipv4options match
++	[ Fabrice Marie ]
++- Kernel bugfixes in patch-o-matic:
++	- Fix unexported ip6_table symbols [ Brad Chapman ]
++	- Decrement TTL in MIRROR target if used in FORWARD chain [ Harald
++		Welte, Fabian Melzow ]
++	- Replace SACKPERM TCP option with NOOP (instead of ENDOFOPT)
++		[ Guillaume Morin ]
++
++Changes from 1.2.2:
++
++- New "make most-of-pom" feature for application of non-confliction
++	patches. This should be used instead of "make patch-o-matic" by most
++	users.
++	[ Harald Welte ]
++- support for statically linking iptables, without need for .s	- plugins
++	[ David McCullough ]
++- support for multiple ranges in SAME target
++	[ Martin Josefsson ]
++- support for router alert options in ipv4options match
++	[ Fabrice Marie ]
++- modprobe() modules when doing iptables-restore
++	[ Andries van Schie ]
++- remove obsolete fragment matching code in IPv6
++	[ Kis-Szab	- Andras ]
++- add support for dns hostnames t	- IPv6 code
++	[ Kis-Szab	- Andras ]
++- New patch-o-matic patches:
++	- New multiport (mport) match
++		[ Andreas Ferber ]
++	- New nth match for matching every n-th packet
++		[ Fabrice Marie ]
++	- New realm match for matchin the routing realm
++		[ Sampsa Ranta ]
++	- New ctnetlink patch for manipulation of conntrack from userspace
++		[ Jay Schulist ]
++	- New REJECT Target for IPv6
++		[ Harald Welte ]
++	- New length match for IPv6
++		[ Imran Patel ]
++	- New multiport (mport) match for IPv6
++		[ Andreas Ferber]
++
++
++iptables v1.2.1 Changelog
++======================================================================
++This version requires kernel 2.4.0 or above.
++
++Bugs Fixed from 1.2:
++
++- Missing quotes around log-prefix
++	[ Bart Theunissen ]
++- Bug in save function of string match
++	[ Gianni Tedesc	- ]
++- ip6tables.c string buffer size fixes
++	[ Andras Kis-Szab	- ]
++- dependency problem with iptables-save / iptables-restore
++	[ Harald Welte ]
++- strtok problem with iptables-save / iptables-restore
++	[ Harald Welte ]
++- Problems with tcp/udp extension and multiple calls of do_command()
++	[ Sven Koch ]
++- Kernel bugfixes in patch-o-matic:
++	- Updated rpc-record patch to work with 2.4.0
++		[ Marc Boucher ]
++	- New ftp-pasv patch for fixing PASV detection with some ftpd's
++		[ Erik Hensema ]
++	- Fix checksum calculation of TOS target
++		[ Rusty Russell ]
++
++Changes from 1.2:
++
++- New `pending-patches' target
++	[ Rusty Russell ]
++- build all shared library extensions regardless of kernel tree
++	[ Rusty Russell ]
++- New counter-restore functions for iptables
++	[ Harald Welte ]
++- Added libiptc and libipulog t	- `devel' Makefile target
++	[ Harald Welte ]
++- Ported iptables-save/restore t	- IPv6
++	[ Andras Kis-Szab	- ]
++- Updated ULOG target (now in-kernel accumulation [= higher performance])
++	[ Harald Welte ]
++- Added fxp support t	- ftp-multi patch
++	[ Magnus Sandin ]
++- Implemented Boyer Moore Sublinear search algorithm for string match
++	[ Gianni Tedesc	- ]
++- Fixed tcp-window-tracking incompatibility with NAT helpers
++	[ Harald Welte ]
++- New patch-o-matic patches:
++	- New generic sequence number offset API for nat helpers
++		[ Harald Welte ]
++	- New psd (port-scan-detection) match
++		[ Dennis Koslowski, Markus Henning ]
++	- New NETLINK target for old ipchains -o behaviour
++		[ Gianni Tedesc	- ]
++	- New SAME target as a special case of SNAT
++		[ Martin Josefsson ]
++	- Ported LOG target to IPv6
++		[ Jan Rekorajski ]
++	- Ported owner, limit, mac and multiport match to IPv6
++		[ Jan Rekorajski ]
++
++
++iptables v1.2.2 Changelog
++======================================================================
++This version requires kernel 2.4.1 or above.
