- obsolete

[packages/kernel.git] / 2.6.x-patch-o-matic-ng-base-20040216.patch

diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ip_pool.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ip_pool.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ip_pool.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ip_pool.h      2004-02-16 11:07:21.518803072 +0100
@@ -0,0 +1,64 @@
+#ifndef _IP_POOL_H
+#define _IP_POOL_H
+
+/***************************************************************************/
+/*  This program is free software; you can redistribute it and/or modify   */
+/*  it under the terms of the GNU General Public License as published by   */
+/*  the Free Software Foundation; either version 2 of the License, or     */
+/*  (at your option) any later version.                                           */
+/*                                                                        */
+/*  This program is distributed in the hope that it will be useful,       */
+/*  but WITHOUT ANY WARRANTY; without even the implied warranty of        */
+/*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         */
+/*  GNU General Public License for more details.                          */
+/*                                                                        */
+/*  You should have received a copy of the GNU General Public License     */
+/*  along with this program; if not, write to the Free Software                   */
+/*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA*/
+/***************************************************************************/
+
+/* A sockopt of such quality has hardly ever been seen before on the open
+ * market!  This little beauty, hardly ever used: above 64, so it's
+ * traditionally used for firewalling, not touched (even once!) by the
+ * 2.0, 2.2 and 2.4 kernels!
+ *
+ * Comes with its own certificate of authenticity, valid anywhere in the
+ * Free world!
+ *
+ * Rusty, 19.4.2000
+ */
+#define SO_IP_POOL 81
+
+typedef int ip_pool_t;                 /* pool index */
+#define IP_POOL_NONE   ((ip_pool_t)-1)
+
+struct ip_pool_request {
+       int op;
+       ip_pool_t index;
+       u_int32_t addr;
+       u_int32_t addr2;
+};
+
+/* NOTE: I deliberately break the first cut ippool utility. Nobody uses it. */
+
+#define IP_POOL_BAD001         0x00000010
+
+#define IP_POOL_FLUSH          0x00000011      /* req.index, no arguments */
+#define IP_POOL_INIT           0x00000012      /* from addr to addr2 incl. */
+#define IP_POOL_DESTROY                0x00000013      /* req.index, no arguments */
+#define IP_POOL_ADD_ADDR       0x00000014      /* add addr to pool */
+#define IP_POOL_DEL_ADDR       0x00000015      /* del addr from pool */
+#define IP_POOL_HIGH_NR                0x00000016      /* result in req.index */
+#define IP_POOL_LOOKUP         0x00000017      /* result in addr and addr2 */
+#define IP_POOL_USAGE          0x00000018      /* result in addr */
+#define IP_POOL_TEST_ADDR      0x00000019      /* result (0/1) returned */
+
+#ifdef __KERNEL__
+
+/* NOTE: ip_pool_match() and ip_pool_mod() expect ADDR to be host byte order */
+extern int ip_pool_match(ip_pool_t pool, u_int32_t addr);
+extern int ip_pool_mod(ip_pool_t pool, u_int32_t addr, int isdel);
+
+#endif
+
+#endif /*_IP_POOL_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_NETLINK.h      1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_NETLINK.h  2004-02-16 11:07:05.880548139 +0100
@@ -0,0 +1,27 @@
+#ifndef _IPT_FWMON_H
+#define _IPT_FWMON_H
+
+/* Bitmask macros */
+#define MASK(x,y) (x & y)
+#define MASK_SET(x,y) x |= y
+#define MASK_UNSET(x,y) x &= ~y
+
+#define USE_MARK       0x00000001
+#define USE_DROP       0x00000002
+#define USE_SIZE       0x00000004
+
+struct ipt_nldata
+{      
+       unsigned int flags;
+       unsigned int mark;
+       unsigned int size;
+};
+
+/* Old header */
+struct netlink_t {
+       unsigned int len;
+       unsigned int mark;
+       char iface[IFNAMSIZ];
+};
+
+#endif /*_IPT_FWMON_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_TTL.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_TTL.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_TTL.h      2004-02-16 11:07:09.253740328 +0100
@@ -0,0 +1,21 @@
+/* TTL modification module for IP tables
+ * (C) 2000 by Harald Welte <laforge@gnumonks.org> */
+
+#ifndef _IPT_TTL_H
+#define _IPT_TTL_H
+
+enum {
+       IPT_TTL_SET = 0,
+       IPT_TTL_INC,
+       IPT_TTL_DEC
+};
+
+#define IPT_TTL_MAXMODE        IPT_TTL_DEC
+
+struct ipt_TTL_info {
+       u_int8_t        mode;
+       u_int8_t        ttl;
+};
+
+
+#endif
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_connlimit.h    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_connlimit.h        2004-02-16 11:07:11.549190614 +0100
@@ -0,0 +1,12 @@
+#ifndef _IPT_CONNLIMIT_H
+#define _IPT_CONNLIMIT_H
+
+struct ipt_connlimit_data;
+
+struct ipt_connlimit_info {
+       int limit;
+       int inverse;
+       u_int32_t mask;
+       struct ipt_connlimit_data *data;
+};
+#endif /* _IPT_CONNLIMIT_H */
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_dstlimit.h     1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_dstlimit.h 2004-02-16 11:07:13.230787904 +0100
@@ -0,0 +1,36 @@
+#ifndef _IPT_DSTLIMIT_H
+#define _IPT_DSTLIMIT_H
+
+/* timings are in milliseconds. */
+#define IPT_DSTLIMIT_SCALE 10000
+/* 1/10,000 sec period => max of 10,000/sec.  Min rate is then 429490
+   seconds, or one every 59 hours. */
+
+/* details of this structure hidden by the implementation */
+struct ipt_dstlimit_htable;
+
+#define IPT_DSTLIMIT_HASH_DIP  0x0001
+#define IPT_DSTLIMIT_HASH_DPT  0x0002
+#define IPT_DSTLIMIT_HASH_SIP  0x0004
+
+struct ipt_dstlimit_info {
+       u_int32_t mode;   /* bitmask of IPT_DSTLIMIT_HASH_* */
+       u_int32_t avg;    /* Average secs between packets * scale */
+       u_int32_t burst;  /* Period multiplier for upper limit. */
+
+       /* user specified */
+       unsigned int size;              /* how many buckets */
+       unsigned int max;               /* max number of entries */
+       unsigned int gc_interval;       /* gc interval */
+       unsigned int expire;            /* when do entries expire? */
+       char name [IFNAMSIZ];           /* name */
+
+       struct ipt_dstlimit_htable *hinfo;
+
+       /* Used internally by the kernel */
+       union {
+               void *ptr;
+               struct ipt_dstlimit_info *master;
+       } u;
+};
+#endif /*_IPT_DSTLIMIT_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_fuzzy.h        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_fuzzy.h    2004-02-16 11:07:14.925382080 +0100
@@ -0,0 +1,21 @@
+#ifndef _IPT_FUZZY_H
+#define _IPT_FUZZY_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+#define MAXFUZZYRATE 10000000
+#define MINFUZZYRATE 3
+
+struct ipt_fuzzy_info {
+       u_int32_t minimum_rate;
+       u_int32_t maximum_rate;
+       u_int32_t packets_total;
+       u_int32_t bytes_total;
+       u_int32_t previous_time;
+       u_int32_t present_time;
+       u_int32_t mean_rate;
+       u_int8_t acceptance_rate;
+};
+
+#endif /*_IPT_FUZZY_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_ipv4options.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_ipv4options.h      2004-02-16 11:07:16.164085433 +0100
@@ -0,0 +1,21 @@
+#ifndef __ipt_ipv4options_h_included__
+#define __ipt_ipv4options_h_included__
+
+#define IPT_IPV4OPTION_MATCH_SSRR              0x01  /* For strict source routing */
+#define IPT_IPV4OPTION_MATCH_LSRR              0x02  /* For loose source routing */
+#define IPT_IPV4OPTION_DONT_MATCH_SRR          0x04  /* any source routing */
+#define IPT_IPV4OPTION_MATCH_RR                        0x08  /* For Record route */
+#define IPT_IPV4OPTION_DONT_MATCH_RR           0x10
+#define IPT_IPV4OPTION_MATCH_TIMESTAMP         0x20  /* For timestamp request */
+#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP    0x40
+#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT      0x80  /* For router-alert */
+#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100
+#define IPT_IPV4OPTION_MATCH_ANY_OPT           0x200 /* match packet with any option */
+#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT      0x400 /* match packet with no option */
+
+struct ipt_ipv4options_info {
+       u_int16_t options;
+};
+
+
+#endif /* __ipt_ipv4options_h_included__ */
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_mport.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_mport.h        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_mport.h    2004-02-16 11:07:17.665725817 +0100
@@ -0,0 +1,24 @@
+#ifndef _IPT_MPORT_H
+#define _IPT_MPORT_H
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+#define IPT_MPORT_SOURCE (1<<0)
+#define IPT_MPORT_DESTINATION (1<<1)
+#define IPT_MPORT_EITHER (IPT_MPORT_SOURCE|IPT_MPORT_DESTINATION)
+
+#define IPT_MULTI_PORTS        15
+
+/* Must fit inside union ipt_matchinfo: 32 bytes */
+/* every entry in ports[] except for the last one has one bit in pflags
+ * associated with it. If this bit is set, the port is the first port of
+ * a portrange, with the next entry being the last.
+ * End of list is marked with pflags bit set and port=65535.
+ * If 14 ports are used (last one does not have a pflag), the last port
+ * is repeated to fill the last entry in ports[] */
+struct ipt_mport
+{
+       u_int8_t flags:2;                       /* Type of comparison */
+       u_int16_t pflags:14;                    /* Port flags */
+       u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
+};
+#endif /*_IPT_MPORT_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_nth.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_nth.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_nth.h      2004-02-16 11:07:18.796455028 +0100
@@ -0,0 +1,19 @@
+#ifndef _IPT_NTH_H
+#define _IPT_NTH_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+#ifndef IPT_NTH_NUM_COUNTERS
+#define IPT_NTH_NUM_COUNTERS 16
+#endif
+
+struct ipt_nth_info {
+       u_int8_t every;
+       u_int8_t not;
+       u_int8_t startat;
+       u_int8_t counter;
+       u_int8_t packet;
+};
+
+#endif /*_IPT_NTH_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_osf.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_osf.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_osf.h      2004-02-16 11:07:19.917186632 +0100
@@ -0,0 +1,130 @@
+/*
+ * ipt_osf.h
+ *
+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+#ifndef _IPT_OSF_H
+#define _IPT_OSF_H
+
+#define MAXGENRELEN            32
+#define MAXDETLEN              64
+
+#define IPT_OSF_GENRE          1
+#define IPT_OSF_SMART          2
+#define IPT_OSF_LOG            4
+
+#define IPT_OSF_LOGLEVEL_ALL           0
+#define IPT_OSF_LOGLEVEL_FIRST 1
+
+#include <linux/list.h>
+
+struct ipt_osf_info
+{
+       char                    genre[MAXGENRELEN];
+       int                     len;
+       unsigned long           flags;
+       int                     loglevel;
+       int                     invert; /* UNSUPPORTED */
+};
+
+struct osf_wc
+{
+       char                    wc;
+       unsigned long           val;
+};
+
+/* This struct represents IANA options
+ * http://www.iana.org/assignments/tcp-parameters
+ */
+struct osf_opt
+{
+       unsigned char           kind;
+       unsigned char           length;
+       struct osf_wc           wc;
+};
+
+#ifdef __KERNEL__
+
+struct osf_finger
+{
+       struct list_head        flist;
+       struct osf_wc           wss;
+       unsigned char           ttl;
+       unsigned char           df;
+       unsigned long           ss;
+       char                    genre[MAXGENRELEN];
+       char                    version[MAXGENRELEN], subtype[MAXGENRELEN];
+       
+       /* Not needed, but for consistency with original table from Michal Zalewski */
+       char                    details[MAXDETLEN]; 
+
+       int                     opt_num;
+       struct osf_opt          opt[MAX_IPOPTLEN]; /* In case it is all NOP or EOL */
+
+};
+
+/* Defines for IANA option kinds */
+
+#define OSFOPT_EOL             0       /* End of options */
+#define OSFOPT_NOP             1       /* NOP */
+#define OSFOPT_MSS             2       /* Maximum segment size */
+#define OSFOPT_WSO             3       /* Window scale option */
+#define OSFOPT_SACKP           4       /* SACK permitted */
+#define OSFOPT_SACK            5       /* SACK */
+#define OSFOPT_ECHO            6       
+#define OSFOPT_ECHOREPLY       7
+#define OSFOPT_TS              8       /* Timestamp option */
+#define OSFOPT_POCP            9       /* Partial Order Connection Permitted */
+#define OSFOPT_POSP            10      /* Partial Order Service Profile */
+/* Others are not used in current OSF */
+
+static struct osf_opt IANA_opts[] = 
+{
+       {0, 1,},
+       {1, 1,},
+       {2, 4,},
+       {3, 3,},
+       {4, 2,},
+       {5, 1 ,}, /* SACK length is not defined */
+       {6, 6,},
+       {7, 6,},
+       {8, 10,},
+       {9, 2,},
+       {10, 3,},
+       {11, 1,}, /* CC: Suppose 1 */
+       {12, 1,}, /* the same */
+       {13, 1,}, /* and here too */
+       {14, 3,},
+       {15, 1,}, /* TCP Alternate Checksum Data. Length is not defined */
+       {16, 1,},
+       {17, 1,},
+       {18, 3,},
+       {19, 18,},
+       {20, 1,},
+       {21, 1,},
+       {22, 1,},
+       {23, 1,},
+       {24, 1,},
+       {25, 1,},
+       {26, 1,},
+};
+
+#endif /* __KERNEL__ */
+
+#endif /* _IPT_OSF_H */
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_pool.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_pool.h 1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_pool.h     2004-02-16 11:07:21.518803072 +0100
@@ -0,0 +1,25 @@
+#ifndef _IPT_POOL_H
+#define _IPT_POOL_H
+
+#include <linux/netfilter_ipv4/ip_pool.h>
+
+#define IPT_POOL_INV_SRC       0x00000001
+#define IPT_POOL_INV_DST       0x00000002
+#define IPT_POOL_DEL_SRC       0x00000004
+#define IPT_POOL_DEL_DST       0x00000008
+#define IPT_POOL_INV_MOD_SRC   0x00000010
+#define IPT_POOL_INV_MOD_DST   0x00000020
+#define IPT_POOL_MOD_SRC_ACCEPT        0x00000040
+#define IPT_POOL_MOD_DST_ACCEPT        0x00000080
+#define IPT_POOL_MOD_SRC_DROP  0x00000100
+#define IPT_POOL_MOD_DST_DROP  0x00000200
+
+/* match info */
+struct ipt_pool_info
+{
+       ip_pool_t src;
+       ip_pool_t dst;
+       unsigned flags;
+};
+
+#endif /*_IPT_POOL_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_psd.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_psd.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_psd.h      2004-02-16 11:07:22.387595011 +0100
@@ -0,0 +1,40 @@
+#ifndef _IPT_PSD_H
+#define _IPT_PSD_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+/*
+ * High port numbers have a lower weight to reduce the frequency of false
+ * positives, such as from passive mode FTP transfers.
+ */
+#define PORT_WEIGHT_PRIV               3
+#define PORT_WEIGHT_HIGH               1
+
+/*
+ * Port scan detection thresholds: at least COUNT ports need to be scanned
+ * from the same source, with no longer than DELAY ticks between ports.
+ */
+#define SCAN_MIN_COUNT                 7
+#define SCAN_MAX_COUNT                 (SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
+#define SCAN_WEIGHT_THRESHOLD          SCAN_MAX_COUNT
+#define SCAN_DELAY_THRESHOLD           (HZ * 3)
+
+/*
+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
+ * HASH_MAX source addresses per the same hash value.
+ */
+#define LIST_SIZE                      0x100
+#define HASH_LOG                       9
+#define HASH_SIZE                      (1 << HASH_LOG)
+#define HASH_MAX                       0x10
+
+struct ipt_psd_info {
+       unsigned int weight_threshold;
+       unsigned int delay_threshold;
+       unsigned short lo_ports_weight;
+       unsigned short hi_ports_weight;
+};
+
+#endif /*_IPT_PSD_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_quota.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_quota.h        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_quota.h    2004-02-16 11:07:23.219395809 +0100
@@ -0,0 +1,11 @@
+#ifndef _IPT_QUOTA_H
+#define _IPT_QUOTA_H
+
+/* print debug info in both kernel/netfilter module & iptable library */
+//#define DEBUG_IPT_QUOTA
+
+struct ipt_quota_info {
+        u_int64_t quota;
+};
+
+#endif /*_IPT_QUOTA_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_random.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_random.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_random.h       1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_random.h   2004-02-16 11:07:24.378118313 +0100
@@ -0,0 +1,11 @@
+#ifndef _IPT_RAND_H
+#define _IPT_RAND_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+struct ipt_rand_info {
+       u_int8_t average;
+};
+
+#endif /*_IPT_RAND_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_realm.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_realm.h        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_realm.h    2004-02-16 11:07:26.369641375 +0100
@@ -0,0 +1,9 @@
+#ifndef _IPT_REALM_H
+#define _IPT_REALM_H
+
+struct ipt_realm_info {
+       u_int32_t id;
+       u_int32_t mask;
+       u_int8_t invert;
+};
+#endif /*_IPT_REALM_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_time.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_time.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_time.h 1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_time.h     2004-02-16 11:07:27.150454383 +0100
@@ -0,0 +1,13 @@
+#ifndef __ipt_time_h_included__
+#define __ipt_time_h_included__
+
+
+struct ipt_time_info {
+       u_int8_t  days_match;   /* 1 bit per day. -SMTWTFS                      */
+       u_int16_t time_start;   /* 0 < time_start < 23*60+59 = 1439             */
+       u_int16_t time_stop;    /* 0:0 < time_stat < 23:59                      */
+       u_int8_t  kerneltime;   /* ignore skb time (and use kerneltime) or not. */
+};
+
+
+#endif /* __ipt_time_h_included__ */
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_u32.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv4/ipt_u32.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv4/ipt_u32.h      2004-02-16 11:07:28.175208970 +0100
@@ -0,0 +1,40 @@
+#ifndef _IPT_U32_H
+#define _IPT_U32_H
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+enum ipt_u32_ops
+{
+       IPT_U32_AND,
+       IPT_U32_LEFTSH,
+       IPT_U32_RIGHTSH,
+       IPT_U32_AT
+};
+
+struct ipt_u32_location_element
+{
+       u_int32_t number;
+       u_int8_t nextop;
+};
+struct ipt_u32_value_element
+{
+       u_int32_t min;
+       u_int32_t max;
+};
+/* *** any way to allow for an arbitrary number of elements?
+   for now I settle for a limit of 10 of each */
+#define U32MAXSIZE 10
+struct ipt_u32_test
+{
+       u_int8_t nnums;
+       struct ipt_u32_location_element location[U32MAXSIZE+1];
+       u_int8_t nvalues;
+       struct ipt_u32_value_element value[U32MAXSIZE+1];
+};
+
+struct ipt_u32
+{
+       u_int8_t ntests;
+       struct ipt_u32_test tests[U32MAXSIZE+1];
+};
+
+#endif /*_IPT_U32_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_HL.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_HL.h  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_HL.h      2004-02-16 11:06:53.521507853 +0100
@@ -0,0 +1,22 @@
+/* Hop Limit modification module for ip6tables
+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
+ * Based on HW's TTL module */
+
+#ifndef _IP6T_HOPLIMIT_H
+#define _IP6T_HOPLIMIT_H
+
+enum {
+       IP6T_HOPLIMIT_SET = 0,
+       IP6T_HOPLIMIT_INC,
+       IP6T_HOPLIMIT_DEC
+};
+
+#define IP6T_HOPLIMIT_MAXMODE  IP6T_HOPLIMIT_DEC
+
+struct ip6t_HOPLIMIT_info {
+       u_int8_t        mode;
+       u_int8_t        hop_limit;
+};
+
+
+#endif
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_REJECT.h      2004-02-15 03:44:09.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_REJECT.h  2004-02-16 11:07:07.812085576 +0100
@@ -2,15 +2,17 @@
 #define _IP6T_REJECT_H
 
 enum ip6t_reject_with {
-       IP6T_ICMP_NET_UNREACHABLE,
-       IP6T_ICMP_HOST_UNREACHABLE,
-       IP6T_ICMP_PROT_UNREACHABLE,
-       IP6T_ICMP_PORT_UNREACHABLE,
-       IP6T_ICMP_ECHOREPLY
+       IP6T_ICMP6_NO_ROUTE,
+       IP6T_ICMP6_ADM_PROHIBITED,
+       IP6T_ICMP6_NOT_NEIGHBOUR,
+       IP6T_ICMP6_ADDR_UNREACH,
+       IP6T_ICMP6_PORT_UNREACH,
+       IP6T_ICMP6_ECHOREPLY,
+       IP6T_TCP_RESET
 };
 
 struct ip6t_reject_info {
        enum ip6t_reject_with with;      /* reject type */
 };
 
-#endif /*_IPT_REJECT_H*/
+#endif /*_IP6T_REJECT_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_fuzzy.h       1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_fuzzy.h   2004-02-16 11:07:14.925382080 +0100
@@ -0,0 +1,21 @@
+#ifndef _IP6T_FUZZY_H
+#define _IP6T_FUZZY_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+#define MAXFUZZYRATE 10000000
+#define MINFUZZYRATE 3
+
+struct ip6t_fuzzy_info {
+       u_int32_t minimum_rate;
+       u_int32_t maximum_rate;
+       u_int32_t packets_total;
+       u_int32_t bytes_total;
+       u_int32_t previous_time;
+       u_int32_t present_time;
+       u_int32_t mean_rate;
+       u_int8_t acceptance_rate;
+};
+
+#endif /*_IP6T_FUZZY_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_nth.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_nth.h 1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_nth.h     2004-02-16 11:07:18.796455028 +0100
@@ -0,0 +1,19 @@
+#ifndef _IP6T_NTH_H
+#define _IP6T_NTH_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+#ifndef IP6T_NTH_NUM_COUNTERS
+#define IP6T_NTH_NUM_COUNTERS 16
+#endif
+
+struct ip6t_nth_info {
+       u_int8_t every;
+       u_int8_t not;
+       u_int8_t startat;
+       u_int8_t counter;
+       u_int8_t packet;
+};
+
+#endif /*_IP6T_NTH_H*/
diff -Nur linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_random.h
--- linux-2.6.3-rc3.org/include/linux/netfilter_ipv6/ip6t_random.h      1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/include/linux/netfilter_ipv6/ip6t_random.h  2004-02-16 11:07:24.378118313 +0100
@@ -0,0 +1,11 @@
+#ifndef _IP6T_RAND_H
+#define _IP6T_RAND_H
+
+#include <linux/param.h>
+#include <linux/types.h>
+
+struct ip6t_rand_info {
+       u_int8_t average;
+};
+
+#endif /*_IP6T_RAND_H*/
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/Kconfig linux-2.6.3-rc3/net/ipv4/netfilter/Kconfig
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/Kconfig      2004-02-16 10:08:59.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/Kconfig  2004-02-16 11:07:28.178208252 +0100
@@ -588,5 +588,384 @@
 
          To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_TARGET_IPV4OPTSSTRIP
+       tristate  'IPV4OPTSSTRIP target support'
+       depends on IP_NF_MANGLE
+         help
+         This option adds CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP, which supplies a target
+         module that will allow you to strip all the IP options from a packet.
+         
+         The target doesn't take any option, and therefore is extremly easy to use :
+         
+         # iptables -t mangle -A PREROUTING -j IPV4OPTSSTRIP
+         # iptables -t mangle --list -n
+         Chain PREROUTING (policy ACCEPT)
+         target     prot opt source               destination
+         IPV4OPTSSTRIP  all  --  0.0.0.0/0            0.0.0.0/0
+         
+         Chain OUTPUT (policy ACCEPT)
+         target     prot opt source               destination
+
+config IP_NF_TARGET_NETLINK
+       tristate  'NETLINK target support'
+       depends on IP_NF_FILTER
+         help
+         CONFIG_IP_NF_TARGET_NETLINK adds a NETLINK target that sends dropped packets to
+         userspace via a netlink socket.  Apps such as fwmon
+         (http://firestorm.geek-ware.co.uk) can then recieve and dislpay these packets.
+         This option is basically a re-implementation of the ipchains -o option.
+
+config IP_NF_TARGET_TTL
+       tristate  'TTL target support'
+       depends on IP_NF_MANGLE
+         help
+         This adds an iptables TTL manipulation target, which enables the user
+         to set the TTL value of an IP packet or to increment / decrement it 
+         by a given value.
+
+config IP_NF_MATCH_CONNLIMIT
+       tristate  'Connections/IP limit match support'
+       depends on IP_NF_IPTABLES
+         help
+         This adds an iptables match which allows you to restrict the
+         number of parallel TCP connections to a server per client IP address
+         (or address block).
+         
+         Examples:
+         
+         # allow 2 telnet connections per client host
+         iptables -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT
+         
+         # you can also match the other way around:
+         iptables -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT
+         
+         # limit the nr of parallel http requests to 16 per class C sized
+         # network (24 bit netmask)
+         iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 \
+               --connlimit-mask 24 -j REJECT
+
+config IP_NF_MATCH_DSTLIMIT
+       tristate  'dstlimit match support'
+       depends on IP_NF_IPTABLES
+         help
+         
+         This patch adds a new match called 'dstlimit'.  
+         The idea is to have something like 'limit', but either per 
+         destination-ip or per (destip,destport) tuple.
+         
+         It gives you the ability to say 
+               '1000 packets per second for every host in 192.168.0.0/16'
+               '100 packets per second for every service of 192.168.1.1'
+         
+         Parameters are:
+               --dstlimit <rate>
+                       A rate just like the limit match
+               --dstlimit-burst <num>
+                       Burst value, just like limit match
+               --dstlimit-mode destip | destip-destport
+                       Limit per IP or per port
+               --dstlimit-name foo
+                       The name for the /proc/net/ipt_dstlimit/foo entry
+               --dstlimit-htable-size <num>
+                       The number of buckets of the hash table
+               --dstlimit-htable-max <num>
+                       Maximum entries in the hash
+               --dstlimit-htable-expire <num>
+                       After how many miliseconds do hash entries expire
+               --dstlimit-htable-gcinterval <num>
+                       How many miliseconds between garbage collection intervals
+         
+
+config IP_NF_MATCH_FUZZY
+       tristate  'fuzzy match support'
+       depends on IP_NF_IPTABLES
+         help
+         This option adds a `fuzzy' match which allows you to match packets according to
+         a dynamic profile implemented by means of a simple Fuzzy Logic Controller (FLC)
+
+config IP_NF_MATCH_IPV4OPTIONS
+       tristate  'IPV4OPTIONS match support'
+       depends on IP_NF_IPTABLES
+         help
+         This option adds an iptables 'ipv4options' match, which allows you to
+         match on IPv4 header options like source routing, record route, timestamp and
+         router-alert.
+         
+         Suppported options are:
+         --ssrr
+           To match packets with the flag strict source routing.
+         --lsrr
+           To match packets with the flag loose source routing.
+         --no-srr
+           To match packets with no flag for source routing.
+         [!] --rr
+           To match packets with the RR flag.
+         [!] --ts
+           To match packets with the TS flag.
+         [!] --ra
+           To match packets with the router-alert option.
+         [!] --any-opt
+           To match a packet with at least one IP option, or no IP option
+           at all if ! is chosen.
+         
+         Example:
+           $ iptables -A input -m ipv4options --rr -j DROP
+           will drop packets with the record-route flag.
+         
+           $ iptables -A input -m ipv4options --ts -j DROP
+           will drop packets with the timestamp flag.
+
+config IP_NF_MATCH_MPORT
+       tristate  'Multiple port with ranges match support'
+       depends on IP_NF_IPTABLES
+         help
+         This module is an enhanced multiport match. It has support for byte
+         ranges as well as for single ports.
+         Up to 15 ports are allowed. Note that a portrange uses up 2 port values.
+         
+         Examples:
+         # iptables -A FORWARD -p tcp -m mport --ports 23:42,65
+
+config IP_NF_MATCH_NTH
+       tristate  'Nth match support'
+       depends on IP_NF_IPTABLES
+         help
+         This option adds an iptables `Nth' match, which allows you to match every Nth
+         packet encountered.  By default there are 16 different counters that can be
+         used.
+         
+         This match functions in one of two ways
+         1) Match ever Nth packet, and only the Nth packet.
+            example:
+             iptables -t mangle -A PREROUTING -m nth --every 10 -j DROP
+            This rule will drop every 10th packet.
+         2) Unique rule for every packet.  This is an easy and quick
+            method to produce load-balancing for both inbound and outbound.
+            example:
+             iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \
+                      --every 3 --packet 0 -j SNAT --to-source 10.0.0.5
+             iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \
+                      --every 3 --packet 1 -j SNAT --to-source 10.0.0.6
+             iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \
+                      --every 3 --packet 2 -j SNAT --to-source 10.0.0.7
+            This example evenly splits connections between the three SNAT
+            addresses.
+         
+            By using the mangle table and iproute2, you can setup complex
+            load-balanced routing.  There's lot of other uses.  Be creative!
+         
+         Suppported options are:
+            --every     Nth         Match every Nth packet
+           [--counter]  num         Use counter 0-15 (default:0)
+           [--start]    num         Initialize the counter at the number 'num'
+                                    instead of 0. Must be between 0 and Nth-1
+           [--packet]   num         Match on 'num' packet. Must be between 0
+                                    and Nth-1.
+                                    If --packet is used for a counter than
+                                    there must be Nth number of --packet
+                                    rules, covering all values between 0 and
+                                    Nth-1 inclusively.
+
+config IP_NF_MATCH_OSF
+       tristate  'OSF match support'
+       depends on IP_NF_IPTABLES
+         help
+         The idea of passive OS fingerprint matching exists for quite a long time,
+         but was created as extension fo OpenBSD pf only some weeks ago.
+         Original idea was lurked in some OpenBSD mailing list (thanks
+         grange@open...) and than adopted for Linux netfilter in form of this code.
+         
+         Original table was created by Michal Zalewski <lcamtuf@coredump.cx> for
+         his excellent p0f and than changed a bit for more convenience.
+         
+         This module compares some data(WS, MSS, options and it's order, ttl,
+         df and others) from first SYN packet (actually from packets with SYN
+         bit set) with hardcoded in fingers[] table ones.
+         
+         Example: (Of course this only an example, do not get inspired by this)
+         
+         # iptables -N LINUX
+         # iptables -A LINUX -j LOG --log-prefix "Linux"
+         
+         # iptables -A INPUT -p tcp -m osf --genre Linux -j LINUX
+         # iptables -A INPUT -p tcp -m osf --genre FreeBSD -j REJECT
+         
+         NOTE: -p tcp is obviously required as it is a TCP match.
+         
+         OSF also has:
+         --log 1/0. 
+               If present, OSF will log determined genres even if they don't match
+               desired one.    
+               0 - log all determined entries, 
+               1 - only first one.
+               
+               Example:
+               #iptables -I INPUT -j ACCEPT -p tcp -m osf --genre Linux --log 1 --smart
+         
+               In syslog you find something like this:
+               ipt_osf: Windows [Windows XP Pro SP1, 2000 SP3]: 11.22.33.55:4024 -> 11.22.33.44:139
+               ipt_osf: Unknown: 16384:106:1:48:020405B401010402 44.33.22.11:1239 -> 11.22.33.44:80
+         
+           --smart
+               if present, OSF will use some smartness to determine remote OS.
+               Now only not use TTL( with it far remote machines can be determined).
+         
+         Fingerprints can be loaded through /proc/sys/net/ipv4/osf file.
+         Only one fingerprint per open/close.
+         
+         Fingerprints can be downloaded from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os
+
+config IP_POOL_STATISTICS
+       bool  'enable statistics on pool usage'
+       depends on IP_NF_POOL!=n
+
+config IP_NF_POOL
+       tristate  'IP address pool support'
+       depends on IP_NF_IPTABLES
+         help
+         CONFIG_IP_NF_POOL provides a match which lets you use bitmaps with one bit per
+         address from some range of IP addresses; the match depends on whether a checked
+         source or destination address has its bit set in the pool.  It also provides a
+         POOL target, which can be used to add or remove the addresses of a packet
+         to/from a pool.
+         
+         There is also a POOL netfilter target, which can be used to set or remove the
+         addresses of a packet from a pool.
+         
+         To define and use pools, you need userlevel utilities: a patched iptables, and
+         the program ippool(8), which defines the pools and their bounds.  The current
+         release of pool matching is ippool-0.0.2, and can be found in the archives of
+         the netfilter mailing list at http://lists.netfilter.org/.
+
+config IP_NF_MATCH_PSD
+       tristate  'psd match support'
+       depends on IP_NF_IPTABLES
+         help
+         This option adds a `psd' match, which supplies portscan
+         detection match (psd). This match will attempt to detect TCP and UDP
+         port scans. This match was derived from Solar Designer's scanlogd.
+         
+         Suppported options are:
+         
+         --psd-weight-threshold <threshold>
+         
+           Total weight of the latest TCP/UDP packets with different
+           destination ports coming from the same host to be treated as port
+           scan sequence.
+         
+         --psd-delay-threshold <delay>
+         
+           Delay (in hundredths of second) for the packets with different
+           destination ports coming from the same host to be treated as
+           possible port scan subsequence.
+         
+         --psd-lo-ports-weight <weight>
+         
+           Weight of the packet with privileged (<=1024) destination port.
+         
+         --psd-hi-ports-weight <weight>
+         
+           Weight of the packet with non-priviliged destination port.
+
+config IP_NF_MATCH_QUOTA
+       tristate  'quota match support'
+       depends on IP_NF_IPTABLES
+         help
+         This option adds CONFIG_IP_NF_MATCH_QUOTA, which implements network
+         quotas by decrementing a byte counter with each packet.
+         
+         Supported options are:
+         --quota <bytes>
+           The quota in bytes.
+         
+         KNOWN BUGS: this does not work on SMP systems.
+         
+
+config IP_NF_MATCH_RANDOM
+       tristate  'random match support'
+       depends on IP_NF_IPTABLES
+         help
+         This option adds a `random' match,
+         which allow you to match packets randomly
+         following a given probability. 
+         
+         Suppported options are:
+         
+         [--average]   percent will match randomly packets with a probability of
+                       'percent'. default is 50%
+
+config IP_NF_MATCH_REALM
+       tristate  'realm match support'
+       depends on IP_NF_IPTABLES
+         help
+         realm match: uses realm key from routing as match criteria similiar to
+                      one in packet classifier
+         
+         /** snip from packet classifier documentation */
+         Routing tables based classifier
+         CONFIG_NET_CLS_ROUTE4
+           If you say Y here, you will be able to classify outgoing packets
+           according to the route table entry they matched. If unsure, say Y.
+         /** end snip **/
+         
+         
+         # Example
+         # add route
+         /sbin/ip route add 194.29.194.0/24 via 194.29.192.1 realm 10
+         
+         # source realm is in realm with mask 0xFFFF0000,
+         # destination is in realm with mask 0x0000FFFF
+         
+         # match destination realm
+         /usr/local/sbin/iptables -A OUTPUT -m realm --realm 10 -j LOG
+         
+         # match realm of source, this is also determinated by routing,
+         /usr/local/sbin/iptables -A INPUT -m realm --realm 655360 -j LOG
+         
+         THIS PATCH REQUIRES CONFIG_NET_CLS_ROUTE TO BE SET
+
+config IP_NF_MATCH_TIME
+       tristate  'TIME match support'
+       depends on IP_NF_IPTABLES
+         help
+         
+         This option adds CONFIG_IP_NF_MATCH_TIME, which supplies a time match module.
+         This match allows you to filter based on the packet arrival time
+         (arrival time at the machine which the netfilter is running on) or
+         departure time (for locally generated packets).
+         
+         Supported options are:
+         --timestart HH:MM
+           The starting point of the time match frame.
+         
+         --timestop HH:MM
+           The stopping point of the time match frame
+         
+         --days Tue,Mon...
+           Days of the week to match separated by a coma, no space
+           (one of Sun,Mon,Tue,Wed,Thu,Fri,Sat)
+         
+         Example:
+           -A INPUT -m time --timestart 8:00 --timestop 18:00 --days Mon,Tue,Wed,Thu,Fri
+           will match packets that have an arrival timestamp in the range 8:00->18:00 from Monday
+           to Friday.
+         
+           -A OUTPUT -m time --timestart 8:00 --timestop 18:00 --Days Mon
+           will match the packets (locally generated) that have a departure timestamp
+           in the range 8:00->18:00 on Monday only.
+
+config IP_NF_MATCH_U32
+       tristate  'U32 match support'
+       depends on IP_NF_IPTABLES
+         help
+         
+         U32 allows you to extract quantities of up to 4 bytes from a packet,
+         AND them with specified masks, shift them by specified amounts and
+         test whether the results are in any of a set of specified ranges.
+         The specification of what to extract is general enough to skip over
+         headers with lengths stored in the packet, as in IP or TCP header
+         lengths.
+         Details and examples are in the kernel module source.
+
 endmenu
 
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/Makefile linux-2.6.3-rc3/net/ipv4/netfilter/Makefile
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/Makefile     2004-02-16 10:08:59.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/Makefile 2004-02-16 11:07:28.178208252 +0100
@@ -42,15 +42,38 @@
 # matches
 obj-$(CONFIG_IP_NF_MATCH_HELPER) += ipt_helper.o
 obj-$(CONFIG_IP_NF_MATCH_LIMIT) += ipt_limit.o
+obj-$(CONFIG_IP_NF_MATCH_QUOTA) += ipt_quota.o
+obj-$(CONFIG_IP_NF_MATCH_DSTLIMIT) += ipt_dstlimit.o
 obj-$(CONFIG_IP_NF_MATCH_MARK) += ipt_mark.o
+obj-$(CONFIG_IP_NF_POOL) += ipt_pool.o ipt_POOL.o ip_pool.o
 obj-$(CONFIG_IP_NF_MATCH_MAC) += ipt_mac.o
 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
 
 obj-$(CONFIG_IP_NF_MATCH_PKTTYPE) += ipt_pkttype.o
 obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
+
+obj-$(CONFIG_IP_NF_MATCH_MPORT) += ipt_mport.o
+
 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 
+obj-$(CONFIG_IP_NF_MATCH_TIME) += ipt_time.o
+
+
+obj-$(CONFIG_IP_NF_MATCH_RANDOM) += ipt_random.o
+
+obj-$(CONFIG_IP_NF_MATCH_PSD) += ipt_psd.o
+
+obj-$(CONFIG_IP_NF_MATCH_OSF) += ipt_osf.o
+
+
+obj-$(CONFIG_IP_NF_MATCH_NTH) += ipt_nth.o
+
+obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o
+
+
+obj-$(CONFIG_IP_NF_MATCH_FUZZY) += ipt_fuzzy.o
+
 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
 
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
@@ -59,10 +82,15 @@
 
 obj-$(CONFIG_IP_NF_MATCH_LENGTH) += ipt_length.o
 
+obj-$(CONFIG_IP_NF_MATCH_U32) += ipt_u32.o
+
+
 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 obj-$(CONFIG_IP_NF_MATCH_STATE) += ipt_state.o
+obj-$(CONFIG_IP_NF_MATCH_CONNLIMIT) += ipt_connlimit.o
 obj-$(CONFIG_IP_NF_MATCH_CONNTRACK) += ipt_conntrack.o
 obj-$(CONFIG_IP_NF_MATCH_TCPMSS) += ipt_tcpmss.o
+obj-$(CONFIG_IP_NF_MATCH_REALM) += ipt_realm.o
 
 obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o
 
@@ -80,6 +108,9 @@
 obj-$(CONFIG_IP_NF_TARGET_CLASSIFY) += ipt_CLASSIFY.o
 obj-$(CONFIG_IP_NF_NAT_SNMP_BASIC) += ip_nat_snmp_basic.o
 obj-$(CONFIG_IP_NF_TARGET_LOG) += ipt_LOG.o
+obj-$(CONFIG_IP_NF_TARGET_TTL) += ipt_TTL.o
+obj-$(CONFIG_IP_NF_TARGET_NETLINK) += ipt_NETLINK.o
+obj-$(CONFIG_IP_NF_TARGET_IPV4OPTSSTRIP) += ipt_IPV4OPTSSTRIP.o
 obj-$(CONFIG_IP_NF_TARGET_ULOG) += ipt_ULOG.o
 obj-$(CONFIG_IP_NF_TARGET_TCPMSS) += ipt_TCPMSS.o
 