++This version recommends kernel 2.4.4 or above.
++
++Bugs Fixed from 1.2.1a:
++
++- fixes for SAME Target
++	[ Martin Josefsson ]
++- fixes for iplimit match in combination with iptables-save/-restore
++	[ Gerd Knorr ]
++- fix for TCP match in combination with iptables-save/-restore
++	[ Ian Lynagh ]
++- iptables-restore now deals correclty with spaces in --log-prefix
++	[ Harald Welte ]
++- fix in 'isapplied' script. It used t	- give false negatives
++	[ Harald Welte ]
++- fix in BALANCE target, target now uses full ip address range
++	[ Martin Josefsson ]
++- fix for NETLINK target, was sending wrong interface name
++	[ Gianni Tedesc	- ]
++- fix for collision of ftp and irc NAT helpers
++	[ Harald Welte ]
++- ip6tables brought in sync with iptables
++	[ Kis-Szab	- Andras ]
++- Kernel bugfixes in patch-o-matic:
++	- Fix possible security vulnerability in ip_conntrack_ftp
++		[ Cristian	- Lincoln Mattos, James Morris and Rusty ]
++
++Changes from 1.2.1a:
++
++- libiptc should now be usable from C++ applications
++	[ Fabrice MAURIE ]
++- seqoffset-,ftp-security, ... patches are combined in 2.4.4.patch
++	[ Rusty Russell ]
++- lots of old pre-2.4.1 patches now combined in 2.4.1.patch
++	[ Rusty Russel ]
++- IRC conntrack + nat cleanup
++	[ Harald Welte ]
++- string match cleanup
++	[ Gianni Tedesc	- ]
++- ULOG cleanup, new version. Fixes 'unable t	- send nflink' bug
++	[ Harald Welte ]
++- New patch-o-matic patches:
++	- New NETMAP Target for mapping whole networks 1:1 to other addresses
++		[ Svenning Soerensen ]
++	- New length Target for matching packet length
++		[ James Morris ]
++	- New ipv4options match for matching IPv4 header options
++		[ Fabrice MARIE ]
++	- New IPv6 agr match for matching IPv6 global aggregatable unicast
++		adresses
++		[ Andras Kis-Szab	- ]
++	- New pkttype match for matching link-layer multicast / broadcast
++		packets
++		[ Michal Ludvig ]
++	- New time match for matching the packet's receive time
++		[ Fabrice MARIE ]
++	- New talk conntack + NAT helper module
++		[ Jozsef Kadlecsik ]
++
++
++iptables v1.2 Changelog
++======================================================================
++This version requires 2.4.0-test9 or above.
++
++Bugs Fixed from 1.1.2:
++
++- Now default installs int	- /usr/local/sbin, not /usr/local/bin.
++- Only does IPv6 compilation on libc6.
++- More header fixes for weird header combos.
++- ip6tables now refers t	- "icmpv6" protocol, not "icmp".
++	[ Harald Welte ]
++- IPPROTO_ESP and AH defined in iptables for primitive headers.
++- iptables multiple-DNS resolve fixed
++	[ Harald Welte, Rusty ]
++- Kernel bugfixes in patch-o-matic:
++	- IPv6 netfilter fixes
++		[ Harald Welte ]
++	- Masquerade with fwmark routing fix
++	- Dynamic hashsize optimization (NAT) + `hashsize=' module parameter.
++	- NAT overlap fix
++	- PPC/Sparc mangle table fix.
++
++Changes from 1.1.2:
++
++- New `install-devel' target
++	[ James Morris ]
++- libipq now has man pages!