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ip_pool.c linux-2.6.3-rc3/net/ipv4/netfilter/ip_pool.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ip_pool.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ip_pool.c        2004-02-16 11:07:21.518803072 +0100
@@ -0,0 +1,332 @@
+/* Kernel module for IP pool management */
+
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ip_pool.h>
+#include <linux/errno.h>
+#include <asm/uaccess.h>
+#include <asm/bitops.h>
+#include <linux/interrupt.h>
+#include <linux/spinlock.h>
+
+#if 0
+#define DP printk
+#else
+#define DP(format, args...)
+#endif
+
+MODULE_LICENSE("GPL");
+
+#define NR_POOL 16
+static int nr_pool = NR_POOL;/* overwrite this when loading module */
+
+struct ip_pool {
+       u_int32_t first_ip;     /* host byte order, included in range */
+       u_int32_t last_ip;      /* host byte order, included in range */
+       void *members;          /* the bitmap proper */
+       int nr_use;             /* total nr. of tests through this */
+       int nr_match;           /* total nr. of matches through this */
+       rwlock_t lock;
+};
+
+static struct ip_pool *POOL;
+
+static inline struct ip_pool *lookup(ip_pool_t index)
+{
+       if (index < 0 || index >= nr_pool) {
+               DP("ip_pool:lookup: bad index %d\n", index);
+               return 0;
+       }
+       return POOL+index;
+}
+
+int ip_pool_match(ip_pool_t index, u_int32_t addr)
+{
+        struct ip_pool *pool = lookup(index);
+       int res = 0;
+
+       if (!pool || !pool->members)
+               return 0;
+       read_lock_bh(&pool->lock);
+       if (pool->members) {
+               if (addr >= pool->first_ip && addr <= pool->last_ip) {
+                       addr -= pool->first_ip;
+                       if (test_bit(addr, pool->members)) {
+                               res = 1;
+#ifdef CONFIG_IP_POOL_STATISTICS
+                               pool->nr_match++;
+#endif
+                       }
+               }
+#ifdef CONFIG_IP_POOL_STATISTICS
+               pool->nr_use++;
+#endif
+       }
+       read_unlock_bh(&pool->lock);
+       return res;
+}
+
+static int pool_change(ip_pool_t index, u_int32_t addr, int isdel)
+{
+       struct ip_pool *pool;
+       int res = -1;
+
+       pool = lookup(index);
+       if (    !pool || !pool->members
+            || addr < pool->first_ip || addr > pool->last_ip)
+               return -1;
+       read_lock_bh(&pool->lock);
+       if (pool->members && addr >= pool->first_ip && addr <= pool->last_ip) {
+               addr -= pool->first_ip;
+               res = isdel
+                       ? (0 != test_and_clear_bit(addr, pool->members))
+                       : (0 != test_and_set_bit(addr, pool->members));
+       }
+       read_unlock_bh(&pool->lock);
+       return res;
+}
+
+int ip_pool_mod(ip_pool_t index, u_int32_t addr, int isdel)
+{
+       int res = pool_change(index,addr,isdel);
+
+       if (!isdel) res = !res;
+       return res;
+}
+
+static inline int bitmap_bytes(u_int32_t a, u_int32_t b)
+{
+       return 4*((((b-a+8)/8)+3)/4);
+}
+
+static inline int poolbytes(ip_pool_t index)
+{
+       struct ip_pool *pool = lookup(index);
+
+       return pool ? bitmap_bytes(pool->first_ip, pool->last_ip) : 0;
+}
+
+static int setpool(
+       struct sock *sk,
+       int optval,
+       void *user,
+       unsigned int len
+) {
+       struct ip_pool_request req;
+
+       DP("ip_pool:setpool: optval=%d, user=%p, len=%d\n", optval, user, len);
+       if (!capable(CAP_NET_ADMIN))
+               return -EPERM;
+       if (optval != SO_IP_POOL)
+               return -EBADF;
+       if (len != sizeof(req))
+               return -EINVAL;
+       if (copy_from_user(&req, user, sizeof(req)) != 0)
+               return -EFAULT;
+       printk("obsolete op - upgrade your ippool(8) utility.\n");
+       return -EINVAL;
+}
+
+static int getpool(
+       struct sock *sk,
+       int optval,
+       void *user,
+       int *len
+) {
+       struct ip_pool_request req;
+       struct ip_pool *pool;
+       ip_pool_t i;
+       int newbytes;
+       void *newmembers;
+       int res;
+
+       DP("ip_pool:getpool: optval=%d, user=%p\n", optval, user);
+       if (!capable(CAP_NET_ADMIN))
+               return -EINVAL;
+       if (optval != SO_IP_POOL)
+               return -EINVAL;
+       if (*len != sizeof(req)) {
+               return -EFAULT;
+       }
+       if (copy_from_user(&req, user, sizeof(req)) != 0)
+               return -EFAULT;
+       DP("ip_pool:getpool op=%d, index=%d\n", req.op, req.index);
+       if (req.op < IP_POOL_BAD001) {
+               printk("obsolete op - upgrade your ippool(8) utility.\n");
+               return -EFAULT;
+       }
+       switch(req.op) {
+       case IP_POOL_HIGH_NR:
+               DP("ip_pool HIGH_NR\n");
+               req.index = IP_POOL_NONE;
+               for (i=0; i<nr_pool; i++)
+                       if (POOL[i].members)
+                               req.index = i;
+               return copy_to_user(user, &req, sizeof(req));
+       case IP_POOL_LOOKUP:
+               DP("ip_pool LOOKUP\n");
+               pool = lookup(req.index);
+               if (!pool)
+                       return -EINVAL;
+               if (!pool->members)
+                       return -EBADF;
+               req.addr = htonl(pool->first_ip);
+               req.addr2 = htonl(pool->last_ip);
+               return copy_to_user(user, &req, sizeof(req));
+       case IP_POOL_USAGE:
+               DP("ip_pool USE\n");
+               pool = lookup(req.index);
+               if (!pool)
+                       return -EINVAL;
+               if (!pool->members)
+                       return -EBADF;
+               req.addr = pool->nr_use;
+               req.addr2 = pool->nr_match;
+               return copy_to_user(user, &req, sizeof(req));
+       case IP_POOL_TEST_ADDR:
+               DP("ip_pool TEST 0x%08x\n", req.addr);
+               pool = lookup(req.index);
+               if (!pool)
+                       return -EINVAL;
+               res = 0;
+               read_lock_bh(&pool->lock);
+               if (!pool->members) {
+                       DP("ip_pool TEST_ADDR no members in pool\n");
+                       res = -EBADF;
+                       goto unlock_and_return_res;
+               }
+               req.addr = ntohl(req.addr);
+               if (req.addr < pool->first_ip) {
+                       DP("ip_pool TEST_ADDR address < pool bounds\n");
+                       res = -ERANGE;
+                       goto unlock_and_return_res;
+               }
+               if (req.addr > pool->last_ip) {
+                       DP("ip_pool TEST_ADDR address > pool bounds\n");
+                       res = -ERANGE;
+                       goto unlock_and_return_res;
+               }
+               req.addr = (0 != test_bit((req.addr - pool->first_ip),
+                                       pool->members));
+               read_unlock_bh(&pool->lock);
+               return copy_to_user(user, &req, sizeof(req));
+       case IP_POOL_FLUSH:
+               DP("ip_pool FLUSH not yet implemented.\n");
+               return -EBUSY;
+       case IP_POOL_DESTROY:
+               DP("ip_pool DESTROY not yet implemented.\n");
+               return -EBUSY;
+       case IP_POOL_INIT:
+               DP("ip_pool INIT 0x%08x-0x%08x\n", req.addr, req.addr2);
+               pool = lookup(req.index);
+               if (!pool)
+                       return -EINVAL;
+               req.addr = ntohl(req.addr);
+               req.addr2 = ntohl(req.addr2);
+               if (req.addr > req.addr2) {
+                       DP("ip_pool INIT bad ip range\n");
+                       return -EINVAL;
+               }
+               newbytes = bitmap_bytes(req.addr, req.addr2);
+               newmembers = kmalloc(newbytes, GFP_KERNEL);
+               if (!newmembers) {
+                       DP("ip_pool INIT out of mem for %d bytes\n", newbytes);
+                       return -ENOMEM;
+               }
+               memset(newmembers, 0, newbytes);
+               write_lock_bh(&pool->lock);
+               if (pool->members) {
+                       DP("ip_pool INIT pool %d exists\n", req.index);
+                       kfree(newmembers);
+                       res = -EBUSY;
+                       goto unlock_and_return_res;
+               }
+               pool->first_ip = req.addr;
+               pool->last_ip = req.addr2;
+               pool->nr_use = 0;
+               pool->nr_match = 0;
+               pool->members = newmembers;
+               write_unlock_bh(&pool->lock);
+               return 0;
+       case IP_POOL_ADD_ADDR:
+               DP("ip_pool ADD_ADDR 0x%08x\n", req.addr);
+               req.addr = pool_change(req.index, ntohl(req.addr), 0);
+               return copy_to_user(user, &req, sizeof(req));
+       case IP_POOL_DEL_ADDR:
+               DP("ip_pool DEL_ADDR 0x%08x\n", req.addr);
+               req.addr = pool_change(req.index, ntohl(req.addr), 1);
+               return copy_to_user(user, &req, sizeof(req));
+       default:
+               DP("ip_pool:getpool bad op %d\n", req.op);
+               return -EINVAL;
+       }
+       return -EINVAL;
+
+unlock_and_return_res:
+       if (pool)
+               read_unlock_bh(&pool->lock);
+       return res;
+}
+
+static struct nf_sockopt_ops so_pool
+= { { NULL, NULL }, PF_INET,
+    SO_IP_POOL, SO_IP_POOL+1, &setpool,
+    SO_IP_POOL, SO_IP_POOL+1, &getpool,
+    0, NULL };
+
+MODULE_PARM(nr_pool, "i");
+
+static int __init init(void)
+{
+       ip_pool_t i;
+       int res;
+
+       if (nr_pool < 1) {
+               printk("ip_pool module init: bad nr_pool %d\n", nr_pool);
+               return -EINVAL;
+       }
+       POOL = kmalloc(nr_pool * sizeof(*POOL), GFP_KERNEL);
+       if (!POOL) {
+               printk("ip_pool module init: out of memory for nr_pool %d\n",
+                       nr_pool);
+               return -ENOMEM;
+       }
+       for (i=0; i<nr_pool; i++) {
+               POOL[i].first_ip = 0;
+               POOL[i].last_ip = 0;
+               POOL[i].members = 0;
+               POOL[i].nr_use = 0;
+               POOL[i].nr_match = 0;
+               POOL[i].lock = RW_LOCK_UNLOCKED;
+       }
+       res = nf_register_sockopt(&so_pool);
+       DP("ip_pool:init %d pools, result %d\n", nr_pool, res);
+       if (res != 0) {
+               kfree(POOL);
+               POOL = 0;
+       }
+       return res;
+}
+
+static void __exit fini(void)
+{
+       ip_pool_t i;
+
+       DP("ip_pool:fini BYEBYE\n");
+       nf_unregister_sockopt(&so_pool);
+       for (i=0; i<nr_pool; i++) {
+               if (POOL[i].members) {
+                       kfree(POOL[i].members);
+                       POOL[i].members = 0;
+               }
+       }
+       kfree(POOL);
+       POOL = 0;
+       DP("ip_pool:fini these are the famous last words\n");
+       return;
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_IPV4OPTSSTRIP.c      2004-02-16 11:06:57.518550655 +0100
@@ -0,0 +1,84 @@
+/**
+ * Strip all IP options in the IP packet header.
+ *
+ * (C) 2001 by Fabrice MARIE <fabrice@netfilter.org>
+ * This software is distributed under GNU GPL v2, 1991
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
+MODULE_DESCRIPTION("Strip all options in IPv4 packets");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+target(struct sk_buff **pskb,
+       unsigned int hooknum,
+       const struct net_device *in,
+       const struct net_device *out,
+       const void *targinfo,
+       void *userinfo)
+{
+       struct iphdr *iph = (*pskb)->nh.iph;
+       struct sk_buff *skb = (*pskb);
+       struct ip_options * opt;
+       unsigned char * optiph = skb->nh.raw;
+       int l = ((struct ip_options *)(&(IPCB(skb)->opt)))->optlen;
+       
+
+       /* if no options in packet then nothing to clear. */
+       if (iph->ihl * 4 == sizeof(struct iphdr))
+               return IPT_CONTINUE;
+
+       /* else clear all options */
+       memset(&(IPCB(skb)->opt), 0, sizeof(struct ip_options));
+       memset(optiph+sizeof(struct iphdr), IPOPT_NOOP, l);
+       opt = &(IPCB(skb)->opt);
+       opt->is_data = 0;
+       opt->optlen = l;
+
+       skb->nfcache |= NFC_ALTERED;
+
+        return IPT_CONTINUE;
+}
+
+static int
+checkentry(const char *tablename,
+          const struct ipt_entry *e,
+           void *targinfo,
+           unsigned int targinfosize,
+           unsigned int hook_mask)
+{
+       if (strcmp(tablename, "mangle")) {
+               printk(KERN_WARNING "IPV4OPTSSTRIP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
+               return 0;
+       }
+       /* nothing else to check because no parameters */
+       return 1;
+}
+
+static struct ipt_target ipt_ipv4optsstrip_reg
+= { { NULL, NULL }, "IPV4OPTSSTRIP", target, checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ipt_register_target(&ipt_ipv4optsstrip_reg))
+               return -EINVAL;
+       printk("ipt_IPV4OPTSSTRIP loaded\n");
+
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_target(&ipt_ipv4optsstrip_reg);
+       printk("ipt_IPV4OPTSSTRIP unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_NETLINK.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_NETLINK.c        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_NETLINK.c    2004-02-16 11:07:05.880548139 +0100
@@ -0,0 +1,119 @@
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/config.h>
+#include <linux/socket.h>
+#include <linux/skbuff.h>
+#include <linux/kernel.h>
+#include <linux/netlink.h>
+#include <linux/netdevice.h>
+#include <linux/mm.h>
+#include <linux/socket.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_NETLINK.h>
+#include <net/sock.h>
+
+MODULE_AUTHOR("Gianni Tedesco <gianni@ecsc.co.uk>");
+MODULE_DESCRIPTION("Provides iptables NETLINK target similar to ipchains -o");
+MODULE_LICENSE("GPL");
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+static struct sock *ipfwsk;
+
+static unsigned int ipt_netlink_target(struct sk_buff **pskb,
+                                   unsigned int hooknum,
+                                   const struct net_device *in,
+                                   const struct net_device *out,
+                                   const void *targinfo, void *userinfo)
+{
+       struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
+       struct iphdr *ip = (*pskb)->nh.iph;
+       struct sk_buff *outskb;
+       struct netlink_t nlhdr;
+       size_t len=0;
+
+       /* Allocate a socket buffer */
+       if ( MASK(nld->flags, USE_SIZE) )
+               len = nld->size+sizeof(nlhdr);
+       else
+               len = ntohs(ip->tot_len)+sizeof(nlhdr); 
+
+       outskb=alloc_skb(len, GFP_ATOMIC);
+
+       if (outskb) {
+               nlhdr.len=len;
+               
+               if ( MASK(nld->flags, USE_MARK) )
+                       nlhdr.mark=(*pskb)->nfmark=nld->mark;
+               else
+                       nlhdr.mark=(*pskb)->nfmark;
+               
+               if ( in && in->name ) {
+                       strncpy((char *)&nlhdr.iface, in->name, IFNAMSIZ);
+               }else if ( out && out->name ){
+                       strncpy((char *)&nlhdr.iface, out->name, IFNAMSIZ);
+               }
+
+               skb_put(outskb, len);
+               memcpy(outskb->data, &nlhdr, sizeof(nlhdr));
+               memcpy((outskb->data)+sizeof(nlhdr), ip, len-sizeof(nlhdr));
+               netlink_broadcast(ipfwsk, outskb, 0, ~0, GFP_ATOMIC);
+       }else{
+               if (net_ratelimit())
+                       printk(KERN_WARNING "ipt_NETLINK: packet drop due to netlink failure\n");
+       }
+
+       if ( MASK(nld->flags, USE_DROP) )
+               return NF_DROP;
+
+       return IPT_CONTINUE;
+}
+
+static int ipt_netlink_checkentry(const char *tablename,
+                              const struct ipt_entry *e,
+                              void *targinfo,
+                              unsigned int targinfosize,
+                              unsigned int hookmask)
+{
+       //struct ipt_nldata *nld = (struct ipt_nldata *)targinfo;
+
+       return 1;
+}
+
+static struct ipt_target ipt_netlink_reg = { 
+       {NULL, NULL},
+       "NETLINK",
+       ipt_netlink_target,
+       ipt_netlink_checkentry,
+       NULL,
+       THIS_MODULE
+};
+
+static int __init init(void)
+{
+       DEBUGP("ipt_NETLINK: init module\n");   
+
+       if (ipt_register_target(&ipt_netlink_reg) != 0) {
+               return -EINVAL;
+       }
+
+       if ( !(ipfwsk=netlink_kernel_create(NETLINK_FIREWALL, NULL)) ){
+               return -EINVAL;
+       }
+
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       DEBUGP("ipt_NETLINK: cleanup_module\n");
+       ipt_unregister_target(&ipt_netlink_reg);
+//     if(ipfwsk->socket) sock_release(ipfwsk->socket);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_POOL.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_POOL.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_POOL.c   1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_POOL.c       2004-02-16 11:07:21.518803072 +0100
@@ -0,0 +1,116 @@
+/* ipt_POOL.c - netfilter target to manipulate IP pools
+ *
+ * This target can be used almost everywhere. It acts on some specified
+ * IP pool, adding or deleting some IP address in the pool. The address
+ * can be either the source (--addsrc, --delsrc), or destination (--add/deldst)
+ * of the packet under inspection.
+ *
+ * The target normally returns IPT_CONTINUE.
+ */
+
+#include <linux/types.h>
+#include <linux/ip.h>
+#include <linux/timer.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/netdevice.h>
+#include <linux/if.h>
+#include <linux/inetdevice.h>
+#include <net/protocol.h>
+#include <net/checksum.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_ipv4/ip_nat_rule.h>
+#include <linux/netfilter_ipv4/ipt_pool.h>
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+/*** NOTE NOTE NOTE NOTE ***
+**
+** By sheer luck, I get away with using the "struct ipt_pool_info", as defined
+** in <linux/netfilter_ipv4/ipt_pool.h>, both as the match and target info.
+** Here, in the target implementation, ipt_pool_info.src, if not IP_POOL_NONE,
+** is modified for the source IP address of the packet under inspection.
+** The same way, the ipt_pool_info.dst pool is modified for the destination.
+**
+** The address is added to the pool normally. However, if IPT_POOL_DEL_dir
+** flag is set in ipt_pool_info.flags, the address is deleted from the pool.
+**
+** If a modification was done to the pool, we possibly return ACCEPT or DROP,
+** if the right IPT_POOL_MOD_dir_ACCEPT or _MOD_dir_DROP flags are set.
+** The IPT_POOL_INV_MOD_dir flag inverts the sense of the check (i.e. the
+** ACCEPT and DROP flags are evaluated when the pool was not modified.)
+*/
+
+static int
+do_check(const char *tablename,
+              const struct ipt_entry *e,
+              void *targinfo,
+              unsigned int targinfosize,
+              unsigned int hook_mask)
+{
+       const struct ipt_pool_info *ipi = targinfo;
+
+       if (targinfosize != IPT_ALIGN(sizeof(*ipi))) {
+               DEBUGP("POOL_check: size %u.\n", targinfosize);
+               return 0;
+       }
+       DEBUGP("ipt_POOL:do_check(%d,%d,%d)\n",ipi->src,ipi->dst,ipi->flags);
+       return 1;
+}
+
+static unsigned int
+do_target(struct sk_buff **pskb,
+               unsigned int hooknum,
+               const struct net_device *in,
+               const struct net_device *out,
+               const void *targinfo,
+               void *userinfo)
+{
+       const struct ipt_pool_info *ipi = targinfo;
+       int modified;
+       unsigned int verdict = IPT_CONTINUE;
+
+       if (ipi->src != IP_POOL_NONE) {
+               modified = ip_pool_mod(ipi->src, ntohl((*pskb)->nh.iph->saddr),
+                                       ipi->flags & IPT_POOL_DEL_SRC);
+               if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_SRC)) {
+                       if (ipi->flags & IPT_POOL_MOD_SRC_ACCEPT)
+                               verdict = NF_ACCEPT;
+                       else if (ipi->flags & IPT_POOL_MOD_SRC_DROP)
+                               verdict = NF_DROP;
+               }
+       }
+       if (verdict == IPT_CONTINUE && ipi->dst != IP_POOL_NONE) {
+               modified = ip_pool_mod(ipi->dst, ntohl((*pskb)->nh.iph->daddr),
+                                       ipi->flags & IPT_POOL_DEL_DST);
+               if (!!modified ^ !!(ipi->flags & IPT_POOL_INV_MOD_DST)) {
+                       if (ipi->flags & IPT_POOL_MOD_DST_ACCEPT)
+                               verdict = NF_ACCEPT;
+                       else if (ipi->flags & IPT_POOL_MOD_DST_DROP)
+                               verdict = NF_DROP;
+               }
+       }
+       return verdict;
+}
+
+static struct ipt_target pool_reg
+= { { NULL, NULL }, "POOL", do_target, do_check, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       DEBUGP("init ipt_POOL\n");
+       return ipt_register_target(&pool_reg);
+}
+
+static void __exit fini(void)
+{
+       DEBUGP("fini ipt_POOL\n");
+       ipt_unregister_target(&pool_reg);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_TTL.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_TTL.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_TTL.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_TTL.c        2004-02-16 11:07:09.253740328 +0100
@@ -0,0 +1,110 @@
+/* TTL modification target for IP tables
+ * (C) 2000 by Harald Welte <laforge@gnumonks.org>
+ *
+ * Version: 1.8
+ *
+ * This software is distributed under the terms of GNU GPL
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/checksum.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_TTL.h>
+
+MODULE_AUTHOR("Harald Welte <laforge@gnumonks.org>");
+MODULE_DESCRIPTION("IP tables TTL modification module");
+MODULE_LICENSE("GPL");
+
+static unsigned int ipt_ttl_target(struct sk_buff **pskb, unsigned int hooknum,
+               const struct net_device *in, const struct net_device *out,
+               const void *targinfo, void *userinfo)
+{
+       struct iphdr *iph = (*pskb)->nh.iph;
+       const struct ipt_TTL_info *info = targinfo;
+       u_int16_t diffs[2];
+       int new_ttl;
+                        
+       switch (info->mode) {
+               case IPT_TTL_SET:
+                       new_ttl = info->ttl;
+                       break;
+               case IPT_TTL_INC:
+                       new_ttl = iph->ttl + info->ttl;
+                       if (new_ttl > 255)
+                               new_ttl = 255;
+                       break;
+               case IPT_TTL_DEC:
+                       new_ttl = iph->ttl + info->ttl;
+                       if (new_ttl < 0)
+                               new_ttl = 0;
+                       break;
+               default:
+                       new_ttl = iph->ttl;
+                       break;
+       }
+
+       if (new_ttl != iph->ttl) {
+               diffs[0] = htons(((unsigned)iph->ttl) << 8) ^ 0xFFFF;
+               iph->ttl = new_ttl;
+               diffs[1] = htons(((unsigned)iph->ttl) << 8);
+               iph->check = csum_fold(csum_partial((char *)diffs,
+                                                   sizeof(diffs),
+                                                   iph->check^0xFFFF));
+                                                                                               (*pskb)->nfcache |= NFC_ALTERED;
+       }
+
+       return IPT_CONTINUE;
+}
+
+static int ipt_ttl_checkentry(const char *tablename,
+               const struct ipt_entry *e,
+               void *targinfo,
+               unsigned int targinfosize,
+               unsigned int hook_mask)
+{
+       struct ipt_TTL_info *info = targinfo;
+
+       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_TTL_info))) {
+               printk(KERN_WARNING "TTL: targinfosize %u != %Zu\n",
+                               targinfosize,
+                               IPT_ALIGN(sizeof(struct ipt_TTL_info)));
+               return 0;       
+       }       
+
+       if (strcmp(tablename, "mangle")) {
+               printk(KERN_WARNING "TTL: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
+               return 0;
+       }
+
+       if (info->mode > IPT_TTL_MAXMODE) {
+               printk(KERN_WARNING "TTL: invalid or unknown Mode %u\n", 
+                       info->mode);
+               return 0;
+       }
+
+       if ((info->mode != IPT_TTL_SET) && (info->ttl == 0)) {
+               printk(KERN_WARNING "TTL: increment/decrement doesn't make sense with value 0\n");
+               return 0;
+       }
+       
+       return 1;
+}
+
+static struct ipt_target ipt_TTL = { { NULL, NULL }, "TTL", 
+       ipt_ttl_target, ipt_ttl_checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ipt_register_target(&ipt_TTL);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_target(&ipt_TTL);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_connlimit.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_connlimit.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_connlimit.c      1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_connlimit.c  2004-02-16 11:07:11.549190614 +0100
@@ -0,0 +1,227 @@
+/*
+ * netfilter module to limit the number of parallel tcp
+ * connections per IP address.
+ *   (c) 2000 Gerd Knorr <kraxel@bytesex.org>
+ *   Nov 2002: Martin Bene <martin.bene@icomedias.com>:
+ *             only ignore TIME_WAIT or gone connections
+ *
+ * based on ...
+ *
+ * Kernel module to match connection tracking information.
+ * GPL (C) 1999  Rusty Russell (rusty@rustcorp.com.au).
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/list.h>
+#include <linux/netfilter_ipv4/ip_conntrack.h>
+#include <linux/netfilter_ipv4/ip_conntrack_core.h>
+#include <linux/netfilter_ipv4/ip_conntrack_tcp.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_connlimit.h>
+
+#define DEBUG 0
+
+MODULE_LICENSE("GPL");
+
+/* we'll save the tuples of all connections we care about */
+struct ipt_connlimit_conn
+{
+        struct list_head list;
+       struct ip_conntrack_tuple tuple;
+};
+
+struct ipt_connlimit_data {
+       spinlock_t lock;
+       struct list_head iphash[256];
+};
+
+static int ipt_iphash(u_int32_t addr)
+{
+       int hash;
+
+       hash  =  addr        & 0xff;
+       hash ^= (addr >>  8) & 0xff;
+       hash ^= (addr >> 16) & 0xff;
+       hash ^= (addr >> 24) & 0xff;
+       return hash;
+}
+
+static int count_them(struct ipt_connlimit_data *data,
+                     u_int32_t addr, u_int32_t mask,
+                     struct ip_conntrack *ct)
+{
+#if DEBUG
+       const static char *tcp[] = { "none", "established", "syn_sent", "syn_recv",
+                                    "fin_wait", "time_wait", "close", "close_wait",
+                                    "last_ack", "listen" };
+#endif
+       int addit = 1, matches = 0;
+       struct ip_conntrack_tuple tuple;
+       struct ip_conntrack_tuple_hash *found;
+       struct ipt_connlimit_conn *conn;
+       struct list_head *hash,*lh;
+
+       spin_lock(&data->lock);
+       tuple = ct->tuplehash[0].tuple;
+       hash = &data->iphash[ipt_iphash(addr & mask)];
+
+       /* check the saved connections */
+       for (lh = hash->next; lh != hash; lh = lh->next) {
+               conn = list_entry(lh,struct ipt_connlimit_conn,list);
+               found = ip_conntrack_find_get(&conn->tuple,ct);
+               if (0 == memcmp(&conn->tuple,&tuple,sizeof(tuple)) &&
+                   found != NULL &&
+                   found->ctrack->proto.tcp.state != TCP_CONNTRACK_TIME_WAIT) {
+                       /* Just to be sure we have it only once in the list.
+                          We should'nt see tuples twice unless someone hooks this
+                          into a table without "-p tcp --syn" */
+                       addit = 0;
+               }
+#if DEBUG
+               printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d %s\n",
+                      ipt_iphash(addr & mask),
+                      NIPQUAD(conn->tuple.src.ip), ntohs(conn->tuple.src.u.tcp.port),
+                      NIPQUAD(conn->tuple.dst.ip), ntohs(conn->tuple.dst.u.tcp.port),
+                      (NULL != found) ? tcp[found->ctrack->proto.tcp.state] : "gone");
+#endif
+               if (NULL == found) {
+                       /* this one is gone */
+                       lh = lh->prev;
+                       list_del(lh->next);
+                       kfree(conn);
+                       continue;
+               }
+               if (found->ctrack->proto.tcp.state == TCP_CONNTRACK_TIME_WAIT) {
+                       /* we don't care about connections which are
+                          closed already -> ditch it */
+                       lh = lh->prev;
+                       list_del(lh->next);
+                       kfree(conn);
+                       nf_conntrack_put(&found->ctrack->infos[0]);
+                       continue;
+               }
+               if ((addr & mask) == (conn->tuple.src.ip & mask)) {
+                       /* same source IP address -> be counted! */
+                       matches++;
+               }
+               nf_conntrack_put(&found->ctrack->infos[0]);
+       }
+       if (addit) {
+               /* save the new connection in our list */
+#if DEBUG
+               printk("ipt_connlimit [%d]: src=%u.%u.%u.%u:%d dst=%u.%u.%u.%u:%d new\n",
+                      ipt_iphash(addr & mask),
+                      NIPQUAD(tuple.src.ip), ntohs(tuple.src.u.tcp.port),
+                      NIPQUAD(tuple.dst.ip), ntohs(tuple.dst.u.tcp.port));
+#endif
+               conn = kmalloc(sizeof(*conn),GFP_ATOMIC);
+               if (NULL == conn)
+                       return -1;
+               memset(conn,0,sizeof(*conn));
+               INIT_LIST_HEAD(&conn->list);
+               conn->tuple = tuple;
+               list_add(&conn->list,hash);
+               matches++;
+       }
+       spin_unlock(&data->lock);
+       return matches;
+}
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       const struct ipt_connlimit_info *info = matchinfo;
+       int connections, match;
+       struct ip_conntrack *ct;
+       enum ip_conntrack_info ctinfo;
+
+       ct = ip_conntrack_get((struct sk_buff *)skb, &ctinfo);
+       if (NULL == ct) {
+               printk("ipt_connlimit: Oops: invalid ct state ?\n");
+               *hotdrop = 1;
+               return 0;
+       }
+       connections = count_them(info->data,skb->nh.iph->saddr,info->mask,ct);
+       if (-1 == connections) {
+               printk("ipt_connlimit: Hmm, kmalloc failed :-(\n");
+               *hotdrop = 1; /* let's free some memory :-) */
+               return 0;
+       }
+        match = (info->inverse) ? (connections <= info->limit) : (connections > info->limit);
+#if DEBUG
+       printk("ipt_connlimit: src=%u.%u.%u.%u mask=%u.%u.%u.%u "
+              "connections=%d limit=%d match=%s\n",
+              NIPQUAD(skb->nh.iph->saddr), NIPQUAD(info->mask),
+              connections, info->limit, match ? "yes" : "no");
+#endif
+
+       return match;
+}
+
+static int check(const char *tablename,
+                const struct ipt_ip *ip,
+                void *matchinfo,
+                unsigned int matchsize,
+                unsigned int hook_mask)
+{
+       struct ipt_connlimit_info *info = matchinfo;
+       int i;
+
+       /* verify size */
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_connlimit_info)))
+               return 0;
+
+       /* refuse anything but tcp */
+       if (ip->proto != IPPROTO_TCP)
+               return 0;
+
+       /* init private data */
+       info->data = kmalloc(sizeof(struct ipt_connlimit_data),GFP_KERNEL);
+       spin_lock_init(&(info->data->lock));
+       for (i = 0; i < 256; i++)
+               INIT_LIST_HEAD(&(info->data->iphash[i]));
+       
+       return 1;
+}
+
+static void destroy(void *matchinfo, unsigned int matchinfosize)
+{
+       struct ipt_connlimit_info *info = matchinfo;
+       struct ipt_connlimit_conn *conn;
+       struct list_head *hash;
+       int i;
+
+       /* cleanup */
+       for (i = 0; i < 256; i++) {
+               hash = &(info->data->iphash[i]);
+               while (hash != hash->next) {
+                       conn = list_entry(hash->next,struct ipt_connlimit_conn,list);
+                       list_del(hash->next);
+                       kfree(conn);
+               }
+       }
+       kfree(info->data);
+}
+
+static struct ipt_match connlimit_match
+= { { NULL, NULL }, "connlimit", &match, &check, &destroy, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ipt_register_match(&connlimit_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&connlimit_match);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_dstlimit.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_dstlimit.c       1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_dstlimit.c   2004-02-16 11:07:13.230787904 +0100
@@ -0,0 +1,623 @@
+/* iptables match extension to limit the number of packets per second
+ * seperately for each destination.
+ *
+ * (C) 2003 by Harald Welte <laforge@netfilter.org>
+ *
+ * Development of this code was funded by Astaro AG, http://www.astaro.com/
+ *
+ * based on ipt_limit.c by:
+ * Jérôme de Vivie     <devivie@info.enserb.u-bordeaux.fr>
+ * Hervé Eychenne      <eychenne@info.enserb.u-bordeaux.fr>
+ * Rusty Russell       <rusty@rustcorp.com.au>
+ *
+ * The general idea is to create a hash table for every dstip and have a