++	[ James Morris ]
++- iptables-save and iptables-restore added (with man pages!)
++	[ Harald Welte ]
++- iptables now inserts modules if CONFIG_KMOD or --modprobe
++	[ Harald Welte, Rusty ]
++- New `experimental' and `install-experimental' targets.
++- `--reject-with=echo-reply' removed in anticipation of the removal of
++	kernel support.
++- ttl match enhancements (greater or less than tests)
++	[ Harald Welte ]
++- Reworked patch-o-matic interface, t	- force reading of help.
++- patch-o-matic updated for new 2.4 Makefiles
++	[ Daniel Stone, Harald Welte ]
++- patch-o-matic now supports non-IPv4 netfilter patches
++	[ Harald Welte ]
++- New patch-o-matic patches:
++	- eggdrop bot connection tracking
++		[ Magnus Sandin ]
++	- FTOS target for full ToS mangling.
++		[ Matthew G. Marsh ]
++	- BALANCE target for simple load-balancing.
++	- iplimit match for limiting number of connections.
++		[ Gerd Knorr ]
++	- IPv6 MARK target
++		[ Harald Welte ]
++	- IPv6 mark match
++		[ Harald Welte ]
++
++
++iptables v1.1.2 Changelog
++======================================================================
++This version requires 2.4.0-test9 or above.
++
++Bugs Fixed from 1.1.1:
++
++- Adding rules on UltraSparc now works
++- string_to_number now handles overflow
++	[ Jan Echternach ]
++- Bug when using ridiculous rule numbers fixed
++
++Changes from 1.1.1:
++
++- patch-o-matic system added:
++	- TTL alteration and ttl matching support -- Harald Welte
++	- AH/ESP matching support -- Yon Uriarte
++	- DROPPED table support -- Rusty
++	- ftp-multi patch for non-standard ftp servers -- Harald Welte
++	- IRC connection tracking & NAT -- Harald Welte
++	- pool match and POOL target -- Patrick
++	- RPC recording patch -- Marcelo Barbosa Lima
++	- SNMP NAT support -- James Morris
++	- string match for looking in packet's data -- Emmanuel Roger
++	- tcp-MSS target for altering MSS -- Marc Boucher
++	- ULOG target for advanced logging -- Harald Welte
++- Minor const cleanups
++	[ Jan Echternach ]
++- iptables.8 updates
++	[ Harald Welte, Rusty ]
++- Better warnings for non-existant matches/missing libraries
++	[ Harald Welte ]
++- Improved isapplied script

debian/patches/0102-add_manpages.patch

+From: Laurence J. Lane <ljlane@debian.org>
+Subject: add binary man pages
+
+--- /dev/null
++++ b/utils/nfnl_osf.8
+@@ -0,0 +1,80 @@
++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
++.\"
++.\" Standard preamble:
++.\" ========================================================================
++.de Sp \" Vertical space (when we can't use .PP)
++.if t .sp .5v
++.if n .sp
++..
++.de Vb \" Begin verbatim text
++.ft CW
++.nf
++.ne \\$1
++..
++.de Ve \" End verbatim text
++.ft R
++.fi
++..
++.\" Set up some character translations and predefined strings.  \*(-- will
++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
++.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
++.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
++.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
++.\" nothing in troff, for use with C<>.
++.tr \(*W-
++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
++.ie n \{\
++.    ds -- \(*W-
++.    ds PI pi
++.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
++.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
++.    ds L" ""
++.    ds R" ""
++.    ds C` ""
++.    ds C' ""
++'br\}
++.el\{\
++.    ds -- \|\(em\|
++.    ds PI \(*p
++.    ds L" ``
++.    ds R" ''
++'br\}
++.\"
++.\" Escape single quotes in literal strings from groff's Unicode transform.
++.ie \n(.g .ds Aq \(aq
++.el       .ds Aq '
++.\"
++.\" If the F register is turned on, we'll generate index entries on stderr for
++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
++.\" entries marked with X<> in POD.  Of course, you'll have to process the
++.\" output yourself in some meaningful fashion.