+ * seperate limit counter per tuple.  This way you can do something like 'limit
+ * the number of syn packets for each of my internal addresses.
+ *
+ * Ideally this would just be implemented as a general 'hash' match, which would
+ * allow us to attach any iptables target to it's hash buckets.  But this is
+ * not possible in the current iptables architecture.  As always, pkttables for
+ * 2.7.x will help ;)
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/random.h>
+#include <linux/jhash.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/proc_fs.h>
+#include <linux/seq_file.h>
+
+#define ASSERT_READ_LOCK(x) 
+#define ASSERT_WRITE_LOCK(x) 
+#include <linux/netfilter_ipv4/lockhelp.h>
+#include <linux/netfilter_ipv4/listhelp.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_dstlimit.h>
+
+/* FIXME: this is just for IP_NF_ASSERRT */
+#include <linux/netfilter_ipv4/ip_conntrack.h>
+
+#define MS2JIFFIES(x) ((x*HZ)/1000)
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
+MODULE_DESCRIPTION("iptables match for limiting per destination");
+
+/* need to declare this at the top */
+static struct proc_dir_entry *dstlimit_procdir;
+static struct file_operations dl_file_ops;
+
+/* hash table crap */
+
+struct dsthash_dst {
+       u_int32_t src_ip;
+       u_int32_t dst_ip;
+       u_int16_t port;
+};
+
+struct dsthash_ent {
+       /* static / read-only parts in the beginning */
+       struct list_head list;
+       struct dsthash_dst dst;
+
+       /* modified structure members in the end */
+       unsigned long expires;          /* precalculated expiry time */
+       struct {
+               unsigned long prev;     /* last modification */
+               u_int32_t credit;
+               u_int32_t credit_cap, cost;
+       } rateinfo;
+};
+
+struct ipt_dstlimit_htable {
+       struct ipt_dstlimit_info *minfo; /* public structure */
+
+       /* used internally */
+       spinlock_t lock;                /* lock for list_head */
+       u_int32_t rnd;                  /* random seed for hash */
+       struct timer_list timer;        /* timer for gc */
+       atomic_t count;                 /* number entries in table */
+
+       /* seq_file stuff */
+       struct proc_dir_entry *pde;
+
+       struct list_head hash[0];       /* hashtable itself */
+};
+
+static kmem_cache_t *dstlimit_cachep;
+
+static inline int dst_cmp(const struct dsthash_ent *ent, struct dsthash_dst *b)
+{
+       return (ent->dst.dst_ip == b->dst_ip 
+               && ent->dst.port == b->port
+               && ent->dst.src_ip == b->src_ip);
+}
+
+static inline u_int32_t
+hash_dst(const struct ipt_dstlimit_htable *ht, const struct dsthash_dst *dst)
+{
+       return (jhash_3words(dst->dst_ip, dst->port, 
+                            dst->src_ip, ht->rnd) % ht->minfo->size);
+}
+
+static inline struct dsthash_ent *
+__dsthash_find(const struct ipt_dstlimit_htable *ht, struct dsthash_dst *dst)
+{
+       struct dsthash_ent *ent;
+       u_int32_t hash = hash_dst(ht, dst);
+       MUST_BE_LOCKED(&ht->lock);
+       ent = LIST_FIND(&ht->hash[hash], dst_cmp, struct dsthash_ent *, dst);
+       return ent;
+}
+
+/* allocate dsthash_ent, initialize dst, put in htable and lock it */
+static struct dsthash_ent *
+__dsthash_alloc_init(struct ipt_dstlimit_htable *ht, struct dsthash_dst *dst)
+{
+       struct dsthash_ent *ent;
+
+       /* initialize hash with random val at the time we allocate
+        * the first hashtable entry */
+       if (!ht->rnd)
+               get_random_bytes(&ht->rnd, 4);
+
+       if (ht->minfo->max &&
+           atomic_read(&ht->count) >= ht->minfo->max) {
+               /* FIXME: do something. question is what.. */
+               if (net_ratelimit())
+                       printk("max count of %u reached\n", ht->minfo->max);
+               return NULL;
+       }
+
+       ent = kmem_cache_alloc(dstlimit_cachep, GFP_ATOMIC);
+       if (!ent) {
+               if (net_ratelimit())
+                       printk("Can't allocate dsthash_ent\n");
+               return NULL;
+       }
+
+       atomic_inc(&ht->count);
+
+       ent->dst.dst_ip = dst->dst_ip;
+       ent->dst.port = dst->port;
+       ent->dst.src_ip = dst->src_ip;
+
+       list_add(&ent->list, &ht->hash[hash_dst(ht, dst)]);
+
+       return ent;
+}
+
+static inline void 
+__dsthash_free(struct ipt_dstlimit_htable *ht, struct dsthash_ent *ent)
+{
+       MUST_BE_LOCKED(&ht->lock);
+
+       list_del(&ent->list);
+       kmem_cache_free(dstlimit_cachep, ent);
+       atomic_dec(&ht->count);
+}
+
+static void htable_gc(unsigned long htlong);
+
+static int htable_create(struct ipt_dstlimit_info *minfo)
+{
+       int i;
+       struct ipt_dstlimit_htable *hinfo;
+
+       if (!minfo->size) {
+               minfo->size = (((num_physpages << PAGE_SHIFT) / 16384)
+                           / sizeof(struct list_head));
+               if (num_physpages > (1024 * 1024 * 1024 / PAGE_SIZE))
+                       minfo->size = 8192;
+               if (minfo->size < 16)
+                       minfo->size = 16;
+       }
+       if (!minfo->max)
+               minfo->max = 8 * minfo->size;
+       else if (minfo->max < minfo->size)
+               minfo->max = minfo->size;
+
+       /* FIXME: don't use vmalloc() here or anywhere else -HW */
+       hinfo = vmalloc(sizeof(struct ipt_dstlimit_htable)
+                       + (sizeof(struct list_head) * minfo->size));
+       if (!hinfo) {
+               printk(KERN_ERR "Unable to create ipt_dstlimit hash\n");
+               return -1;
+       }
+
+       for (i = 0; i < minfo->size; i++)
+               INIT_LIST_HEAD(&hinfo->hash[i]);
+
+       minfo->hinfo = hinfo;
+
+       hinfo->minfo = minfo;
+       atomic_set(&hinfo->count, 0);
+       hinfo->rnd = 0;
+
+       hinfo->lock = SPIN_LOCK_UNLOCKED;
+
+       hinfo->pde = create_proc_entry(minfo->name, 0, dstlimit_procdir);
+       if (!hinfo->pde) {
+               vfree(hinfo);
+               return -1;
+       }
+       hinfo->pde->proc_fops = &dl_file_ops;
+       hinfo->pde->data = hinfo;
+
+       init_timer(&hinfo->timer);
+       hinfo->timer.expires = jiffies + MS2JIFFIES(minfo->gc_interval);
+       hinfo->timer.data = (unsigned long )hinfo;
+       hinfo->timer.function = htable_gc;
+       add_timer(&hinfo->timer);
+
+       return 0;
+}
+
+static int select_all(struct ipt_dstlimit_htable *ht, struct dsthash_ent *he)
+{
+       return 1;
+}
+
+static int select_gc(struct ipt_dstlimit_htable *ht, struct dsthash_ent *he)
+{
+       return (jiffies >= he->expires);
+}
+
+static void htable_selective_cleanup(struct ipt_dstlimit_htable *ht,
+                               int (*select)(struct ipt_dstlimit_htable *ht, 
+                                             struct dsthash_ent *he))
+{
+       int i;
+
+       IP_NF_ASSERT(ht->minfo->size && ht->minfo->max);
+
+       /* lock hash table and iterate over it */
+       LOCK_BH(&ht->lock);
+       for (i = 0; i < ht->minfo->size; i++) {
+               struct dsthash_ent *dh, *n;
+               list_for_each_entry_safe(dh, n, &ht->hash[i], list) {
+                       if ((*select)(ht, dh))
+                               __dsthash_free(ht, dh);
+               }
+       }
+       UNLOCK_BH(&ht->lock);
+}
+
+/* hash table garbage collector, run by timer */
+static void htable_gc(unsigned long htlong)
+{
+       struct ipt_dstlimit_htable *ht = (struct ipt_dstlimit_htable *)htlong;
+
+       htable_selective_cleanup(ht, select_gc);
+
+       /* re-add the timer accordingly */
+       ht->timer.expires = jiffies + MS2JIFFIES(ht->minfo->gc_interval);
+       add_timer(&ht->timer);
+}
+
+/* The algorithm used is the Simple Token Bucket Filter (TBF)
+ * see net/sched/sch_tbf.c in the linux source tree
+ */
+
+/* Rusty: This is my (non-mathematically-inclined) understanding of
+   this algorithm.  The `average rate' in jiffies becomes your initial
+   amount of credit `credit' and the most credit you can ever have
+   `credit_cap'.  The `peak rate' becomes the cost of passing the
+   test, `cost'.
+
+   `prev' tracks the last packet hit: you gain one credit per jiffy.
+   If you get credit balance more than this, the extra credit is
+   discarded.  Every time the match passes, you lose `cost' credits;
+   if you don't have that many, the test fails.
+
+   See Alexey's formal explanation in net/sched/sch_tbf.c.
+
+   To get the maximum range, we multiply by this factor (ie. you get N
+   credits per jiffy).  We want to allow a rate as low as 1 per day
+   (slowest userspace tool allows), which means
+   CREDITS_PER_JIFFY*HZ*60*60*24 < 2^32 ie.
+*/
+#define MAX_CPJ (0xFFFFFFFF / (HZ*60*60*24))
+
+/* Repeated shift and or gives us all 1s, final shift and add 1 gives
+ * us the power of 2 below the theoretical max, so GCC simply does a
+ * shift. */
+#define _POW2_BELOW2(x) ((x)|((x)>>1))
+#define _POW2_BELOW4(x) (_POW2_BELOW2(x)|_POW2_BELOW2((x)>>2))
+#define _POW2_BELOW8(x) (_POW2_BELOW4(x)|_POW2_BELOW4((x)>>4))
+#define _POW2_BELOW16(x) (_POW2_BELOW8(x)|_POW2_BELOW8((x)>>8))
+#define _POW2_BELOW32(x) (_POW2_BELOW16(x)|_POW2_BELOW16((x)>>16))
+#define POW2_BELOW32(x) ((_POW2_BELOW32(x)>>1) + 1)
+
+#define CREDITS_PER_JIFFY POW2_BELOW32(MAX_CPJ)
+
+/* Precision saver. */
+static inline u_int32_t
+user2credits(u_int32_t user)
+{
+       /* If multiplying would overflow... */
+       if (user > 0xFFFFFFFF / (HZ*CREDITS_PER_JIFFY))
+               /* Divide first. */
+               return (user / IPT_DSTLIMIT_SCALE) * HZ * CREDITS_PER_JIFFY;
+
+       return (user * HZ * CREDITS_PER_JIFFY) / IPT_DSTLIMIT_SCALE;
+}
+
+static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
+{
+       dh->rateinfo.credit += (now - xchg(&dh->rateinfo.prev, now)) 
+                                       * CREDITS_PER_JIFFY;
+       if (dh->rateinfo.credit > dh->rateinfo.credit_cap)
+               dh->rateinfo.credit = dh->rateinfo.credit_cap;
+}
+
+static int
+dstlimit_match(const struct sk_buff *skb,
+               const struct net_device *in,
+               const struct net_device *out,
+               const void *matchinfo,
+               int offset,
+               const void *hdr,
+               u_int16_t datalen,
+               int *hotdrop)
+{
+       struct ipt_dstlimit_info *r = 
+               ((struct ipt_dstlimit_info *)matchinfo)->u.master;
+       unsigned long now = jiffies;
+       struct dsthash_ent *dh;
+       struct dsthash_dst dst;
+
+       memset(&dst, 0, sizeof(dst));
+
+       /* dest ip is always in hash */
+       dst.dst_ip = skb->nh.iph->daddr;
+
+       /* source ip only if respective hashmode, otherwise set to
+        * zero */
+       if (r->mode & IPT_DSTLIMIT_HASH_SIP)
+               dst.src_ip = skb->nh.iph->saddr;
+
+       /* dest port only if respective mode */
+       if (r->mode & IPT_DSTLIMIT_HASH_DPT) {
+               switch (skb->nh.iph->protocol) {
+                       struct tcphdr *th;
+                       struct udphdr *uh;
+               case IPPROTO_TCP:
+                       th = (void *)skb->nh.iph+skb->nh.iph->ihl*4;
+                       dst.port = th->dest;
+                       break;
+               case IPPROTO_UDP:
+                       uh = (void *)skb->nh.iph+skb->nh.iph->ihl*4;
+                       dst.port = uh->dest;
+                       break;
+               default:
+                       break;
+               }
+       } 
+
+       LOCK_BH(&r->hinfo->lock);
+       dh = __dsthash_find(r->hinfo, &dst);
+       if (!dh) {
+               dh = __dsthash_alloc_init(r->hinfo, &dst);
+
+               if (!dh) {
+                       /* enomem... don't match == DROP */
+                       if (net_ratelimit())
+                               printk("%s: ENOMEM\n", __FUNCTION__);
+                       UNLOCK_BH(&r->hinfo->lock);
+                       return 0;
+               }
+
+               dh->expires = jiffies + MS2JIFFIES(r->expire);
+
+               dh->rateinfo.prev = jiffies;
+               dh->rateinfo.credit = user2credits(r->avg * r->burst);
+               dh->rateinfo.credit_cap = user2credits(r->avg * r->burst);
+               dh->rateinfo.cost = user2credits(r->avg);
+
+               UNLOCK_BH(&r->hinfo->lock);
+               return 0;
+       }
+
+       /* update expiration timeout */
+       dh->expires = now + MS2JIFFIES(r->expire);
+
+       rateinfo_recalc(dh, now);
+       if (dh->rateinfo.credit >= dh->rateinfo.cost) {
+               /* We're underlimit. */
+               dh->rateinfo.credit -= dh->rateinfo.cost;
+               UNLOCK_BH(&r->hinfo->lock);
+               return 1;
+       }
+
+               UNLOCK_BH(&r->hinfo->lock);
+
+       /* default case: we're overlimit, thus don't match */
+       return 0;
+}
+
+static int
+dstlimit_checkentry(const char *tablename,
+                    const struct ipt_ip *ip,
+                    void *matchinfo,
+                    unsigned int matchsize,
+                    unsigned int hook_mask)
+{
+       struct ipt_dstlimit_info *r = matchinfo;
+
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_dstlimit_info)))
+               return 0;
+
+       /* Check for overflow. */
+       if (r->burst == 0
+           || user2credits(r->avg * r->burst) < user2credits(r->avg)) {
+               printk("Overflow in ipt_dstlimit, try lower: %u/%u\n",
+                      r->avg, r->burst);
+               return 0;
+       }
+
+       if (r->mode == 0 
+           || r->mode > (IPT_DSTLIMIT_HASH_DPT
+                         |IPT_DSTLIMIT_HASH_DIP
+                         |IPT_DSTLIMIT_HASH_SIP))
+               return 0;
+
+       if (!r->gc_interval)
+               return 0;
+       
+       if (!r->expire)
+               return 0;
+
+       if (htable_create(r) != 0) {
+               printk("Unable to create dstlimit htable\n");
+               return 0;
+       }
+
+       /* Ugly hack: For SMP, we only want to use one set */
+       r->u.master = r;
+
+       return 1;
+}
+
+static void
+dstlimit_destroy(void *matchinfo, unsigned int matchsize)
+{
+       struct ipt_dstlimit_info *r = (struct ipt_dstlimit_info *) matchinfo;
+
+       r = r->u.master;
+
+       /* remove timer, if it is pending */
+       if (timer_pending(&r->hinfo->timer))
+               del_timer(&r->hinfo->timer);
+
+       /* remove proc entry */
+       remove_proc_entry(r->name, dstlimit_procdir);
+
+       htable_selective_cleanup(r->hinfo, select_all);
+       vfree(&r->hinfo);
+}
+
+static struct ipt_match ipt_dstlimit = { 
+       .list = { .prev = NULL, .next = NULL }, 
+       .name = "dstlimit", 
+       .match = dstlimit_match, 
+       .checkentry = dstlimit_checkentry, 
+       .destroy = dstlimit_destroy,
+       .me = THIS_MODULE 
+};
+
+/* PROC stuff */
+
+static void *dl_seq_start(struct seq_file *s, loff_t *pos)
+{
+       struct proc_dir_entry *pde = s->private;
+       struct ipt_dstlimit_htable *htable = pde->data;
+       unsigned int *bucket;
+
+       LOCK_BH(&htable->lock);
+       if (*pos >= htable->minfo->size)
+               return NULL;
+
+       bucket = kmalloc(sizeof(unsigned int), GFP_KERNEL);
+       if (!bucket)
+               return ERR_PTR(-ENOMEM);
+
+       *bucket = *pos;
+       return bucket;
+}
+
+static void *dl_seq_next(struct seq_file *s, void *v, loff_t *pos)
+{
+       struct proc_dir_entry *pde = s->private;
+       struct ipt_dstlimit_htable *htable = pde->data;
+       unsigned int *bucket = (unsigned int *)v;
+
+       *pos = ++(*bucket);
+       if (*pos >= htable->minfo->size) {
+               kfree(v);
+               return NULL;
+       }
+       return bucket;
+}
+
+static void dl_seq_stop(struct seq_file *s, void *v)
+{
+       struct proc_dir_entry *pde = s->private;
+       struct ipt_dstlimit_htable *htable = pde->data;
+
+       UNLOCK_BH(&htable->lock);
+}
+
+static inline int dl_seq_real_show(struct dsthash_ent *ent, struct seq_file *s)
+{
+       /* recalculate to show accurate numbers */
+       rateinfo_recalc(ent, jiffies);
+
+       return seq_printf(s, "%ld %u.%u.%u.%u->%u.%u.%u.%u:%u %u %u %u\n",
+                       (ent->expires - jiffies)/HZ,
+                       NIPQUAD(ent->dst.src_ip),
+                       NIPQUAD(ent->dst.dst_ip), ntohs(ent->dst.port),
+                       ent->rateinfo.credit, ent->rateinfo.credit_cap,
+                       ent->rateinfo.cost);
+}
+
+static int dl_seq_show(struct seq_file *s, void *v)
+{
+       struct proc_dir_entry *pde = s->private;
+       struct ipt_dstlimit_htable *htable = pde->data;
+       unsigned int *bucket = (unsigned int *)v;
+
+       if (LIST_FIND_W(&htable->hash[*bucket], dl_seq_real_show,
+                     struct dsthash_ent *, s)) {
+               /* buffer was filled and unable to print that tuple */
+               return 1;
+       }
+       return 0;
+}
+
+static struct seq_operations dl_seq_ops = {
+       .start = dl_seq_start,
+       .next  = dl_seq_next,
+       .stop  = dl_seq_stop,
+       .show  = dl_seq_show
+};
+
+static int dl_proc_open(struct inode *inode, struct file *file)
+{
+       int ret = seq_open(file, &dl_seq_ops);
+
+       if (!ret) {
+               struct seq_file *sf = file->private_data;
+               sf->private = PDE(inode);
+       }
+       return ret;
+}
+
+static struct file_operations dl_file_ops = {
+       .owner   = THIS_MODULE,
+       .open    = dl_proc_open,
+       .read    = seq_read,
+       .llseek  = seq_lseek,
+       .release = seq_release
+};
+
+static int init_or_fini(int fini)
+{
+       int ret = 0;
+
+       if (fini)
+               goto cleanup;
+
+       if (ipt_register_match(&ipt_dstlimit)) {
+               ret = -EINVAL;
+               goto cleanup_nothing;
+       }
+
+       /* FIXME: do we really want HWCACHE_ALIGN since our objects are
+        * quite small ? */
+       dstlimit_cachep = kmem_cache_create("ipt_dstlimit",
+                                           sizeof(struct dsthash_ent), 0,
+                                           SLAB_HWCACHE_ALIGN, NULL, NULL);
+       if (!dstlimit_cachep) {
+               printk(KERN_ERR "Unable to create ipt_dstlimit slab cache\n");
+               ret = -ENOMEM;
+               goto cleanup_unreg_match;
+       }
+
+       dstlimit_procdir = proc_mkdir("ipt_dstlimit", proc_net);
+       if (!dstlimit_procdir) {
+               printk(KERN_ERR "Unable to create proc dir entry\n");
+               ret = -ENOMEM;
+               goto cleanup_free_slab;
+       }
+
+       return ret;
+
+cleanup:
+       remove_proc_entry("ipt_dstlimit", proc_net);
+cleanup_free_slab:
+       kmem_cache_destroy(dstlimit_cachep);
+cleanup_unreg_match:
+       ipt_unregister_match(&ipt_dstlimit);
+cleanup_nothing:
+       return ret;
+       
+}
+
+static int __init init(void)
+{
+       return init_or_fini(0);
+}
+
+static void __exit fini(void)
+{
+       init_or_fini(1);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_fuzzy.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_fuzzy.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_fuzzy.c  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_fuzzy.c      2004-02-16 11:07:14.925382080 +0100
@@ -0,0 +1,190 @@
+/*
+ *  This module implements a simple TSK FLC 
+ * (Takagi-Sugeno-Kang Fuzzy Logic Controller) that aims
+ * to limit , in an adaptive and flexible way , the packet rate crossing 
+ * a given stream . It serves as an initial and very simple (but effective)
+ * example of how Fuzzy Logic techniques can be applied to defeat DoS attacks.
+ *  As a matter of fact , Fuzzy Logic can help us to insert any "behavior"  
+ * into our code in a precise , adaptive and efficient manner. 
+ *  The goal is very similar to that of "limit" match , but using techniques of
+ * Fuzzy Control , that allow us to shape the transfer functions precisely ,
+ * avoiding over and undershoots - and stuff like that .
+ *
+ *
+ * 2002-08-10  Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Initial version.
+ * 2002-08-17  : Changed to eliminate floating point operations .
+ * 2002-08-23  : Coding style changes .
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/random.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_fuzzy.h>
+
+/*
+ Packet Acceptance Rate - LOW and Packet Acceptance Rate - HIGH
+ Expressed in percentage
+*/
+
+#define PAR_LOW                1/100
+#define PAR_HIGH       1
+
+static spinlock_t fuzzy_lock = SPIN_LOCK_UNLOCKED ;
+
+MODULE_AUTHOR("Hime Aguiar e Oliveira Junior <hime@engineer.com>");
+MODULE_DESCRIPTION("IP tables Fuzzy Logic Controller match module");
+MODULE_LICENSE("GPL");
+
+static  u_int8_t mf_high(u_int32_t tx,u_int32_t mini,u_int32_t maxi)
+{
+       if (tx >= maxi) return 100;
+
+       if (tx <= mini) return 0;
+
+       return ( (100*(tx-mini)) / (maxi-mini) ) ;
+}
+
+static u_int8_t mf_low(u_int32_t tx,u_int32_t mini,u_int32_t maxi)
+{
+       if (tx <= mini) return 100;
+
+       if (tx >= maxi) return 0;
+
+       return ( (100*( maxi - tx ))  / ( maxi - mini ) ) ;
+
+}
+
+static int
+ipt_fuzzy_match(const struct sk_buff *pskb,
+              const struct net_device *in,
+              const struct net_device *out,
+              const void *matchinfo,
+              int offset,
+              const void *hdr,
+              u_int16_t datalen,
+              int *hotdrop)
+{
+       /* From userspace */
+       
+       struct ipt_fuzzy_info *info = (struct ipt_fuzzy_info *) matchinfo;
+
+       u_int8_t random_number;
+       unsigned long amount ;
+       u_int8_t howhigh , howlow ;
+       
+
+       spin_lock_bh(&fuzzy_lock) ; /* Rise the lock */
+
+       info->bytes_total += pskb->len ;
+       info->packets_total++ ;
+
+       info->present_time = jiffies ;
+       
+       if ( info->present_time >= info->previous_time )
+               amount = info->present_time - info->previous_time ;
+       else { 
+               /* There was a transition : I choose to re-sample 
+                  and keep the old acceptance rate...
+               */
+
+               amount = 0 ;
+               info->previous_time = info->present_time ;
+               info->bytes_total = info->packets_total = 0;
+            };
+       
+       if (  amount > HZ/10 ) /* More than 100 ms elapsed ... */
+               {
+
+       info->mean_rate = (u_int32_t) ( ( HZ * info->packets_total )  \
+                                       / amount ) ;
+
+               info->previous_time = info->present_time ;
+               info->bytes_total = info->packets_total = 0 ;
+
+       howhigh = mf_high(info->mean_rate,info->minimum_rate,info->maximum_rate);
+       howlow  = mf_low(info->mean_rate,info->minimum_rate,info->maximum_rate);
+
+    info->acceptance_rate = (u_int8_t) \
+                          ( howhigh*PAR_LOW + PAR_HIGH*howlow ) ;
+
+    /* In fact , the above defuzzification would require a denominator
+       proportional to (howhigh+howlow) but , in this particular case ,
+       that expression is constant .
+        An imediate consequence is that it isn't necessary to call 
+       both mf_high and mf_low - but to keep things understandable ,
+       I did so .
+     */ 
+
+               }
+       
+       spin_unlock_bh(&fuzzy_lock) ; /* Release the lock */
+
+
+       if ( info->acceptance_rate < 100 )
+       {                
+               get_random_bytes((void *)(&random_number), 1);
+
+               /*  If within the acceptance , it can pass => don't match */
+               if ( random_number <= (255 * info->acceptance_rate) / 100 )
+                       return 0 ;
+               else
+                       return 1; /* It can't pass ( It matches ) */
+       } ;
+
+       return 0; /* acceptance_rate == 100 % => Everything passes ... */
+       
+}
+
+static int
+ipt_fuzzy_checkentry(const char *tablename,
+                  const struct ipt_ip *e,
+                  void *matchinfo,
+                  unsigned int matchsize,
+                  unsigned int hook_mask)
+{
+       
+       const struct ipt_fuzzy_info *info = matchinfo;
+
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_fuzzy_info))) {
+               printk("ipt_fuzzy: matchsize %u != %u\n", matchsize,
+                      IPT_ALIGN(sizeof(struct ipt_fuzzy_info)));
+               return 0;
+       }
+
+if ((info->minimum_rate < MINFUZZYRATE ) || (info->maximum_rate > MAXFUZZYRATE)
+       || (info->minimum_rate >= info->maximum_rate ))
+               {
+               printk("ipt_fuzzy: BAD limits , please verify !!!\n");
+               return 0;
+               }
+
+       return 1;
+}
+
+static struct ipt_match ipt_fuzzy_reg = { 
+       {NULL, NULL},
+       "fuzzy",
+       ipt_fuzzy_match,
+       ipt_fuzzy_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ipt_register_match(&ipt_fuzzy_reg))
+               return -EINVAL;
+
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&ipt_fuzzy_reg);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_ipv4options.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_ipv4options.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_ipv4options.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_ipv4options.c        2004-02-16 11:07:16.165085194 +0100
@@ -0,0 +1,170 @@
+/*
+  This is a module which is used to match ipv4 options.
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+  ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  11-mars-2001 Fabrice MARIE <fabrice@netfilter.org> : initial development.
+  12-july-2001 Fabrice MARIE <fabrice@netfilter.org> : added router-alert otions matching. Fixed a bug with no-srr
+  12-august-2001 Imran Patel <ipatel@crosswinds.net> : optimization of the match.
+  18-november-2001 Fabrice MARIE <fabrice@netfilter.org> : added [!] 'any' option match.
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <net/ip.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_ipv4options.h>
+
+MODULE_LICENSE("GPL");
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       const struct ipt_ipv4options_info *info = matchinfo;   /* match info for rule */
+       const struct iphdr *iph = skb->nh.iph;
+       const struct ip_options *opt;
+
+       if (iph->ihl * 4 == sizeof(struct iphdr)) {
+               /* No options, so we match only the "DONTs" and the "IGNOREs" */
+
+               if (((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT) ||
+                   ((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) ||
+                   ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR) ||
+                   ((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) ||
+                   ((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) ||
+                    ((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT))
+                       return 0;
+               return 1;
+       }
+       else {
+               if ((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT)
+                       /* there are options, and we don't need to care which one */
+                       return 1;
+               else {
+                       if ((info->options & IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) == IPT_IPV4OPTION_DONT_MATCH_ANY_OPT)
+                               /* there are options but we don't want any ! */
+                               return 0;
+               }
+       }
+
+       opt = &(IPCB(skb)->opt);
+
+       /* source routing */
+       if ((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) {
+               if (!((opt->srr) & (opt->is_strictroute)))
+                       return 0;
+       }
+       else if ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR) {
+               if (!((opt->srr) & (!opt->is_strictroute)))
+                       return 0;
+       }
+       else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_SRR) == IPT_IPV4OPTION_DONT_MATCH_SRR) {
+               if (opt->srr)
+                       return 0;
+       }
+       /* record route */
+       if ((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) {
+               if (!opt->rr)
+                       return 0;
+       }
+       else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_RR) == IPT_IPV4OPTION_DONT_MATCH_RR) {
+               if (opt->rr)
+                       return 0;
+       }
+       /* timestamp */
+       if ((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) {
+               if (!opt->ts)
+                       return 0;
+       }
+       else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) == IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) {
+               if (opt->ts)
+                       return 0;
+       }
+       /* router-alert option  */
+       if ((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT) {
+               if (!opt->router_alert)
+                       return 0;
+       }
+       else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) {
+               if (opt->router_alert)
+                       return 0;
+       }
+
+       /* we match ! */
+       return 1;
+}
+
+static int
+checkentry(const char *tablename,
+          const struct ipt_ip *ip,
+          void *matchinfo,
+          unsigned int matchsize,
+          unsigned int hook_mask)
+{
+       const struct ipt_ipv4options_info *info = matchinfo;   /* match info for rule */
+       /* Check the size */
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_ipv4options_info)))
+               return 0;
+       /* Now check the coherence of the data ... */
+       if (((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT) &&
+           (((info->options & IPT_IPV4OPTION_DONT_MATCH_SRR) == IPT_IPV4OPTION_DONT_MATCH_SRR) ||
+            ((info->options & IPT_IPV4OPTION_DONT_MATCH_RR) == IPT_IPV4OPTION_DONT_MATCH_RR) ||
+            ((info->options & IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) == IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) ||
+            ((info->options & IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) ||
+            ((info->options & IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) == IPT_IPV4OPTION_DONT_MATCH_ANY_OPT)))
+               return 0; /* opposites */
+       if (((info->options & IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) == IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) &&
+           (((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR) ||
+            ((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) ||
+            ((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) ||
+            ((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) ||
+            ((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT) ||
+            ((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT)))
+               return 0; /* opposites */
+       if (((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) &&
+           ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR))
+               return 0; /* cannot match in the same time loose and strict source routing */
+       if ((((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) ||
+            ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR)) &&
+           ((info->options & IPT_IPV4OPTION_DONT_MATCH_SRR) == IPT_IPV4OPTION_DONT_MATCH_SRR))
+               return 0; /* opposites */
+       if (((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) &&
+           ((info->options & IPT_IPV4OPTION_DONT_MATCH_RR) == IPT_IPV4OPTION_DONT_MATCH_RR))
+               return 0; /* opposites */
+       if (((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) &&
+           ((info->options & IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) == IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP))
+               return 0; /* opposites */
+       if (((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT) &&
+           ((info->options & IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT))
+               return 0; /* opposites */
+
+       /* everything looks ok. */
+       return 1;
+}
+
+static struct ipt_match ipv4options_match
+= { { NULL, NULL }, "ipv4options", &match, &checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       printk("ipt_ipv4options loading\n");
+       return ipt_register_match(&ipv4options_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&ipv4options_match);
+       printk("ipt_ipv4options unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_mport.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_mport.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_mport.c  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_mport.c      2004-02-16 11:07:17.665725817 +0100
@@ -0,0 +1,112 @@
+/* Kernel module to match one of a list of TCP/UDP ports: ports are in
+   the same place so we can treat them as equal. */
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/udp.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter_ipv4/ipt_mport.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+MODULE_LICENSE("GPL");
+
+#if 0
+#define duprintf(format, args...) printk(format , ## args)
+#else
+#define duprintf(format, args...)
+#endif
+
+/* Returns 1 if the port is matched by the test, 0 otherwise. */
+static inline int
+ports_match(const struct ipt_mport *minfo, u_int16_t src, u_int16_t dst)
+{
+       unsigned int i;
+        unsigned int m;
+        u_int16_t pflags = minfo->pflags;
+       for (i=0, m=1; i<IPT_MULTI_PORTS; i++, m<<=1) {
+                u_int16_t s, e;
+
+                if (pflags & m
+                    && minfo->ports[i] == 65535)
+                        return 0;
+
+                s = minfo->ports[i];
+
+                if (pflags & m) {