++.ie \nF \{\
++.    de IX
++.    tm Index:\\$1\t\\n%\t"\\$2"
++..
++.    nr % 0
++.    rr F
++.\}
++.el \{\
++.    de IX
++..
++.\}
++.\" ========================================================================
++.\"
++.IX Title "NFNL_OSF 8"
++.TH NFNL_OSF 8 "2012-10-27" "nfnl_osf" "nfnl_osf"
++.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
++.\" way too many mistakes in technical documents.
++.if n .ad l
++.nh
++.SH "NAME"
++nfnl_osf \- load and unload os fingerprint database
++.SH "SYNOPSIS"
++.IX Header "SYNOPSIS"
++load and unload osf fingerprint database for the netfilter osf extension
++.SH "DESCRIPTION"
++.IX Header "DESCRIPTION"
++nffl_osf has no official man page.  Look at the osf module in \fB\f(BIiptables\-extensions\fB\|(8)\fR for more information.
++.SH "SEE ALSO"
++.IX Header "SEE ALSO"
++\&\fIiptables\-extensions\fR\|(8)
+--- /dev/null
++++ b/iptables/xtables-multi.8
+@@ -0,0 +1,83 @@
++.\" Automatically generated by Pod::Man 2.25 (Pod::Simple 3.16)
++.\"
++.\" Standard preamble:
++.\" ========================================================================
++.de Sp \" Vertical space (when we can't use .PP)
++.if t .sp .5v
++.if n .sp
++..
++.de Vb \" Begin verbatim text
++.ft CW
++.nf
++.ne \\$1
++..
++.de Ve \" End verbatim text
++.ft R
++.fi
++..
++.\" Set up some character translations and predefined strings.  \*(-- will
++.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
++.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
++.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
++.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
++.\" nothing in troff, for use with C<>.
++.tr \(*W-
++.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
++.ie n \{\
++.    ds -- \(*W-
++.    ds PI pi
++.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
++.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
++.    ds L" ""
++.    ds R" ""
++.    ds C` ""
++.    ds C' ""
++'br\}
++.el\{\
++.    ds -- \|\(em\|
++.    ds PI \(*p
++.    ds L" ``
++.    ds R" ''
++'br\}
++.\"
++.\" Escape single quotes in literal strings from groff's Unicode transform.
++.ie \n(.g .ds Aq \(aq
++.el       .ds Aq '
++.\"
++.\" If the F register is turned on, we'll generate index entries on stderr for
++.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
++.\" entries marked with X<> in POD.  Of course, you'll have to process the
++.\" output yourself in some meaningful fashion.
++.ie \nF \{\
++.    de IX
++.    tm Index:\\$1\t\\n%\t"\\$2"
++..
++.    nr % 0
++.    rr F
++.\}
++.el \{\
++.    de IX
++..
++.\}
++.\" ========================================================================
++.\"
++.IX Title "XTABLES-MULTI 8"
++.TH XTABLES-MULTI 8 "2012-10-27" "xtables 1.4.16.3" "xtables-multi"
++.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
++.\" way too many mistakes in technical documents.
++.if n .ad l
++.nh
++.SH "NAME"
++xtables\-multi \- xtables multi\-link binary for netfilter's iptables and ip6tables
++.SH "SYNOPSIS"
++.IX Header "SYNOPSIS"
++.Vb 1
++\& n/a
++.Ve
++.SH "DESCRIPTION"
++.IX Header "DESCRIPTION"
++xtables-multi has no official man page. It is a binary that behaves
++according to the name it is called by. \fB\s-1SEE\s0 \s-1ALSO\s0\fR lists the names.
++.SH "SEE ALSO"
++.IX Header "SEE ALSO"
++\&\fIiptables\fR\|(8), \fIip6tables\fR\|(8), \fIiptables\-save\fR\|(8), \fIip6tables\-save\fR\|(8), \fIiptables\-restore\fR\|(8), \fIip6tables\-resotre\fR\|(8)

debian/patches/0103-lintian_allows_to.patch

+From: Laurence J. Lane
+Description: cleanup "allows to", triggered lintian grammar warning
+
+--- a/extensions/libipt_ECN.man
++++ b/extensions/libipt_ECN.man
+@@ -1,4 +1,4 @@
+-This target allows to selectively work around known ECN blackholes.
++This target selectively works around known ECN blackholes.
+ It can only be used in the mangle table.
+ .TP
+ \fB\-\-ecn\-tcp\-remove\fP
+--- a/extensions/libxt_AUDIT.man
++++ b/extensions/libxt_AUDIT.man
+@@ -1,4 +1,4 @@
+-This target allows to create audit records for packets hitting the target.
++This target allows creates audit records for packets hitting the target.
+ It can be used to record accepted, dropped, and rejected packets. See
+ auditd(8) for additional details.
+ .TP
+--- a/extensions/libxt_CHECKSUM.man
++++ b/extensions/libxt_CHECKSUM.man
+@@ -1,4 +1,4 @@
+-This target allows to selectively work around broken/old applications.
++This target selectively works around broken/old applications.
+ It can only be used in the mangle table.
+ .TP
+ \fB\-\-checksum\-fill\fP
+--- a/extensions/libxt_CT.man
++++ b/extensions/libxt_CT.man
+@@ -1,4 +1,4 @@
+-The CT target allows to set parameters for a packet or its associated
++The CT target sets parameters for a packet or its associated
+ connection. The target attaches a "template" connection tracking entry to
+ the packet, which is then used by the conntrack core when initializing
+ a new ct entry. This target is thus only valid in the "raw" table.
+--- a/extensions/libxt_DSCP.man
++++ b/extensions/libxt_DSCP.man
+@@ -1,4 +1,4 @@
+-This target allows to alter the value of the DSCP bits within the TOS
++This target alters the value of the DSCP bits within the TOS
+ header of the IPv4 packet.  As this manipulates a packet, it can only
+ be used in the mangle table.
+ .TP
+--- a/extensions/libxt_TCPMSS.man
++++ b/extensions/libxt_TCPMSS.man
+@@ -1,4 +1,4 @@
+-This target allows to alter the MSS value of TCP SYN packets, to control
++This target alters the MSS value of TCP SYN packets, to control
+ the maximum size for that connection (usually limiting it to your
+ outgoing interface's MTU minus 40 for IPv4 or 60 for IPv6, respectively).
+ Of course, it can only be used
+--- a/extensions/libxt_osf.c
++++ b/extensions/libxt_osf.c
+@@ -40,7 +40,7 @@
+ 		"--ttl level            Use some TTL check extensions to determine OS:\n"
+ 		"       0                       true ip and fingerprint TTL comparison. Works for LAN.\n"
+ 		"       1                       check if ip TTL is less than fingerprint one. Works for global addresses.\n"
+-		"       2                       do not compare TTL at all. Allows to detect NMAP, but can produce false results.\n"
++		"       2                       do not compare TTL at all. This allows NMAP detection, but can produce false results.\n"
+ 		"--log level            Log determined genres into dmesg even if they do not match desired one:\n"
+ 		"       0                       log all matched or unknown signatures.\n"
+ 		"       1                       log only first one.\n"
+--- a/iptables/iptables.8.in
++++ b/iptables/iptables.8.in
+@@ -244,13 +244,13 @@
+ This option has no effect in iptables and iptables-restore.
+ If a rule using the \fB\-4\fP option is inserted with (and only with)
+ ip6tables-restore, it will be silently ignored. Any other uses will throw an
+-error. This option allows to put both IPv4 and IPv6 rules in a single rule file
++error. This option allows IPv4 and IPv6 rules in a single rule file
+ for use with both iptables-restore and ip6tables-restore.