+                        e = minfo->ports[++i];
+                        m <<= 1;
+                } else
+                        e = s;
+
+                if (minfo->flags & IPT_MPORT_SOURCE
+                    && src >= s && src <= e)
+                        return 1;
+
+               if (minfo->flags & IPT_MPORT_DESTINATION
+                   && dst >= s && dst <= e)
+                       return 1;
+       }
+
+       return 0;
+}
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       const struct udphdr *udp = hdr;
+       const struct ipt_mport *minfo = matchinfo;
+
+       /* Must be big enough to read ports. */
+       if (offset == 0 && datalen < sizeof(struct udphdr)) {
+               /* We've been asked to examine this packet, and we
+                  can't.  Hence, no choice but to drop. */
+                       duprintf("ipt_mport:"
+                                " Dropping evil offset=0 tinygram.\n");
+                       *hotdrop = 1;
+                       return 0;
+       }
+
+       /* Must not be a fragment. */
+       return !offset
+               && ports_match(minfo, ntohs(udp->source), ntohs(udp->dest));
+}
+
+/* Called when user tries to insert an entry of this type. */
+static int
+checkentry(const char *tablename,
+          const struct ipt_ip *ip,
+          void *matchinfo,
+          unsigned int matchsize,
+          unsigned int hook_mask)
+{
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_mport)))
+               return 0;
+
+       /* Must specify proto == TCP/UDP, no unknown flags or bad count */
+       return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
+               && !(ip->invflags & IPT_INV_PROTO)
+               && matchsize == IPT_ALIGN(sizeof(struct ipt_mport));
+}
+
+static struct ipt_match mport_match
+= { { NULL, NULL }, "mport", &match, &checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ipt_register_match(&mport_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&mport_match);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_nth.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_nth.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_nth.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_nth.c        2004-02-16 11:07:18.803453352 +0100
@@ -0,0 +1,172 @@
+/*
+  This is a module which is used for match support for every Nth packet
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+     ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  2001-07-18 Fabrice MARIE <fabrice@netfilter.org> : initial implementation.
+  2001-09-20 Richard Wagner (rwagner@cloudnet.com)
+        * added support for multiple counters
+        * added support for matching on individual packets
+          in the counter cycle
+
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_nth.h>
+
+MODULE_LICENSE("GPL");
+
+/*
+ * State information.
+ */
+struct state {
+       spinlock_t lock;
+       u_int16_t number;
+};
+
+static struct state states[IPT_NTH_NUM_COUNTERS];
+
+static int
+ipt_nth_match(const struct sk_buff *pskb,
+             const struct net_device *in,
+             const struct net_device *out,
+             const void *matchinfo,
+             int offset,
+             const void *hdr,
+             u_int16_t datalen,
+             int *hotdrop)
+{
+       /* Parameters from userspace */
+       const struct ipt_nth_info *info = matchinfo;
+        unsigned counter = info->counter;
+               if((counter < 0) || (counter >= IPT_NTH_NUM_COUNTERS)) 
+       {
+                       printk(KERN_WARNING "nth: invalid counter %u. counter between 0 and %u\n", counter, IPT_NTH_NUM_COUNTERS-1);
+               return 0;
+        };
+
+        spin_lock(&states[counter].lock);
+
+        /* Are we matching every nth packet?*/
+        if (info->packet == 0xFF)
+        {
+               /* We're matching every nth packet and only every nth packet*/
+               /* Do we match or invert match? */
+               if (info->not == 0)
+               {
+                       if (states[counter].number == 0)
+                       {
+                               ++states[counter].number;
+                               goto match;
+                       }
+                       if (states[counter].number >= info->every)
+                               states[counter].number = 0; /* reset the counter */
+                       else
+                               ++states[counter].number;
+                       goto dontmatch;
+               }
+               else
+               {
+                       if (states[counter].number == 0)
+                       {
+                               ++states[counter].number;
+                               goto dontmatch;
+                       }
+                       if (states[counter].number >= info->every)
+                               states[counter].number = 0;
+                       else
+                               ++states[counter].number;
+                       goto match;
+               }
+        }
+        else
+        {
+               /* We're using the --packet, so there must be a rule for every value */
+               if (states[counter].number == info->packet)
+               {
+                       /* only increment the counter when a match happens */
+                       if (states[counter].number >= info->every)
+                               states[counter].number = 0; /* reset the counter */
+                       else
+                               ++states[counter].number;
+                       goto match;
+               }
+               else
+                       goto dontmatch;
+       }
+
+ dontmatch:
+       /* don't match */
+       spin_unlock(&states[counter].lock);
+       return 0;
+
+ match:
+       spin_unlock(&states[counter].lock);
+       return 1;
+}
+
+static int
+ipt_nth_checkentry(const char *tablename,
+                  const struct ipt_ip *e,
+                  void *matchinfo,
+                  unsigned int matchsize,
+                  unsigned int hook_mask)
+{
+       /* Parameters from userspace */
+       const struct ipt_nth_info *info = matchinfo;
+        unsigned counter = info->counter;
+        if((counter < 0) || (counter >= IPT_NTH_NUM_COUNTERS)) 
+       {
+               printk(KERN_WARNING "nth: invalid counter %u. counter between 0 and %u\n", counter, IPT_NTH_NUM_COUNTERS-1);
+                       return 0;
+               };
+
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_nth_info))) {
+               printk("nth: matchsize %u != %u\n", matchsize,
+                      IPT_ALIGN(sizeof(struct ipt_nth_info)));
+               return 0;
+       }
+
+       states[counter].number = info->startat;
+
+       return 1;
+}
+
+static struct ipt_match ipt_nth_reg = { 
+       {NULL, NULL},
+       "nth",
+       ipt_nth_match,
+       ipt_nth_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       unsigned counter;
+        memset(&states, 0, sizeof(states));
+       if (ipt_register_match(&ipt_nth_reg))
+               return -EINVAL;
+
+        for(counter = 0; counter < IPT_NTH_NUM_COUNTERS; counter++) 
+       {
+               spin_lock_init(&(states[counter].lock));
+        };
+
+       printk("ipt_nth match loaded\n");
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&ipt_nth_reg);
+       printk("ipt_nth match unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_osf.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_osf.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_osf.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_osf.c        2004-02-16 11:07:19.917186632 +0100
@@ -0,0 +1,733 @@
+/*
+ * ipt_osf.c
+ *
+ * Copyright (c) 2003 Evgeniy Polyakov <johnpol@2ka.mipt.ru>
+ *
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ */
+
+/*
+ * OS fingerprint matching module.
+ * It simply compares various parameters from SYN packet with
+ * some hardcoded ones.
+ *
+ * Original table was created by Michal Zalewski <lcamtuf@coredump.cx>
+ * for his p0f.
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/smp.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/file.h>
+#include <linux/ip.h>
+#include <linux/proc_fs.h>
+#include <linux/fs.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/ctype.h>
+#include <linux/list.h>
+
+#include <net/sock.h>
+#include <net/ip.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+#include <linux/netfilter_ipv4/ipt_osf.h>
+
+#define OSF_DEBUG
+
+#ifdef OSF_DEBUG
+#define log(x...)              printk(KERN_INFO "ipt_osf: " x)
+#define loga(x...)             printk(x)
+#else
+#define log(x...)              do {} while(0)
+#define loga(x...)             do {} while(0)
+#endif
+
+#define FMATCH_WRONG           0
+#define FMATCH_OK              1
+#define FMATCH_OPT_WRONG       2
+
+#define OPTDEL                 ','
+#define OSFPDEL                ':'
+#define MAXOPTSTRLEN           128
+#define OSFFLUSH               "FLUSH"
+
+static rwlock_t osf_lock = RW_LOCK_UNLOCKED;
+static struct list_head        finger_list;    
+
+static int match(const struct sk_buff *, const struct net_device *, const struct net_device *,
+                     const void *, int, const void *, u_int16_t, int *);
+static int checkentry(const char *, const struct ipt_ip *, void *,
+                          unsigned int, unsigned int);
+
+static struct ipt_match osf_match = 
+{ 
+       { NULL, NULL }, 
+       "osf", 
+       &match, 
+       &checkentry, 
+       NULL, 
+       THIS_MODULE 
+};
+
+static inline int smart_dec(unsigned long flags, unsigned char ip_ttl, unsigned char f_ttl)
+{
+       if (flags & IPT_OSF_SMART)
+               return 1;
+       else
+               return (ip_ttl == f_ttl);
+}
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       struct ipt_osf_info *info = (struct ipt_osf_info *)matchinfo;
+       struct iphdr *ip = skb->nh.iph;
+       struct tcphdr *tcp;
+       int fmatch = FMATCH_WRONG, fcount = 0;
+       unsigned long totlen, optsize = 0, window;
+       unsigned char df, *optp = NULL, *_optp = NULL;
+       char check_WSS = 0;
+       struct list_head *ent;
+       struct osf_finger *f;
+
+       if (!ip || !info)
+               return 0;
+                               
+       tcp = (struct tcphdr *)((u_int32_t *)ip + ip->ihl);
+
+       if (!tcp->syn)
+               return 0;
+       else if (tcp->ack)
+               return 0;
+       
+       totlen = ntohs(ip->tot_len);
+       df = ((ntohs(ip->frag_off) & IP_DF)?1:0);
+       window = ntohs(tcp->window);
+       
+       if (tcp->doff*4 > sizeof(struct tcphdr))
+       {
+               _optp = optp = (char *)(tcp+1);
+               optsize = tcp->doff*4 - sizeof(struct tcphdr);
+       }
+
+       
+       /* Actually we can create hash/table of all genres and search
+        * only in appropriate part, but here is initial variant,
+        * so will use slow path.
+        */
+       read_lock(&osf_lock);
+       list_for_each(ent, &finger_list)
+       {
+               f = list_entry(ent, struct osf_finger, flist);
+       
+               if (!(info->flags & IPT_OSF_LOG) && strcmp(info->genre, f->genre)) 
+                       continue;
+
+               optp = _optp;
+               fmatch = FMATCH_WRONG;
+
+               if (totlen == f->ss && df == f->df && 
+                       smart_dec(info->flags, ip->ttl, f->ttl))
+               {
+                       unsigned long foptsize;
+                       int optnum;
+                       unsigned short mss = 0;
+
+                       check_WSS = 0;
+
+                       switch (f->wss.wc)
+                       {
+                               case 0:   check_WSS = 0; break;
+                               case 'S': check_WSS = 1; break;
+                               case 'T': check_WSS = 2; break;
+                               case '%': check_WSS = 3; break;
+                               default: log("Wrong fingerprint wss.wc=%d, %s - %s\n", 
+                                                        f->wss.wc, f->genre, f->details);
+                                        check_WSS = 4;
+                                        break;
+                       }
+                       if (check_WSS == 4)
+                               continue;
+
+                       /* Check options */
+
+                       foptsize = 0;
+                       for (optnum=0; optnum<f->opt_num; ++optnum)
+                               foptsize += f->opt[optnum].length;
+
+                               
+                       if (foptsize > MAX_IPOPTLEN || optsize > MAX_IPOPTLEN || optsize != foptsize)
+                               continue;
+
+                       if (!optp)
+                       {
+                               fmatch = FMATCH_OK;
+                               loga("\tYEP : matching without options.\n");
+                               if ((info->flags & IPT_OSF_LOG) && 
+                                       info->loglevel == IPT_OSF_LOGLEVEL_FIRST)
+                                       break;
+                               else
+                                       continue;
+                       }
+                       
+
+                       for (optnum=0; optnum<f->opt_num; ++optnum)
+                       {
+                               if (f->opt[optnum].kind == (*optp))
+                               {
+                                       unsigned char len = f->opt[optnum].length;
+                                       unsigned char *optend = optp + len;
+
+                                       fmatch = FMATCH_OK;
+
+                                       if (*optp == OSFOPT_MSS) /* MSS */
+                                               mss = ntohs(*(unsigned short *)(optp+2));
+                                       
+                                       if (len != 1)
+                                       {
+                                               /* Skip kind and length fields*/
+                                               optp += 2; 
+
+                                               if (f->opt[optnum].wc.wc != 0)
+                                               {
+                                                       unsigned long tmp = 0;
+                                                       
+                                                       /* Hmmm... It looks a bit ugly. :) */
+                                                       memcpy(&tmp, &f->opt[optnum].wc.val, 
+                                                               (len > sizeof(unsigned long)?
+                                                                       sizeof(unsigned long):len));
+
+                                                       tmp = ntohl(tmp);
+                                                       if (tmp != f->opt[optnum].wc.val)
+                                                               fmatch = FMATCH_OPT_WRONG;
+                                               }
+                                       }
+
+                                       optp = optend;
+                               }
+                               else
+                                       fmatch = FMATCH_OPT_WRONG;
+
+                               if (fmatch != FMATCH_OK)
+                                       break;
+                       }
+
+                       if (fmatch != FMATCH_OPT_WRONG)
+                       {
+                               fmatch = FMATCH_WRONG;
+
+                               switch (check_WSS)
+                               {
+                                       case 0:
+                                               if (window == f->wss.val)
+                                                       fmatch = FMATCH_OK;
+                                               break;
+                                       case 1: /* MSS */
+                                               if (window == f->wss.val*mss)
+                                                       fmatch = FMATCH_OK;
+                                               break;
+                                       case 2: /* MTU */
+                                               if (window == f->wss.val*(mss+40))
+                                                       fmatch = FMATCH_OK;
+                                               break;
+                                       case 3: /* MOD */
+                                               if (window % f->wss.val == 0)
+                                                       fmatch = FMATCH_OK;
+                                               break;
+                               }
+                       }
+                                       
+
+                       if (fmatch == FMATCH_OK)
+                       {
+                               fcount++;
+                               log("%s [%s]: %u.%u.%u.%u:%u -> %u.%u.%u.%u:%u\n", 
+                                       f->genre, f->details,
+                                       NIPQUAD(ip->saddr), ntohs(tcp->source),
+                                       NIPQUAD(ip->daddr), ntohs(tcp->dest));
+                               if ((info->flags & IPT_OSF_LOG) && 
+                                       info->loglevel == IPT_OSF_LOGLEVEL_FIRST)
+                                       break;
+                       }
+               }
+       }
+       if (!fcount && (info->flags & IPT_OSF_LOG))
+       {
+               log("Unknown: %lu:%d:%d:%lu:", window, ip->ttl, df, totlen);
+               if (optp)
+               {
+                       unsigned char opt[4 * 15 - sizeof(struct tcphdr)];
+                       unsigned int i, optsize;
+
+                       optsize = tcp->doff * 4 - sizeof(struct tcphdr);
+                       if (skb_copy_bits(skb, ip->ihl*4 + sizeof(struct tcphdr),
+                                         opt, optsize) < 0)
+                               loga("TRUNCATED");
+                       else
+                               for (i = 0; i < optsize; i++)
+                                       loga("%02X", opt[i]);
+                       
+               }  
+               loga(" %u.%u.%u.%u:%u -> %u.%u.%u.%u:%u\n", 
+                       NIPQUAD(ip->saddr), ntohs(tcp->source),
+                       NIPQUAD(ip->daddr), ntohs(tcp->dest));
+       }
+       read_unlock(&osf_lock);
+
+       return (fmatch == FMATCH_OK)?1:0;
+}
+
+static int
+checkentry(const char *tablename,
+           const struct ipt_ip *ip,
+           void *matchinfo,
+           unsigned int matchsize,
+           unsigned int hook_mask)
+{
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_osf_info)))
+               return 0;
+       if (ip->proto != IPPROTO_TCP)
+              return 0;
+
+       return 1;
+}
+
+static char * osf_strchr(char *ptr, char c)
+{
+       char *tmp;
+
+       tmp = strchr(ptr, c);
+
+       while (tmp && tmp+1 && isspace(*(tmp+1)))
+               tmp++;
+
+       return tmp;
+}
+
+static struct osf_finger * finger_alloc(void)
+{
+       struct osf_finger *f;
+
+       f = kmalloc(sizeof(struct osf_finger), GFP_KERNEL);
+       if (f)
+               memset(f, 0, sizeof(struct osf_finger));
+       
+       return f;
+}
+
+static void finger_free(struct osf_finger *f)
+{
+       memset(f, 0, sizeof(struct osf_finger));
+       kfree(f);
+}
+
+
+static void osf_parse_opt(struct osf_opt *opt, int *optnum, char *obuf, int olen)
+{
+       int i, op;
+       char *ptr, wc;
+       unsigned long val;
+
+       ptr = &obuf[0];
+       i = 0;
+       while (ptr != NULL && i < olen)
+       {
+               val = 0;
+               op = 0;
+               wc = 0;
+               switch (obuf[i])
+               {
+                       case 'N': 
+                               op = OSFOPT_NOP;
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       *ptr = '\0';
+                                       ptr++;
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+                       case 'S': 
+                               op = OSFOPT_SACKP;
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       *ptr = '\0';
+                                       ptr++;
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+                       case 'T': 
+                               op = OSFOPT_TS;
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       *ptr = '\0';
+                                       ptr++;
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+                       case 'W': 
+                               op = OSFOPT_WSO;
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       switch (obuf[i+1])
+                                       {
+                                               case '%':       wc = '%'; break;
+                                               case 'S':       wc = 'S'; break;
+                                               case 'T':       wc = 'T'; break;
+                                               default:        wc = 0; break;
+                                       }
+                                       
+                                       *ptr = '\0';
+                                       ptr++;
+                                       if (wc)
+                                               val = simple_strtoul(&obuf[i+2], NULL, 10);
+                                       else
+                                               val = simple_strtoul(&obuf[i+1], NULL, 10);
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+                       case 'M': 
+                               op = OSFOPT_MSS;
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       if (obuf[i+1] == '%')
+                                               wc = '%';
+                                       *ptr = '\0';
+                                       ptr++;
+                                       if (wc)
+                                               val = simple_strtoul(&obuf[i+2], NULL, 10);
+                                       else
+                                               val = simple_strtoul(&obuf[i+1], NULL, 10);
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+                       case 'E': 
+                               op = OSFOPT_EOL;
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       *ptr = '\0';
+                                       ptr++;
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+                       default:
+                               ptr = osf_strchr(&obuf[i], OPTDEL);
+                               if (ptr)
+                               {
+                                       ptr++;
+                                       i += (int)(ptr-&obuf[i]);
+
+                               }
+                               else
+                                       i++;
+                               break;
+               }
+
+               opt[*optnum].kind       = IANA_opts[op].kind;
+               opt[*optnum].length     = IANA_opts[op].length;
+               opt[*optnum].wc.wc      = wc;
+               opt[*optnum].wc.val     = val;
+
+               (*optnum)++;
+       }
+}
+
+static int osf_proc_read(char *buf, char **start, off_t off, int count, int *eof, void *data)
+{
+       struct list_head *ent;
+       struct osf_finger *f = NULL;
+       int i;
+       
+       *eof = 1;
+       count = 0;
+
+       read_lock_bh(&osf_lock);
+       list_for_each(ent, &finger_list)
+       {
+               f = list_entry(ent, struct osf_finger, flist);
+
+               log("%s [%s]", f->genre, f->details);
+               
+               count += sprintf(buf+count, "%s - %s[%s] : %s", 
+                                       f->genre, f->version,
+                                       f->subtype, f->details);
+               
+               if (f->opt_num)
+               {
+                       loga(" OPT: ");
+                       //count += sprintf(buf+count, " OPT: ");
+                       for (i=0; i<f->opt_num; ++i)
+                       {
+                               //count += sprintf(buf+count, "%d.%c%lu; ", 
+                               //      f->opt[i].kind, (f->opt[i].wc.wc)?f->opt[i].wc.wc:' ', f->opt[i].wc.val);
+                               loga("%d.%c%lu; ", 
+                                       f->opt[i].kind, (f->opt[i].wc.wc)?f->opt[i].wc.wc:' ', f->opt[i].wc.val);
+                       }
+               }
+               loga("\n");
+               count += sprintf(buf+count, "\n");
+       }
+       read_unlock_bh(&osf_lock);
+
+       return count;
+}
+
+static int osf_proc_write(struct file *file, const char *buffer, unsigned long count, void *data)
+{
+       int cnt;
+       unsigned long i;
+       char obuf[MAXOPTSTRLEN];
+       struct osf_finger *finger;
+       struct list_head *ent, *n;
+
+       char *pbeg, *pend;
+
+       if (count == strlen(OSFFLUSH) && !strncmp(buffer, OSFFLUSH, strlen(OSFFLUSH)))
+       {
+               int i = 0;
+               write_lock_bh(&osf_lock);
+               list_for_each_safe(ent, n, &finger_list)
+               {
+                       i++;
+                       finger = list_entry(ent, struct osf_finger, flist);
+                       list_del(&finger->flist);
+                       finger_free(finger);
+               }
+               write_unlock_bh(&osf_lock);
+       
+               log("Flushed %d entries.\n", i);
+               
+               return count;
+       }
+
+       
+       cnt = 0;
+       for (i=0; i<count && buffer[i] != '\0'; ++i)
+               if (buffer[i] == ':')
+                       cnt++;
+
+       if (cnt != 8 || i != count)
+       {
+               log("Wrong input line cnt=%d[8], len=%lu[%lu]\n", 
+                       cnt, i, count);
+               return count;
+       }
+
+       memset(obuf, 0, sizeof(obuf));
+       
+       finger = finger_alloc();
+       if (!finger)
+       {
+               log("Failed to allocate new fingerprint entry.\n");
+               return -ENOMEM;
+       }
+
+       pbeg = (char *)buffer;
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               if (pbeg[0] == 'S')
+               {
+                       finger->wss.wc = 'S';
+                       if (pbeg[1] == '%')
+                               finger->wss.val = simple_strtoul(pbeg+2, NULL, 10);
+                       else if (pbeg[1] == '*')
+                               finger->wss.val = 0;
+                       else 
+                               finger->wss.val = simple_strtoul(pbeg+1, NULL, 10);
+               }
+               else if (pbeg[0] == 'T')
+               {
+                       finger->wss.wc = 'T';
+                       if (pbeg[1] == '%')
+                               finger->wss.val = simple_strtoul(pbeg+2, NULL, 10);
+                       else if (pbeg[1] == '*')
+                               finger->wss.val = 0;
+                       else 
+                               finger->wss.val = simple_strtoul(pbeg+1, NULL, 10);
+               }
+               if (isdigit(pbeg[0]))
+               {
+                       finger->wss.wc = 0;
+                       finger->wss.val = simple_strtoul(pbeg, NULL, 10);
+               }
+
+               pbeg = pend+1;
+       }
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               finger->ttl = simple_strtoul(pbeg, NULL, 10);
+               pbeg = pend+1;
+       }
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               finger->df = simple_strtoul(pbeg, NULL, 10);
+               pbeg = pend+1;
+       }
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               finger->ss = simple_strtoul(pbeg, NULL, 10);
+               pbeg = pend+1;
+       }
+
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               cnt = snprintf(obuf, sizeof(obuf), "%s", pbeg);
+               pbeg = pend+1;
+       }
+
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               if (pbeg[0] == '@' || pbeg[0] == '*')
+                       cnt = snprintf(finger->genre, sizeof(finger->genre), "%s", pbeg+1);
+               else
+                       cnt = snprintf(finger->genre, sizeof(finger->genre), "%s", pbeg);
+               pbeg = pend+1;
+       }
+       
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               cnt = snprintf(finger->version, sizeof(finger->version), "%s", pbeg);
+               pbeg = pend+1;
+       }
+       
+       pend = osf_strchr(pbeg, OSFPDEL);
+       if (pend)
+       {
+               *pend = '\0';
+               cnt = snprintf(finger->subtype, sizeof(finger->subtype), "%s", pbeg);
+               pbeg = pend+1;
+       }
+
+       cnt = snprintf(finger->details, 
+                       ((count - (pbeg - buffer)+1) > MAXDETLEN)?MAXDETLEN:(count - (pbeg - buffer)+1), 
+                       "%s", pbeg);
+       
+       log("%s - %s[%s] : %s\n", 
+               finger->genre, finger->version,
+               finger->subtype, finger->details);
+       
+       osf_parse_opt(finger->opt, &finger->opt_num, obuf, sizeof(obuf));
+       
+
+       write_lock_bh(&osf_lock);
+       list_add_tail(&finger->flist, &finger_list);
+       write_unlock_bh(&osf_lock);
+
+       return count;
+}
+
+static int __init osf_init(void)
+{
+       int err;
+       struct proc_dir_entry *p;
+
+       log("Startng OS fingerprint matching module.\n");
+
+       INIT_LIST_HEAD(&finger_list);
+       
+       err = ipt_register_match(&osf_match);
+       if (err)
+       {
+               log("Failed to register OS fingerprint matching module.\n");
+               return -ENXIO;
+       }
+
+       p = create_proc_entry("sys/net/ipv4/osf", S_IFREG | 0644, NULL);
+       if (!p)
+       {
+               ipt_unregister_match(&osf_match);
+               return -ENXIO;
+       }
+
+       p->write_proc = osf_proc_write;
+       p->read_proc  = osf_proc_read;
+
+       return 0;
+}
+
+static void __exit osf_fini(void)
+{
+       struct list_head *ent, *n;
+       struct osf_finger *f;
+       
+       remove_proc_entry("sys/net/ipv4/osf", NULL);
+       ipt_unregister_match(&osf_match);
+
+       list_for_each_safe(ent, n, &finger_list)
+       {
+               f = list_entry(ent, struct osf_finger, flist);
+               list_del(&f->flist);
+               finger_free(f);
+       }
+       
+       log("OS fingerprint matching module finished.\n");
+}
+
+module_init(osf_init);
+module_exit(osf_fini);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Evgeniy Polyakov <johnpol@2ka.mipt.ru>");
+MODULE_DESCRIPTION("Passive OS fingerprint matching.");
+
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_pool.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_pool.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_pool.c   1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_pool.c       2004-02-16 11:07:21.519802833 +0100
@@ -0,0 +1,71 @@
+/* Kernel module to match an IP address pool. */
+
+#include <linux/module.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ip_pool.h>
+#include <linux/netfilter_ipv4/ipt_pool.h>
+
+static inline int match_pool(
+       ip_pool_t index,
+       __u32 addr,
+       int inv
+) {
+       if (ip_pool_match(index, ntohl(addr)))
+               inv = !inv;
+       return inv;
+}
+
+static int match(
+       const struct sk_buff *skb,
+       const struct net_device *in,
+       const struct net_device *out,
+       const void *matchinfo,
+       int offset,
+       const void *hdr,
+       u_int16_t datalen,
+       int *hotdrop
+) {
+       const struct ipt_pool_info *info = matchinfo;
+       const struct iphdr *iph = skb->nh.iph;
+
+       if (info->src != IP_POOL_NONE && !match_pool(info->src, iph->saddr,
+                                               info->flags&IPT_POOL_INV_SRC))
+               return 0;
+
+       if (info->dst != IP_POOL_NONE && !match_pool(info->dst, iph->daddr,
+                                               info->flags&IPT_POOL_INV_DST))
+               return 0;
+
+       return 1;
+}
+
+static int checkentry(
+       const char *tablename,
+       const struct ipt_ip *ip,
+       void *matchinfo,
+       unsigned int matchsize,
+       unsigned int hook_mask
+) {
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_pool_info)))
+               return 0;
+       return 1;
+}
+
+static struct ipt_match pool_match
+= { { NULL, NULL }, "pool", &match, &checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ipt_register_match(&pool_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&pool_match);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_psd.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_psd.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_psd.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_psd.c        2004-02-16 11:07:22.387595011 +0100
@@ -0,0 +1,361 @@
+/*
+  This is a module which is used for PSD (portscan detection)
+  Derived from scanlogd v2.1 written by Solar Designer <solar@false.com>
+  and LOG target module.
+
+  Copyright (C) 2000,2001 astaro AG
+
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+     ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  2000-05-04 Markus Hennig <hennig@astaro.de> : initial
+  2000-08-18 Dennis Koslowski <koslowski@astaro.de> : first release
+  2000-12-01 Dennis Koslowski <koslowski@astaro.de> : UDP scans detection added
+  2001-01-02 Dennis Koslowski <koslowski@astaro.de> : output modified
+  2001-02-04 Jan Rekorajski <baggins@pld.org.pl> : converted from target to match