+ .TP
+ \fB\-6\fP, \fB\-\-ipv6\fP
+ If a rule using the \fB\-6\fP option is inserted with (and only with)
+ iptables-restore, it will be silently ignored. Any other uses will throw an
+-error. This option allows to put both IPv4 and IPv6 rules in a single rule file
++error. This option allows IPv4 and IPv6 rules in a single rule file
+ for use with both iptables-restore and ip6tables-restore.
+ This option has no effect in ip6tables and ip6tables-restore.
+ .TP

debian/patches/0104-lintian_hyphens.patch

+From: Laurence J. Lane <ljlane@debian.org>
+Description: man page hyphen cleanup
+
+--- a/extensions/libip6t_DNPT.man
++++ b/extensions/libip6t_DNPT.man
+@@ -23,7 +23,7 @@
+ .PP
+ You may need to enable IPv6 neighbor proxy:
+ .IP
+-sysctl -w net.ipv6.conf.all.proxy_ndp=1
++sysctl \-w net.ipv6.conf.all.proxy_ndp=1
+ .PP
+ You also have to use the
+ .B NOTRACK
+--- a/extensions/libip6t_SNPT.man
++++ b/extensions/libip6t_SNPT.man
+@@ -23,7 +23,7 @@
+ .PP
+ You may need to enable IPv6 neighbor proxy:
+ .IP
+-sysctl -w net.ipv6.conf.all.proxy_ndp=1
++sysctl \-w net.ipv6.conf.all.proxy_ndp=1
+ .PP
+ You also have to use the
+ .B NOTRACK
+--- a/extensions/libxt_HMARK.man
++++ b/extensions/libxt_HMARK.man
+@@ -56,5 +56,5 @@
+  \-j HMARK \-\-hmark-tuple ct,src,dst,proto \-\-hmark-offset 10000
+ \-\-hmark\-mod 10 \-\-hmark\-rnd 0xfeedcafe
+ .PP
+-iptables \-t mangle \-A PREROUTING -j HMARK \-\-hmark\-offset 10000
++iptables \-t mangle \-A PREROUTING \-j HMARK \-\-hmark\-offset 10000
+ \-\-hmark-tuple src,dst,proto \-\-hmark-mod 10 \-\-hmark\-rnd 0xdeafbeef
+--- a/extensions/libxt_SET.man
++++ b/extensions/libxt_SET.man
+@@ -21,5 +21,5 @@
+ when adding an entry if it already exists, reset the timeout value
+ to the specified one or to the default from the set definition
+ .PP
+-Use of -j SET requires that ipset kernel support is provided, which, for
++Use of \-j SET requires that ipset kernel support is provided, which, for
+ standard kernels, is the case since Linux 2.6.39.
+--- a/extensions/libxt_TOS.man
++++ b/extensions/libxt_TOS.man
+@@ -32,5 +32,5 @@
+ a bug whereby IPv6 TOS mangling does not behave as documented and differs from
+ the IPv4 version. The TOS mask indicates the bits one wants to zero out, so it
+ needs to be inverted before applying it to the original TOS field. However, the
+-aformentioned kernels forgo the inversion which breaks --set-tos and its
++aformentioned kernels forgo the inversion which breaks \-\-set\-tos and its
+ mnemonics.
+--- a/extensions/libxt_bpf.man
++++ b/extensions/libxt_bpf.man
+@@ -4,7 +4,7 @@
+ \fB\-\-bytecode\fP \fIcode\fP
+ Pass the BPF byte code format (described in the example below).