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_psd.h>
+
+#if 0
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Dennis Koslowski <koslowski@astaro.com>");
+
+#define HF_DADDR_CHANGING   0x01
+#define HF_SPORT_CHANGING   0x02
+#define HF_TOS_CHANGING            0x04
+#define HF_TTL_CHANGING            0x08
+            
+/*
+ * Information we keep per each target port
+ */
+struct port {
+       u_int16_t number;      /* port number */ 
+       u_int8_t proto;        /* protocol number */
+       u_int8_t and_flags;    /* tcp ANDed flags */
+       u_int8_t or_flags;     /* tcp ORed flags */
+};
+
+/*
+ * Information we keep per each source address.
+ */
+struct host {
+       struct host *next;              /* Next entry with the same hash */
+       clock_t timestamp;              /* Last update time */
+       struct in_addr src_addr;        /* Source address */
+       struct in_addr dest_addr;       /* Destination address */
+       unsigned short src_port;        /* Source port */
+       int count;                      /* Number of ports in the list */
+       int weight;                     /* Total weight of ports in the list */
+       struct port ports[SCAN_MAX_COUNT - 1];  /* List of ports */
+       unsigned char tos;              /* TOS */
+       unsigned char ttl;              /* TTL */
+       unsigned char flags;            /* HF_ flags bitmask */
+};
+
+/*
+ * State information.
+ */
+static struct {
+       spinlock_t lock;
+       struct host list[LIST_SIZE];    /* List of source addresses */
+       struct host *hash[HASH_SIZE];   /* Hash: pointers into the list */
+       int index;                      /* Oldest entry to be replaced */
+} state;
+
+/*
+ * Convert an IP address into a hash table index.
+ */
+static inline int hashfunc(struct in_addr addr)
+{
+       unsigned int value;
+       int hash;
+
+       value = addr.s_addr;
+       hash = 0;
+       do {
+               hash ^= value;
+       } while ((value >>= HASH_LOG));
+
+       return hash & (HASH_SIZE - 1);
+}
+
+static int
+ipt_psd_match(const struct sk_buff *pskb,
+             const struct net_device *in,
+             const struct net_device *out,
+             const void *matchinfo,
+             int offset,
+             const void *hdr,
+             u_int16_t datalen,
+             int *hotdrop)
+{
+       struct iphdr *ip_hdr;
+       struct tcphdr *tcp_hdr;
+       struct in_addr addr;
+       u_int16_t src_port,dest_port;
+       u_int8_t tcp_flags, proto;
+       clock_t now;
+       struct host *curr, *last, **head;
+       int hash, index, count;
+
+       /* Parameters from userspace */
+       const struct ipt_psd_info *psdinfo = matchinfo;
+
+       /* IP header */
+       ip_hdr = pskb->nh.iph;
+
+       /* Sanity check */
+       if (ntohs(ip_hdr->frag_off) & IP_OFFSET) {
+               DEBUGP("PSD: sanity check failed\n");
+               return 0;
+       }
+
+       /* TCP or UDP ? */
+       proto = ip_hdr->protocol;
+
+       if (proto != IPPROTO_TCP && proto != IPPROTO_UDP) {
+               DEBUGP("PSD: protocol not supported\n");
+               return 0;
+       }
+
+       /* Get the source address, source & destination ports, and TCP flags */
+
+       addr.s_addr = ip_hdr->saddr;
+
+       tcp_hdr = (struct tcphdr*)((u_int32_t *)ip_hdr + ip_hdr->ihl);
+
+       /* Yep, it´s dirty */
+       src_port = tcp_hdr->source;
+       dest_port = tcp_hdr->dest;
+
+       if (proto == IPPROTO_TCP) {
+               tcp_flags = *((u_int8_t*)tcp_hdr + 13);
+       }
+       else {
+               tcp_flags = 0x00;
+       }
+
+       /* We're using IP address 0.0.0.0 for a special purpose here, so don't let
+        * them spoof us. [DHCP needs this feature - HW] */
+       if (!addr.s_addr) {
+               DEBUGP("PSD: spoofed source address (0.0.0.0)\n");
+               return 0;
+       }
+
+       /* Use jiffies here not to depend on someone setting the time while we're
+        * running; we need to be careful with possible return value overflows. */
+       now = jiffies;
+
+       spin_lock(&state.lock);
+
+       /* Do we know this source address already? */
+       count = 0;
+       last = NULL;
+       if ((curr = *(head = &state.hash[hash = hashfunc(addr)])))
+               do {
+                       if (curr->src_addr.s_addr == addr.s_addr) break;
+                       count++;
+                       if (curr->next) last = curr;
+               } while ((curr = curr->next));
+
+       if (curr) {
+
+               /* We know this address, and the entry isn't too old. Update it. */
+               if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
+                   time_after_eq(now, curr->timestamp)) {
+
+                       /* Just update the appropriate list entry if we've seen this port already */
+                       for (index = 0; index < curr->count; index++) {
+                               if (curr->ports[index].number == dest_port) {
+                                       curr->ports[index].proto = proto;
+                                       curr->ports[index].and_flags &= tcp_flags;
+                                       curr->ports[index].or_flags |= tcp_flags;
+                                       goto out_no_match;
+                               }
+                       }
+
+                       /* TCP/ACK and/or TCP/RST to a new port? This could be an outgoing connection. */
+                       if (proto == IPPROTO_TCP && (tcp_hdr->ack || tcp_hdr->rst))
+                               goto out_no_match;
+
+                       /* Packet to a new port, and not TCP/ACK: update the timestamp */
+                       curr->timestamp = now;
+
+                       /* Logged this scan already? Then drop the packet. */
+                       if (curr->weight >= psdinfo->weight_threshold)
+                               goto out_match;
+
+                       /* Specify if destination address, source port, TOS or TTL are not fixed */
+                       if (curr->dest_addr.s_addr != ip_hdr->daddr)
+                               curr->flags |= HF_DADDR_CHANGING;
+                       if (curr->src_port != src_port)
+                               curr->flags |= HF_SPORT_CHANGING;
+                       if (curr->tos != ip_hdr->tos)
+                               curr->flags |= HF_TOS_CHANGING;
+                       if (curr->ttl != ip_hdr->ttl)
+                               curr->flags |= HF_TTL_CHANGING;
+
+                       /* Update the total weight */
+                       curr->weight += (ntohs(dest_port) < 1024) ?
+                               psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
+
+                       /* Got enough destination ports to decide that this is a scan? */
+                       /* Then log it and drop the packet. */
+                       if (curr->weight >= psdinfo->weight_threshold)
+                               goto out_match;
+
+                       /* Remember the new port */
+                       if (curr->count < SCAN_MAX_COUNT) {
+                               curr->ports[curr->count].number = dest_port;
+                               curr->ports[curr->count].proto = proto;
+                               curr->ports[curr->count].and_flags = tcp_flags;
+                               curr->ports[curr->count].or_flags = tcp_flags;
+                               curr->count++;
+                       }
+
+                       goto out_no_match;
+               }
+
+               /* We know this address, but the entry is outdated. Mark it unused, and
+                * remove from the hash table. We'll allocate a new entry instead since
+                * this one might get re-used too soon. */
+               curr->src_addr.s_addr = 0;
+               if (last)
+                       last->next = last->next->next;
+               else if (*head)
+                       *head = (*head)->next;
+               last = NULL;
+       }
+
+       /* We don't need an ACK from a new source address */
+       if (proto == IPPROTO_TCP && tcp_hdr->ack)
+               goto out_no_match;
+
+       /* Got too many source addresses with the same hash value? Then remove the
+        * oldest one from the hash table, so that they can't take too much of our
+        * CPU time even with carefully chosen spoofed IP addresses. */
+       if (count >= HASH_MAX && last) last->next = NULL;
+
+       /* We're going to re-use the oldest list entry, so remove it from the hash
+        * table first (if it is really already in use, and isn't removed from the
+        * hash table already because of the HASH_MAX check above). */
+
+       /* First, find it */
+       if (state.list[state.index].src_addr.s_addr)
+               head = &state.hash[hashfunc(state.list[state.index].src_addr)];
+       else
+               head = &last;
+       last = NULL;
+       if ((curr = *head))
+       do {
+               if (curr == &state.list[state.index]) break;
+               last = curr;
+       } while ((curr = curr->next));
+
+       /* Then, remove it */
+       if (curr) {
+               if (last)
+                       last->next = last->next->next;
+               else if (*head)
+                       *head = (*head)->next;
+       }
+
+       /* Get our list entry */
+       curr = &state.list[state.index++];
+       if (state.index >= LIST_SIZE) state.index = 0;
+
+       /* Link it into the hash table */
+       head = &state.hash[hash];
+       curr->next = *head;
+       *head = curr;
+
+       /* And fill in the fields */
+       curr->timestamp = now;
+       curr->src_addr = addr;
+       curr->dest_addr.s_addr = ip_hdr->daddr;
+       curr->src_port = src_port;
+       curr->count = 1;
+       curr->weight = (ntohs(dest_port) < 1024) ?
+               psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
+       curr->ports[0].number = dest_port;
+       curr->ports[0].proto = proto;
+       curr->ports[0].and_flags = tcp_flags;
+       curr->ports[0].or_flags = tcp_flags;
+       curr->tos = ip_hdr->tos;
+       curr->ttl = ip_hdr->ttl;
+
+out_no_match:
+       spin_unlock(&state.lock);
+       return 0;
+
+out_match:
+       spin_unlock(&state.lock);
+       return 1;
+}
+
+static int ipt_psd_checkentry(const char *tablename,
+                             const struct ipt_ip *e,
+                             void *matchinfo,
+                             unsigned int matchsize,
+                             unsigned int hook_mask)
+{
+/*     const struct ipt_psd_info *psdinfo = targinfo;*/
+
+       /* we accept TCP only */
+/*     if (e->ip.proto != IPPROTO_TCP) { */
+/*             DEBUGP("PSD: specified protocol may be TCP only\n"); */
+/*             return 0; */
+/*     } */
+
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_psd_info))) {
+               DEBUGP("PSD: matchsize %u != %u\n",
+                      matchsize,
+                      IPT_ALIGN(sizeof(struct ipt_psd_info)));
+               return 0;
+       }
+
+       return 1;
+}
+
+static struct ipt_match ipt_psd_reg = { 
+       {NULL, NULL},
+       "psd",
+       ipt_psd_match,
+       ipt_psd_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ipt_register_match(&ipt_psd_reg))
+               return -EINVAL;
+
+       memset(&state, 0, sizeof(state));
+
+       spin_lock_init(&(state.lock));
+
+       printk("netfilter PSD loaded - (c) astaro AG\n");
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&ipt_psd_reg);
+       printk("netfilter PSD unloaded - (c) astaro AG\n");
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_quota.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_quota.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_quota.c  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_quota.c      2004-02-16 11:07:23.219395809 +0100
@@ -0,0 +1,81 @@
+/* 
+ * netfilter module to enforce network quotas
+ *
+ * Sam Johnston <samj@samj.net>
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_quota.h>
+
+MODULE_LICENSE("GPL");
+
+static spinlock_t quota_lock = SPIN_LOCK_UNLOCKED;
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset, const void *hdr, u_int16_t datalen, int *hotdrop)
+{
+
+        struct ipt_quota_info *q = (struct ipt_quota_info *) matchinfo;
+
+        spin_lock_bh(&quota_lock);
+
+        if (q->quota >= datalen) {
+                /* we can afford this one */
+                q->quota -= datalen;
+                spin_unlock_bh(&quota_lock);
+
+#ifdef DEBUG_IPT_QUOTA
+                printk("IPT Quota OK: %llu datlen %d \n", q->quota, datalen);
+#endif
+                return 1;
+        }
+
+        /* so we do not allow even small packets from now on */
+        q->quota = 0;
+
+#ifdef DEBUG_IPT_QUOTA
+        printk("IPT Quota Failed: %llu datlen %d \n", q->quota, datalen);
+#endif
+
+        spin_unlock_bh(&quota_lock);
+        return 0;
+}
+
+static int
+checkentry(const char *tablename,
+           const struct ipt_ip *ip,
+           void *matchinfo, unsigned int matchsize, unsigned int hook_mask)
+{
+        /* TODO: spinlocks? sanity checks? */
+        if (matchsize != IPT_ALIGN(sizeof (struct ipt_quota_info)))
+                return 0;
+
+        return 1;
+}
+
+static struct ipt_match quota_match
+    = { {NULL, NULL}, "quota", &match, &checkentry, NULL, THIS_MODULE };
+
+static int __init
+init(void)
+{
+        return ipt_register_match(&quota_match);
+}
+
+static void __exit
+fini(void)
+{
+        ipt_unregister_match(&quota_match);
+}
+
+module_init(init);
+module_exit(fini);
+
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_random.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_random.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_random.c 1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_random.c     2004-02-16 11:07:24.379118074 +0100
@@ -0,0 +1,96 @@
+/*
+  This is a module which is used for a "random" match support.
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+     ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  2001-10-14 Fabrice MARIE <fabrice@netfilter.org> : initial implementation.
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/random.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_random.h>
+
+MODULE_LICENSE("GPL");
+
+static int
+ipt_rand_match(const struct sk_buff *pskb,
+              const struct net_device *in,
+              const struct net_device *out,
+              const void *matchinfo,
+              int offset,
+              const void *hdr,
+              u_int16_t datalen,
+              int *hotdrop)
+{
+       /* Parameters from userspace */
+       const struct ipt_rand_info *info = matchinfo;
+       u_int8_t random_number;
+
+       /* get 1 random number from the kernel random number generation routine */
+       get_random_bytes((void *)(&random_number), 1);
+
+       /* Do we match ? */
+       if (random_number <= info->average)
+               return 1;
+       else
+               return 0;
+}
+
+static int
+ipt_rand_checkentry(const char *tablename,
+                  const struct ipt_ip *e,
+                  void *matchinfo,
+                  unsigned int matchsize,
+                  unsigned int hook_mask)
+{
+       /* Parameters from userspace */
+       const struct ipt_rand_info *info = matchinfo;
+
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_rand_info))) {
+               printk("ipt_random: matchsize %u != %u\n", matchsize,
+                      IPT_ALIGN(sizeof(struct ipt_rand_info)));
+               return 0;
+       }
+
+       /* must be  1 <= average % <= 99 */
+       /* 1  x 2.55 = 2   */
+       /* 99 x 2.55 = 252 */
+       if ((info->average < 2) || (info->average > 252)) {
+               printk("ipt_random:  invalid average %u\n", info->average);
+               return 0;
+       }
+
+       return 1;
+}
+
+static struct ipt_match ipt_rand_reg = { 
+       {NULL, NULL},
+       "random",
+       ipt_rand_match,
+       ipt_rand_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ipt_register_match(&ipt_rand_reg))
+               return -EINVAL;
+
+       printk("ipt_random match loaded\n");
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&ipt_rand_reg);
+       printk("ipt_random match unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_realm.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_realm.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_realm.c  1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_realm.c      2004-02-16 11:07:26.369641375 +0100
@@ -0,0 +1,68 @@
+/* Kernel module to match realm from routing. */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <net/route.h>
+
+#include <linux/netfilter_ipv4/ipt_realm.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+MODULE_AUTHOR("Sampsa Ranta <sampsa@netsonic.fi>");
+MODULE_LICENSE("GPL");
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       const struct ipt_realm_info *info = matchinfo;
+       struct dst_entry *dst = skb->dst;
+       u32 id;
+    
+       if(dst == NULL)
+               return 0;
+       id = dst->tclassid;
+
+       return (info->id == (id & info->mask)) ^ info->invert;
+}
+
+static int check(const char *tablename,
+                 const struct ipt_ip *ip,
+                 void *matchinfo,
+                 unsigned int matchsize,
+                 unsigned int hook_mask)
+{
+       if (hook_mask
+           & ~((1 << NF_IP_POST_ROUTING) | (1 << NF_IP_FORWARD) |
+               (1 << NF_IP_LOCAL_OUT)| (1 << NF_IP_LOCAL_IN))) {
+               printk("ipt_realm: only valid for POST_ROUTING, LOCAL_OUT, "
+                      "LOCAL_IN or FORWARD.\n");
+               return 0;
+       }
+
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_realm_info)))
+               return 0;
+
+       return 1;
+}
+
+static struct ipt_match realm_match
+= { { NULL, NULL }, "realm", &match, &check, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ipt_register_match(&realm_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&realm_match);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_time.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_time.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_time.c   1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_time.c       2004-02-16 11:07:27.150454383 +0100
@@ -0,0 +1,185 @@
+/*
+  This is a module which is used for time matching
+  It is using some modified code from dietlibc (localtime() function)
+  that you can find at http://www.fefe.de/dietlibc/
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from: ftp://prep.ai.mit.edu/pub/gnu/GPL
+  2001-05-04 Fabrice MARIE <fabrice@netfilter.org> : initial development.
+  2001-21-05 Fabrice MARIE <fabrice@netfilter.org> : bug fix in the match code,
+     thanks to "Zeng Yu" <zengy@capitel.com.cn> for bug report.
+  2001-26-09 Fabrice MARIE <fabrice@netfilter.org> : force the match to be in LOCAL_IN or PRE_ROUTING only.
+  2001-30-11 Fabrice : added the possibility to use the match in FORWARD/OUTPUT with a little hack,
+     added Nguyen Dang Phuoc Dong <dongnd@tlnet.com.vn> patch to support timezones.
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_time.h>
+#include <linux/time.h>
+
+MODULE_AUTHOR("Fabrice MARIE <fabrice@netfilter.org>");
+MODULE_DESCRIPTION("Match arrival timestamp");
+MODULE_LICENSE("GPL");
+
+struct tm
+{
+       int tm_sec;                   /* Seconds.     [0-60] (1 leap second) */
+       int tm_min;                   /* Minutes.     [0-59] */
+       int tm_hour;                  /* Hours.       [0-23] */
+       int tm_mday;                  /* Day.         [1-31] */
+       int tm_mon;                   /* Month.       [0-11] */
+       int tm_year;                  /* Year - 1900.  */
+       int tm_wday;                  /* Day of week. [0-6] */
+       int tm_yday;                  /* Days in year.[0-365] */
+       int tm_isdst;                 /* DST.         [-1/0/1]*/
+
+       long int tm_gmtoff;           /* we don't care, we count from GMT */
+       const char *tm_zone;          /* we don't care, we count from GMT */
+};
+
+void
+localtime(const time_t *timepr, struct tm *r);
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       const struct ipt_time_info *info = matchinfo;   /* match info for rule */
+       struct tm currenttime;                          /* time human readable */
+       u_int8_t days_of_week[7] = {64, 32, 16, 8, 4, 2, 1};
+       u_int16_t packet_time;
+       struct timeval kerneltimeval;
+       time_t packet_local_time;
+
+       /* if kerneltime=1, we don't read the skb->timestamp but kernel time instead */
+       if (info->kerneltime)
+       {
+               do_gettimeofday(&kerneltimeval);
+               packet_local_time = kerneltimeval.tv_sec;
+       }
+       else
+               packet_local_time = skb->stamp.tv_sec;
+
+       /* Transform the timestamp of the packet, in a human readable form */
+       localtime(&packet_local_time, &currenttime);
+
+       /* check if we match this timestamp, we start by the days... */
+       if ((days_of_week[currenttime.tm_wday] & info->days_match) != days_of_week[currenttime.tm_wday])
+               return 0; /* the day doesn't match */
+
+       /* ... check the time now */
+       packet_time = (currenttime.tm_hour * 60) + currenttime.tm_min;
+       if ((packet_time < info->time_start) || (packet_time > info->time_stop))
+               return 0;
+
+       /* here we match ! */
+       return 1;
+}
+
+static int
+checkentry(const char *tablename,
+           const struct ipt_ip *ip,
+           void *matchinfo,
+           unsigned int matchsize,
+           unsigned int hook_mask)
+{
+       struct ipt_time_info *info = matchinfo;   /* match info for rule */
+
+       /* First, check that we are in the correct hook */
+       /* PRE_ROUTING, LOCAL_IN or FROWARD */
+       if (hook_mask
+            & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)))
+       {
+               printk("ipt_time: error, only valid for PRE_ROUTING, LOCAL_IN, FORWARD and OUTPUT)\n");
+               return 0;
+       }
+       /* we use the kerneltime if we are in forward or output */
+       info->kerneltime = 1;
+       if (hook_mask & ~((1 << NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT))) 
+               /* if not, we use the skb time */
+               info->kerneltime = 0;
+
+       /* Check the size */
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_time_info)))
+               return 0;
+       /* Now check the coherence of the data ... */
+       if ((info->time_start > 1439) ||        /* 23*60+59 = 1439*/
+           (info->time_stop  > 1439))
+       {
+               printk(KERN_WARNING "ipt_time: invalid argument\n");
+               return 0;
+       }
+
+       return 1;
+}
+
+static struct ipt_match time_match
+= { { NULL, NULL }, "time", &match, &checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       printk("ipt_time loading\n");
+       return ipt_register_match(&time_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&time_match);
+       printk("ipt_time unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);
+
+
+/* The part below is borowed and modified from dietlibc */
+
+/* seconds per day */
+#define SPD 24*60*60
+
+void
+localtime(const time_t *timepr, struct tm *r) {
+       time_t i;
+       time_t timep;
+       extern struct timezone sys_tz;
+       const unsigned int __spm[12] =
+               { 0,
+                 (31),
+                 (31+28),
+                 (31+28+31),
+                 (31+28+31+30),
+                 (31+28+31+30+31),
+                 (31+28+31+30+31+30),
+                 (31+28+31+30+31+30+31),
+                 (31+28+31+30+31+30+31+31),
+                 (31+28+31+30+31+30+31+31+30),
+                 (31+28+31+30+31+30+31+31+30+31),
+                 (31+28+31+30+31+30+31+31+30+31+30),
+               };
+       register time_t work;
+
+       timep = (*timepr) - (sys_tz.tz_minuteswest * 60);
+       work=timep%(SPD);
+       r->tm_sec=work%60; work/=60;
+       r->tm_min=work%60; r->tm_hour=work/60;
+       work=timep/(SPD);
+       r->tm_wday=(4+work)%7;
+       for (i=1970; ; ++i) {
+               register time_t k= (!(i%4) && ((i%100) || !(i%400)))?366:365;
+               if (work>k)
+                       work-=k;
+               else
+                       break;
+       }
+       r->tm_year=i-1900;
+       for (i=11; i && __spm[i]>work; --i) ;
+       r->tm_mon=i;
+       r->tm_mday=work-__spm[i]+1;
+}
diff -Nur linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_u32.c linux-2.6.3-rc3/net/ipv4/netfilter/ipt_u32.c
--- linux-2.6.3-rc3.org/net/ipv4/netfilter/ipt_u32.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv4/netfilter/ipt_u32.c        2004-02-16 11:07:28.175208970 +0100
@@ -0,0 +1,211 @@
+/* Kernel module to match u32 packet content. */
+
+/* 
+U32 tests whether quantities of up to 4 bytes extracted from a packet 
+have specified values.  The specification of what to extract is general 
+enough to find data at given offsets from tcp headers or payloads.
+
+ --u32 tests
+ The argument amounts to a program in a small language described below.
+ tests := location = value |  tests && location = value
+ value := range | value , range
+ range := number | number : number
+  a single number, n, is interpreted the same as n:n
+  n:m is interpreted as the range of numbers >=n and <=m
+ location := number | location operator number
+ operator := & | << | >> | @
+
+ The operators &, <<, >>, && mean the same as in c.  The = is really a set
+ membership operator and the value syntax describes a set.  The @ operator
+ is what allows moving to the next header and is described further below.
+
+ *** Until I can find out how to avoid it, there are some artificial limits
+ on the size of the tests:
+ - no more than 10 ='s (and 9 &&'s) in the u32 argument
+ - no more than 10 ranges (and 9 commas) per value
+ - no more than 10 numbers (and 9 operators) per location
+
+ To describe the meaning of location, imagine the following machine that
+ interprets it.  There are three registers:
+  A is of type char*, initially the address of the IP header
+  B and C are unsigned 32 bit integers, initially zero
+
+  The instructions are:
+   number      B = number;
+               C = (*(A+B)<<24)+(*(A+B+1)<<16)+(*(A+B+2)<<8)+*(A+B+3)
+   &number     C = C&number
+   <<number    C = C<<number
+   >>number    C = C>>number
+   @number     A = A+C; then do the instruction number
+  Any access of memory outside [skb->head,skb->end] causes the match to fail.
+  Otherwise the result of the computation is the final value of C.
+
+ Whitespace is allowed but not required in the tests.
+ However the characters that do occur there are likely to require
+ shell quoting, so it's a good idea to enclose the arguments in quotes.
+
+Example:
+ match IP packets with total length >= 256
+ The IP header contains a total length field in bytes 2-3.
+ --u32 "0&0xFFFF=0x100:0xFFFF" 
+ read bytes 0-3
+ AND that with FFFF (giving bytes 2-3),
+ and test whether that's in the range [0x100:0xFFFF]
+
+Example: (more realistic, hence more complicated)
+ match icmp packets with icmp type 0
+ First test that it's an icmp packet, true iff byte 9 (protocol) = 1
+ --u32 "6&0xFF=1 && ...
+ read bytes 6-9, use & to throw away bytes 6-8 and compare the result to 1
+ Next test that it's not a fragment.
+  (If so it might be part of such a packet but we can't always tell.)
+  n.b. This test is generally needed if you want to match anything
+  beyond the IP header.
+ The last 6 bits of byte 6 and all of byte 7 are 0 iff this is a complete
+ packet (not a fragment).  Alternatively, you can allow first fragments
+ by only testing the last 5 bits of byte 6.
+ ... 4&0x3FFF=0 && ...
+ Last test: the first byte past the IP header (the type) is 0
+ This is where we have to use the @syntax.  The length of the IP header
+ (IHL) in 32 bit words is stored in the right half of byte 0 of the
+ IP header itself.
+ ... 0>>22&0x3C@0>>24=0"
+ The first 0 means read bytes 0-3,
+ >>22 means shift that 22 bits to the right.  Shifting 24 bits would give
+   the first byte, so only 22 bits is four times that plus a few more bits.
+ &3C then eliminates the two extra bits on the right and the first four 
+ bits of the first byte.
+ For instance, if IHL=5 then the IP header is 20 (4 x 5) bytes long.
+ In this case bytes 0-1 are (in binary) xxxx0101 yyzzzzzz, 
+ >>22 gives the 10 bit value xxxx0101yy and &3C gives 010100.
+ @ means to use this number as a new offset into the packet, and read
+ four bytes starting from there.  This is the first 4 bytes of the icmp
+ payload, of which byte 0 is the icmp type.  Therefore we simply shift
+ the value 24 to the right to throw out all but the first byte and compare
+ the result with 0.
+
+Example: 
+ tcp payload bytes 8-12 is any of 1, 2, 5 or 8
+ First we test that the packet is a tcp packet (similar to icmp).
+ --u32 "6&0xFF=6 && ...
+ Next, test that it's not a fragment (same as above).
+ ... 0>>22&0x3C@12>>26&0x3C@8=1,2,5,8"
+ 0>>22&3C as above computes the number of bytes in the IP header.
+ @ makes this the new offset into the packet, which is the start of the
+ tcp header.  The length of the tcp header (again in 32 bit words) is
+ the left half of byte 12 of the tcp header.  The 12>>26&3C
+ computes this length in bytes (similar to the IP header before).
+ @ makes this the new offset, which is the start of the tcp payload.
+ Finally 8 reads bytes 8-12 of the payload and = checks whether the
+ result is any of 1, 2, 5 or 8
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter_ipv4/ipt_u32.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+
+/* #include <asm-i386/timex.h> for timing */
+
+MODULE_AUTHOR("Don Cohen <don@isis.cs3-inc.com>");
+MODULE_DESCRIPTION("IP tables u32 matching module");
+MODULE_LICENSE("GPL");
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const void *matchinfo,
+      int offset,
+      const void *hdr,
+      u_int16_t datalen,
+      int *hotdrop)
+{
+       const struct ipt_u32 *data = matchinfo;
+       int testind, i;
+       unsigned char* origbase = (char*)skb->nh.iph;
+       unsigned char* base = origbase;
+       unsigned char* head = skb->head;
+       unsigned char* end = skb->end;
+       int nnums, nvals;
+       u_int32_t pos, val;
+       /* unsigned long long cycles1, cycles2, cycles3, cycles4;
+          cycles1 = get_cycles(); */
+
+       for (testind=0; testind < data->ntests; testind++) {
+               base = origbase; /* reset for each test */
+               pos = data->tests[testind].location[0].number;
+               if (base+pos+3 > end || base+pos < head) 
+                       return 0;
+               val = (base[pos]<<24) + (base[pos+1]<<16) +
+                       (base[pos+2]<<8) + base[pos+3];
+               nnums = data->tests[testind].nnums;
+               for (i=1; i < nnums; i++) {
+                       u_int32_t number = data->tests[testind].location[i].number;
+                       switch (data->tests[testind].location[i].nextop) {
+                       case IPT_U32_AND: 
+                               val = val & number; 
+                               break;
+                       case IPT_U32_LEFTSH: 
+                               val = val << number;
+                               break;
+                       case IPT_U32_RIGHTSH: 
+                               val = val >> number; 
+                               break;
+                       case IPT_U32_AT:
+                               base = base + val;
+                               pos = number;
+                               if (base+pos+3 > end || base+pos < head) 
+                                       return 0;
+                               val = (base[pos]<<24) + (base[pos+1]<<16) +
+                                       (base[pos+2]<<8) + base[pos+3];
+                               break;
+                       }
+               }
+               nvals = data->tests[testind].nvalues;
+               for (i=0; i < nvals; i++) {
+                       if ((data->tests[testind].value[i].min <= val) &&
+                           (val <= data->tests[testind].value[i].max)) {
+                               break;
+                       }
+               }
+               if (i >= data->tests[testind].nvalues) {
+                       /* cycles2 = get_cycles(); 
+                          printk("failed %d in %d cycles\n", testind, 
+                                 cycles2-cycles1); */
+                       return 0;
+               }
+       }
+       /* cycles2 = get_cycles();
+          printk("succeeded in %d cycles\n", cycles2-cycles1); */
+       return 1;
+}
+
+static int
+checkentry(const char *tablename,
+           const struct ipt_ip *ip,
+           void *matchinfo,
+           unsigned int matchsize,
+           unsigned int hook_mask)
+{
+       if (matchsize != IPT_ALIGN(sizeof(struct ipt_u32)))
+               return 0;
+       return 1;
+}
+
+static struct ipt_match u32_match
+= { { NULL, NULL }, "u32", &match, &checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ipt_register_match(&u32_match);
+}
+
+static void __exit fini(void)
+{
+       ipt_unregister_match(&u32_match);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/Kconfig linux-2.6.3-rc3/net/ipv6/netfilter/Kconfig
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/Kconfig      2004-02-15 03:45:16.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/Kconfig  2004-02-16 11:07:24.383117116 +0100
@@ -218,5 +218,85 @@
          To compile it as a module, choose M here.  If unsure, say N.
 