+ .PP
+-The code format is similar to the output of the tcpdump -ddd command: one line
++The code format is similar to the output of the tcpdump \-ddd command: one line
+ that stores the number of instructions, followed by one line for each
+ instruction. Instruction lines follow the pattern 'u16 u8 u8 u32' in decimal
+ notation. Fields encode the operation, jump offset if true, jump offset if
+--- a/extensions/libxt_cluster.man
++++ b/extensions/libxt_cluster.man
+@@ -27,7 +27,7 @@
+ iptables \-A PREROUTING \-t mangle \-i eth2 \-m cluster
+ \-\-cluster\-total\-nodes 2 \-\-cluster\-local\-node 1
+ \-\-cluster\-hash\-seed 0xdeadbeef
+-\-j MARK -\-set\-mark 0xffff
++\-j MARK \-\-set\-mark 0xffff
+ .IP
+ iptables \-A PREROUTING \-t mangle \-i eth1
+ \-m mark ! \-\-mark 0xffff \-j DROP
+--- a/extensions/libxt_osf.man
++++ b/extensions/libxt_osf.man
+@@ -35,11 +35,11 @@
+ OS fingerprints are loadable using the \fBnfnl_osf\fP program. To load
+ fingerprints from a file, use:
+ .PP
+-\fBnfnl_osf -f /usr/share/xtables/pf.os\fP
++\fBnfnl_osf \-f /usr/share/xtables/pf.os\fP
+ .PP
+ To remove them again,
+ .PP
+-\fBnfnl_osf -f /usr/share/xtables/pf.os -d\fP
++\fBnfnl_osf \-f /usr/share/xtables/pf.os \-d\fP
+ .PP
+ The fingerprint database can be downlaoded from
+ http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os .
+--- a/extensions/libxt_set.man
++++ b/extensions/libxt_set.man
+@@ -61,5 +61,5 @@
+ The option \fB\-\-match\-set\fP can be replaced by \fB\-\-set\fP if that does 
+ not clash with an option of other extensions.
+ .PP
+-Use of -m set requires that ipset kernel support is provided, which, for
++Use of \-m set requires that ipset kernel support is provided, which, for
+ standard kernels, is the case since Linux 2.6.39.

debian/patches/0105-lintian_spelling.patch

+From: Laurence J. Lane <ljlane@debian.org>
+Description: lintian spelling warning, s/specifing/specifying
+
+--- a/libipq/ipq_set_verdict.3
++++ b/libipq/ipq_set_verdict.3
+@@ -30,7 +30,7 @@
+ .B ipq_set_verdict
+ function issues a verdict on a packet previously obtained with
+ .BR ipq_read ,
+-specifing the intended disposition of the packet, and optionally
++specifying the intended disposition of the packet, and optionally
+ supplying a modified version of the payload data.
+ .PP
+ The

debian/patches/0201-660748-iptables_apply_man.patch

+From afc5ba9e94f86a11d50f3554efeafd402faddacb Mon Sep 17 00:00:00 2001
+From: "Laurence J. Lane" <ljlane@debian.org>
+Date: Mon, 2 Sep 2013 16:46:50 -0400
+Subject: [PATCH] iptables: mention iptables-reply in SEE ALSO
+
+Add iptables-apply(8) to the SEE ALSO section of *-save(8)
+and *-restore(8).
+
+References: http://bugs.debian.org/660748
+
+Signed-off-by: Laurence J. Lane <ljlane@debian.org>
+---
+ iptables/iptables-restore.8.in | 2 +-
+ iptables/iptables-save.8.in    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/iptables/iptables-restore.8.in
++++ b/iptables/iptables-restore.8.in
+@@ -65,7 +65,7 @@
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-restore.
+ .SH SEE ALSO
+-\fBiptables\-save\fP(8), \fBiptables\fP(8)
++\fBiptables\-apply\fP(8),\fBiptables\-save\fP(8), \fBiptables\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the
+--- a/iptables/iptables-save.8.in
++++ b/iptables/iptables-save.8.in
+@@ -55,7 +55,7 @@
+ .br
+ Andras Kis-Szabo <kisza@sch.bme.hu> contributed ip6tables-save.
+ .SH SEE ALSO
+-\fBiptables\-restore\fP(8), \fBiptables\fP(8)
++\fBiptables\-apply\fP(8),\fBiptables\-restore\fP(8), \fBiptables\fP(8)
+ .PP
+ The iptables-HOWTO, which details more iptables usage, the NAT-HOWTO,
+ which details NAT, and the netfilter-hacking-HOWTO which details the