 #dep_tristate '  LOG target support' CONFIG_IP6_NF_TARGET_LOG $CONFIG_IP6_NF_IPTABLES
+config IP6_NF_TARGET_HOPLIMIT
+       tristate  'HOPLIMIT target support'
+       depends on IP6_NF_MANGLE
+         help
+         This allows the user to set the IPv6 Hop Limit value on a packet or
+         to increment or decrement it by a given value.
+         
+         Example:
+         # ip6tables -t mangle -A OUTPUT -j HOPLIMIT --hl-inc 1
+         # ip6tables -t mangle -A INPUT -j HOPLIMIT --hl-eq 64
+         # ip6tables -t mangle -A OUTPUT -j HOPLIMIT --hl-dec 2
+
+config IP6_NF_TARGET_REJECT
+       tristate  'REJECT target support'
+       depends on IP6_NF_FILTER
+         help
+         This CONFIG_IP6_NF_TARGET_REJECT option adds a REJECT target to ip6tables.
+         Please keep in mind that the icmp-types are different from the icmpv6 types
+         (see ip6tables -j REJECT -h for more info)
+
+config IP6_NF_MATCH_FUZZY
+       tristate  'Fuzzy match support'
+       depends on IP6_NF_FILTER
+         help
+         This option adds a `fuzzy' match which allows you to match packets according to
+         a dynamic profile implemented by means of a simple Fuzzy Logic Controller (FLC)
+
+config IP6_NF_MATCH_NTH
+       tristate  'Nth match support'
+       depends on IP6_NF_IPTABLES
+         help
+         This option adds an iptables `Nth' match, which allows you to match every Nth
+         packet encountered.  By default there are 16 different counters that can be
+         used.
+         
+         This match functions in one of two ways
+         1) Match ever Nth packet, and only the Nth packet.
+            example:
+             iptables -t mangle -A PREROUTING -m nth --every 10 -j DROP
+            This rule will drop every 10th packet.
+         2) Unique rule for every packet.  This is an easy and quick
+            method to produce load-balancing for both inbound and outbound.
+            example:
+             iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \
+                      --every 3 --packet 0 -j SNAT --to-source 10.0.0.5
+             iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \
+                      --every 3 --packet 1 -j SNAT --to-source 10.0.0.6
+             iptables -t nat -A POSTROUTING -o eth0 -m nth --counter 7 \
+                      --every 3 --packet 2 -j SNAT --to-source 10.0.0.7
+            This example evenly splits connections between the three SNAT
+            addresses.
+         
+            By using the mangle table and iproute2, you can setup complex
+            load-balanced routing.  There's lot of other uses.  Be creative!
+         
+         Suppported options are:
+            --every     Nth         Match every Nth packet
+           [--counter]  num         Use counter 0-15 (default:0)
+           [--start]    num         Initialize the counter at the number 'num'
+                                    instead of 0. Must be between 0 and Nth-1
+           [--packet]   num         Match on 'num' packet. Must be between 0
+                                    and Nth-1.
+                                    If --packet is used for a counter than
+                                    there must be Nth number of --packet
+                                    rules, covering all values between 0 and
+                                    Nth-1 inclusively.
+
+config IP6_NF_MATCH_RANDOM
+       tristate  'Random match support'
+       depends on IP6_NF_IPTABLES
+         help
+         This option adds a `random' match,
+         which allow you to match packets randomly
+         following a given probability. 
+         
+         Suppported options are:
+         
+         [--average]   percent will match randomly packets with a probability of
+                       'percent'. default is 50%
+
 endmenu
 
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/Makefile linux-2.6.3-rc3/net/ipv6/netfilter/Makefile
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/Makefile     2004-02-15 03:44:25.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/Makefile 2004-02-16 11:07:24.383117116 +0100
@@ -8,6 +8,7 @@
 obj-$(CONFIG_IP6_NF_MATCH_MARK) += ip6t_mark.o
 obj-$(CONFIG_IP6_NF_MATCH_LENGTH) += ip6t_length.o
 obj-$(CONFIG_IP6_NF_MATCH_MAC) += ip6t_mac.o
+obj-$(CONFIG_IP6_NF_MATCH_FUZZY) += ip6t_fuzzy.o
 obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
 obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o ip6t_dst.o
 obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
@@ -19,6 +20,12 @@
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_TARGET_MARK) += ip6t_MARK.o
+obj-$(CONFIG_IP6_NF_TARGET_REJECT) += ip6t_REJECT.o
 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
+
+obj-$(CONFIG_IP6_NF_MATCH_RANDOM) += ip6t_random.o
+
+obj-$(CONFIG_IP6_NF_MATCH_NTH) += ip6t_nth.o
+obj-$(CONFIG_IP6_NF_TARGET_HOPLIMIT) += ip6t_HL.o
 obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_HL.c linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_HL.c
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_HL.c    1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_HL.c        2004-02-16 11:06:53.521507853 +0100
@@ -0,0 +1,105 @@
+/* 
+ * Hop Limit modification target for ip6tables
+ * Maciej Soltysiak <solt@dns.toxicfilms.tv>
+ * Based on HW's TTL module
+ *
+ * This software is distributed under the terms of GNU GPL
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv6/ip6t_HL.h>
+
+MODULE_AUTHOR("Maciej Soltysiak <solt@dns.toxicfilms.tv>");
+MODULE_DESCRIPTION("IP tables Hop Limit modification module");
+MODULE_LICENSE("GPL");
+
+static unsigned int ip6t_hl_target(struct sk_buff **pskb, unsigned int hooknum,
+               const struct net_device *in, const struct net_device *out,
+               const void *targinfo, void *userinfo)
+{
+       struct ipv6hdr *ip6h = (*pskb)->nh.ipv6h;
+       const struct ip6t_HOPLIMIT_info *info = targinfo;
+       u_int16_t diffs[2];
+       int new_hl;
+                        
+       switch (info->mode) {
+               case IP6T_HOPLIMIT_SET:
+                       new_hl = info->hop_limit;
+                       break;
+               case IP6T_HOPLIMIT_INC:
+                       new_hl = ip6h->hop_limit + info->hop_limit;
+                       if (new_hl > 255)
+                               new_hl = 255;
+                       break;
+               case IP6T_HOPLIMIT_DEC:
+                       new_hl = ip6h->hop_limit + info->hop_limit;
+                       if (new_hl < 0)
+                               new_hl = 0;
+                       break;
+               default:
+                       new_hl = ip6h->hop_limit;
+                       break;
+       }
+
+       if (new_hl != ip6h->hop_limit) {
+               diffs[0] = htons(((unsigned)ip6h->hop_limit) << 8) ^ 0xFFFF;
+               ip6h->hop_limit = new_hl;
+               diffs[1] = htons(((unsigned)ip6h->hop_limit) << 8);
+       }
+
+       return IP6T_CONTINUE;
+}
+
+static int ip6t_hl_checkentry(const char *tablename,
+               const struct ip6t_entry *e,
+               void *targinfo,
+               unsigned int targinfosize,
+               unsigned int hook_mask)
+{
+       struct ip6t_HOPLIMIT_info *info = targinfo;
+
+       if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_HOPLIMIT_info))) {
+               printk(KERN_WARNING "HOPLIMIT: targinfosize %u != %Zu\n",
+                               targinfosize,
+                               IP6T_ALIGN(sizeof(struct ip6t_HOPLIMIT_info)));
+               return 0;       
+       }       
+
+       if (strcmp(tablename, "mangle")) {
+               printk(KERN_WARNING "HOPLIMIT: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
+               return 0;
+       }
+
+       if (info->mode > IP6T_HOPLIMIT_MAXMODE) {
+               printk(KERN_WARNING "HOPLIMIT: invalid or unknown Mode %u\n", 
+                       info->mode);
+               return 0;
+       }
+
+       if ((info->mode != IP6T_HOPLIMIT_SET) && (info->hop_limit == 0)) {
+               printk(KERN_WARNING "HOPLIMIT: increment/decrement doesn't make sense with value 0\n");
+               return 0;
+       }
+       
+       return 1;
+}
+
+static struct ip6t_target ip6t_HOPLIMIT = { { NULL, NULL }, "HOPLIMIT", 
+       ip6t_hl_target, ip6t_hl_checkentry, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       return ip6t_register_target(&ip6t_HOPLIMIT);
+}
+
+static void __exit fini(void)
+{
+       ip6t_unregister_target(&ip6t_HOPLIMIT);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_REJECT.c linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_REJECT.c
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_REJECT.c        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_REJECT.c    2004-02-16 11:07:07.805087251 +0100
@@ -0,0 +1,274 @@
+/*
+ * This is a module which is used for rejecting packets.
+ *     Added support for customized reject packets (Jozsef Kadlecsik).
+ * Sun 12 Nov 2000
+ *     Port to IPv6 / ip6tables (Harald Welte <laforge@gnumonks.org>)
+ */
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/icmpv6.h>
+#include <net/tcp.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv6/ip6t_REJECT.h>
+
+#if 1
+#define DEBUGP printk
+#else
+#define DEBUGP(format, args...)
+#endif
+
+#if 0
+/* Send RST reply */
+static void send_reset(struct sk_buff *oldskb)
+{
+       struct sk_buff *nskb;
+       struct tcphdr *otcph, *tcph;
+       struct rtable *rt;
+       unsigned int otcplen;
+       int needs_ack;
+
+       /* IP header checks: fragment, too short. */
+       if (oldskb->nh.iph->frag_off & htons(IP_OFFSET)
+           || oldskb->len < (oldskb->nh.iph->ihl<<2) + sizeof(struct tcphdr))
+               return;
+
+       otcph = (struct tcphdr *)((u_int32_t*)oldskb->nh.iph + oldskb->nh.iph->ihl);
+       otcplen = oldskb->len - oldskb->nh.iph->ihl*4;
+
+       /* No RST for RST. */
+       if (otcph->rst)
+               return;
+
+       /* Check checksum. */
+       if (tcp_v4_check(otcph, otcplen, oldskb->nh.iph->saddr,
+                        oldskb->nh.iph->daddr,
+                        csum_partial((char *)otcph, otcplen, 0)) != 0)
+               return;
+
+       /* Copy skb (even if skb is about to be dropped, we can't just
+           clone it because there may be other things, such as tcpdump,
+           interested in it) */
+       nskb = skb_copy(oldskb, GFP_ATOMIC);
+       if (!nskb)
+               return;
+
+       /* This packet will not be the same as the other: clear nf fields */
+       nf_conntrack_put(nskb->nfct);
+       nskb->nfct = NULL;
+       nskb->nfcache = 0;
+#ifdef CONFIG_NETFILTER_DEBUG
+       nskb->nf_debug = 0;
+#endif
+
+       tcph = (struct tcphdr *)((u_int32_t*)nskb->nh.iph + nskb->nh.iph->ihl);
+
+       nskb->nh.iph->daddr = xchg(&nskb->nh.iph->saddr, nskb->nh.iph->daddr);
+       tcph->source = xchg(&tcph->dest, tcph->source);
+
+       /* Truncate to length (no data) */
+       tcph->doff = sizeof(struct tcphdr)/4;
+       skb_trim(nskb, nskb->nh.iph->ihl*4 + sizeof(struct tcphdr));
+       nskb->nh.iph->tot_len = htons(nskb->len);
+
+       if (tcph->ack) {
+               needs_ack = 0;
+               tcph->seq = otcph->ack_seq;
+               tcph->ack_seq = 0;
+       } else {
+               needs_ack = 1;
+               tcph->ack_seq = htonl(ntohl(otcph->seq) + otcph->syn + otcph->fin
+                                     + otcplen - (otcph->doff<<2));
+               tcph->seq = 0;
+       }
+
+       /* Reset flags */
+       ((u_int8_t *)tcph)[13] = 0;
+       tcph->rst = 1;
+       tcph->ack = needs_ack;
+
+       tcph->window = 0;
+       tcph->urg_ptr = 0;
+
+       /* Adjust TCP checksum */
+       tcph->check = 0;
+       tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr),
+                                  nskb->nh.iph->saddr,
+                                  nskb->nh.iph->daddr,
+                                  csum_partial((char *)tcph,
+                                               sizeof(struct tcphdr), 0));
+
+       /* Adjust IP TTL, DF */
+       nskb->nh.iph->ttl = MAXTTL;
+       /* Set DF, id = 0 */
+       nskb->nh.iph->frag_off = htons(IP_DF);
+       nskb->nh.iph->id = 0;
+
+       /* Adjust IP checksum */
+       nskb->nh.iph->check = 0;
+       nskb->nh.iph->check = ip_fast_csum((unsigned char *)nskb->nh.iph, 
+                                          nskb->nh.iph->ihl);
+
+       /* Routing */
+       if (ip_route_output(&rt, nskb->nh.iph->daddr, nskb->nh.iph->saddr,
+                           RT_TOS(nskb->nh.iph->tos) | RTO_CONN,
+                           0) != 0)
+               goto free_nskb;
+
+       dst_release(nskb->dst);
+       nskb->dst = &rt->u.dst;
+
+       /* "Never happens" */
+       if (nskb->len > nskb->dst->pmtu)
+               goto free_nskb;
+
+       NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, nskb, NULL, nskb->dst->dev,
+               ip_finish_output);
+       return;
+
+ free_nskb:
+       kfree_skb(nskb);
+}
+#endif
+
+static unsigned int reject6_target(struct sk_buff **pskb,
+                          unsigned int hooknum,
+                          const struct net_device *in,
+                          const struct net_device *out,
+                          const void *targinfo,
+                          void *userinfo)
+{
+       const struct ip6t_reject_info *reject = targinfo;
+
+       /* WARNING: This code causes reentry within ip6tables.
+          This means that the ip6tables jump stack is now crap.  We
+          must return an absolute verdict. --RR */
+       DEBUGP("REJECTv6: calling icmpv6_send\n");
+       switch (reject->with) {
+       case IP6T_ICMP6_NO_ROUTE:
+               icmpv6_send(*pskb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, out);
+               break;
+       case IP6T_ICMP6_ADM_PROHIBITED:
+               icmpv6_send(*pskb, ICMPV6_DEST_UNREACH, ICMPV6_ADM_PROHIBITED, 0, out);
+               break;
+       case IP6T_ICMP6_NOT_NEIGHBOUR:
+               icmpv6_send(*pskb, ICMPV6_DEST_UNREACH, ICMPV6_NOT_NEIGHBOUR, 0, out);
+               break;
+       case IP6T_ICMP6_ADDR_UNREACH:
+               icmpv6_send(*pskb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0, out);
+               break;
+       case IP6T_ICMP6_PORT_UNREACH:
+               icmpv6_send(*pskb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, out);
+               break;
+#if 0
+       case IPT_ICMP_ECHOREPLY: {
+               struct icmp6hdr *icmph  = (struct icmphdr *)
+                       ((u_int32_t *)(*pskb)->nh.iph + (*pskb)->nh.iph->ihl);
+               unsigned int datalen = (*pskb)->len - (*pskb)->nh.iph->ihl * 4;
+
+               /* Not non-head frags, or truncated */
+               if (((ntohs((*pskb)->nh.iph->frag_off) & IP_OFFSET) == 0)
+                   && datalen >= 4) {
+                       /* Usually I don't like cut & pasting code,
+                           but dammit, my party is starting in 45
+                           mins! --RR */
+                       struct icmp_bxm icmp_param;
+
+                       icmp_param.icmph=*icmph;
+                       icmp_param.icmph.type=ICMP_ECHOREPLY;
+                       icmp_param.data_ptr=(icmph+1);
+                       icmp_param.data_len=datalen;
+                       icmp_reply(&icmp_param, *pskb);
+               }
+       }
+       break;
+       case IPT_TCP_RESET:
+               send_reset(*pskb);
+               break;
+#endif
+       default:
+               printk(KERN_WARNING "REJECTv6: case %u not handled yet\n", reject->with);
+               break;
+       }
+
+       return NF_DROP;
+}
+
+static inline int find_ping_match(const struct ip6t_entry_match *m)
+{
+       const struct ip6t_icmp *icmpinfo = (const struct ip6t_icmp *)m->data;
+
+       if (strcmp(m->u.kernel.match->name, "icmp6") == 0
+           && icmpinfo->type == ICMPV6_ECHO_REQUEST
+           && !(icmpinfo->invflags & IP6T_ICMP_INV))
+               return 1;
+
+       return 0;
+}
+
+static int check(const char *tablename,
+                const struct ip6t_entry *e,
+                void *targinfo,
+                unsigned int targinfosize,
+                unsigned int hook_mask)
+{
+       const struct ip6t_reject_info *rejinfo = targinfo;
+
+       if (targinfosize != IP6T_ALIGN(sizeof(struct ip6t_reject_info))) {
+               DEBUGP("REJECTv6: targinfosize %u != 0\n", targinfosize);
+               return 0;
+       }
+
+       /* Only allow these for packet filtering. */
+       if (strcmp(tablename, "filter") != 0) {
+               DEBUGP("REJECTv6: bad table `%s'.\n", tablename);
+               return 0;
+       }
+       if ((hook_mask & ~((1 << NF_IP6_LOCAL_IN)
+                          | (1 << NF_IP6_FORWARD)
+                          | (1 << NF_IP6_LOCAL_OUT))) != 0) {
+               DEBUGP("REJECTv6: bad hook mask %X\n", hook_mask);
+               return 0;
+       }
+
+       if (rejinfo->with == IP6T_ICMP6_ECHOREPLY) {
+               /* Must specify that it's an ICMP ping packet. */
+               if (e->ipv6.proto != IPPROTO_ICMPV6
+                   || (e->ipv6.invflags & IP6T_INV_PROTO)) {
+                       DEBUGP("REJECTv6: ECHOREPLY illegal for non-icmp\n");
+                       return 0;
+               }
+               /* Must contain ICMP match. */
+               if (IP6T_MATCH_ITERATE(e, find_ping_match) == 0) {
+                       DEBUGP("REJECTv6: ECHOREPLY illegal for non-ping\n");
+                       return 0;
+               }
+       } else if (rejinfo->with == IP6T_TCP_RESET) {
+               /* Must specify that it's a TCP packet */
+               if (e->ipv6.proto != IPPROTO_TCP
+                   || (e->ipv6.invflags & IP6T_INV_PROTO)) {
+                       DEBUGP("REJECTv6: TCP_RESET illegal for non-tcp\n");
+                       return 0;
+               }
+       }
+
+       return 1;
+}
+
+static struct ip6t_target ip6t_reject_reg
+= { { NULL, NULL }, "REJECT", reject6_target, check, NULL, THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ip6t_register_target(&ip6t_reject_reg))
+               return -EINVAL;
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ip6t_unregister_target(&ip6t_reject_reg);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_fuzzy.c linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_fuzzy.c
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_fuzzy.c 1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_fuzzy.c     2004-02-16 11:07:14.926381841 +0100
@@ -0,0 +1,189 @@
+/*
+ * This module implements a simple TSK FLC
+ * (Takagi-Sugeno-Kang Fuzzy Logic Controller) that aims
+ * to limit , in an adaptive and flexible way , the packet rate crossing
+ * a given stream . It serves as an initial and very simple (but effective)
+ * example of how Fuzzy Logic techniques can be applied to defeat DoS attacks.
+ *  As a matter of fact , Fuzzy Logic can help us to insert any "behavior"
+ * into our code in a precise , adaptive and efficient manner.
+ *  The goal is very similar to that of "limit" match , but using techniques of
+ * Fuzzy Control , that allow us to shape the transfer functions precisely ,
+ * avoiding over and undershoots - and stuff like that .
+ *
+ *
+ * 2002-08-10  Hime Aguiar e Oliveira Jr. <hime@engineer.com> : Initial version.
+ * 2002-08-17  : Changed to eliminate floating point operations .
+ * 2002-08-23  : Coding style changes .
+ * 2003-04-08  Maciej Soltysiak <solt@dns.toxicilms.tv> : IPv6 Port
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ipv6.h>
+#include <linux/random.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv6/ip6t_fuzzy.h>
+
+/*
+ Packet Acceptance Rate - LOW and Packet Acceptance Rate - HIGH
+ Expressed in percentage
+*/
+
+#define PAR_LOW                1/100
+#define PAR_HIGH       1
+
+static spinlock_t fuzzy_lock = SPIN_LOCK_UNLOCKED;
+
+MODULE_AUTHOR("Hime Aguiar e Oliveira Junior <hime@engineer.com>");
+MODULE_DESCRIPTION("IP tables Fuzzy Logic Controller match module");
+MODULE_LICENSE("GPL");
+
+static  u_int8_t mf_high(u_int32_t tx,u_int32_t mini,u_int32_t maxi)
+{
+       if (tx >= maxi) return 100;
+
+       if (tx <= mini) return 0;
+
+       return ((100 * (tx-mini)) / (maxi-mini));
+}
+
+static u_int8_t mf_low(u_int32_t tx,u_int32_t mini,u_int32_t maxi)
+{
+       if (tx <= mini) return 100;
+
+       if (tx >= maxi) return 0;
+
+       return ((100 * (maxi - tx)) / (maxi - mini));
+
+}
+
+static int
+ip6t_fuzzy_match(const struct sk_buff *pskb,
+              const struct net_device *in,
+              const struct net_device *out,
+              const void *matchinfo,
+              int offset,
+              const void *hdr,
+              u_int16_t datalen,
+              int *hotdrop)
+{
+       /* From userspace */
+
+       struct ip6t_fuzzy_info *info = (struct ip6t_fuzzy_info *) matchinfo;
+
+       u_int8_t random_number;
+       unsigned long amount;
+       u_int8_t howhigh, howlow;
+
+
+       spin_lock_bh(&fuzzy_lock); /* Rise the lock */
+
+       info->bytes_total += pskb->len;
+       info->packets_total++;
+
+       info->present_time = jiffies;
+
+       if (info->present_time >= info->previous_time)
+               amount = info->present_time - info->previous_time;
+       else {
+               /* There was a transition : I choose to re-sample
+                  and keep the old acceptance rate...
+               */
+
+               amount = 0;
+               info->previous_time = info->present_time;
+               info->bytes_total = info->packets_total = 0;
+            };
+
+       if ( amount > HZ/10) {/* More than 100 ms elapsed ... */
+
+               info->mean_rate = (u_int32_t) ((HZ * info->packets_total) \
+                                       / amount);
+
+               info->previous_time = info->present_time;
+               info->bytes_total = info->packets_total = 0;
+
+               howhigh = mf_high(info->mean_rate,info->minimum_rate,info->maximum_rate);
+               howlow  = mf_low(info->mean_rate,info->minimum_rate,info->maximum_rate);
+
+               info->acceptance_rate = (u_int8_t) \
+                               (howhigh * PAR_LOW + PAR_HIGH * howlow);
+
+       /* In fact, the above defuzzification would require a denominator
+        * proportional to (howhigh+howlow) but, in this particular case,
+        * that expression is constant.
+        * An imediate consequence is that it is not necessary to call
+        * both mf_high and mf_low - but to keep things understandable,
+        * I did so.
+        */
+
+       }
+
+       spin_unlock_bh(&fuzzy_lock); /* Release the lock */
+
+
+       if (info->acceptance_rate < 100)
+       {
+               get_random_bytes((void *)(&random_number), 1);
+
+               /*  If within the acceptance , it can pass => don't match */
+               if (random_number <= (255 * info->acceptance_rate) / 100)
+                       return 0;
+               else
+                       return 1; /* It can't pass (It matches) */
+       };
+
+       return 0; /* acceptance_rate == 100 % => Everything passes ... */
+
+}
+
+static int
+ip6t_fuzzy_checkentry(const char *tablename,
+                  const struct ip6t_ip6 *ip,
+                  void *matchinfo,
+                  unsigned int matchsize,
+                  unsigned int hook_mask)
+{
+
+       const struct ip6t_fuzzy_info *info = matchinfo;
+
+       if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_fuzzy_info))) {
+               printk("ip6t_fuzzy: matchsize %u != %u\n", matchsize,
+                      IP6T_ALIGN(sizeof(struct ip6t_fuzzy_info)));
+               return 0;
+       }
+
+       if ((info->minimum_rate < MINFUZZYRATE) || (info->maximum_rate > MAXFUZZYRATE)
+        || (info->minimum_rate >= info->maximum_rate)) {
+               printk("ip6t_fuzzy: BAD limits , please verify !!!\n");
+               return 0;
+       }
+
+       return 1;
+}
+
+static struct ip6t_match ip6t_fuzzy_reg = {
+       {NULL, NULL},
+       "fuzzy",
+       ip6t_fuzzy_match,
+       ip6t_fuzzy_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ip6t_register_match(&ip6t_fuzzy_reg))
+               return -EINVAL;
+
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ip6t_unregister_match(&ip6t_fuzzy_reg);
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_nth.c linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_nth.c
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_nth.c   1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_nth.c       2004-02-16 11:07:18.803453352 +0100
@@ -0,0 +1,173 @@
+/*
+  This is a module which is used for match support for every Nth packet
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+     ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  2001-07-18 Fabrice MARIE <fabrice@netfilter.org> : initial implementation.
+  2001-09-20 Richard Wagner (rwagner@cloudnet.com)
+        * added support for multiple counters
+        * added support for matching on individual packets
+          in the counter cycle
+  2003-04-30 Maciej Soltysiak <solt@dns.toxicfilms.tv> : IPv6 Port
+
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv6/ip6t_nth.h>
+
+MODULE_LICENSE("GPL");
+
+/*
+ * State information.
+ */
+struct state {
+       spinlock_t lock;
+       u_int16_t number;
+};
+
+static struct state states[IP6T_NTH_NUM_COUNTERS];
+
+static int
+ip6t_nth_match(const struct sk_buff *pskb,
+             const struct net_device *in,
+             const struct net_device *out,
+             const void *matchinfo,
+             int offset,
+             const void *hdr,
+             u_int16_t datalen,
+             int *hotdrop)
+{
+       /* Parameters from userspace */
+       const struct ip6t_nth_info *info = matchinfo;
+        unsigned counter = info->counter;
+               if((counter < 0) || (counter >= IP6T_NTH_NUM_COUNTERS)) 
+       {
+                       printk(KERN_WARNING "nth: invalid counter %u. counter between 0 and %u\n", counter, IP6T_NTH_NUM_COUNTERS-1);
+               return 0;
+        };
+
+        spin_lock(&states[counter].lock);
+
+        /* Are we matching every nth packet?*/
+        if (info->packet == 0xFF)
+        {
+               /* We're matching every nth packet and only every nth packet*/
+               /* Do we match or invert match? */
+               if (info->not == 0)
+               {
+                       if (states[counter].number == 0)
+                       {
+                               ++states[counter].number;
+                               goto match;
+                       }
+                       if (states[counter].number >= info->every)
+                               states[counter].number = 0; /* reset the counter */
+                       else
+                               ++states[counter].number;
+                       goto dontmatch;
+               }
+               else
+               {
+                       if (states[counter].number == 0)
+                       {
+                               ++states[counter].number;
+                               goto dontmatch;
+                       }
+                       if (states[counter].number >= info->every)
+                               states[counter].number = 0;
+                       else
+                               ++states[counter].number;
+                       goto match;
+               }
+        }
+        else
+        {
+               /* We're using the --packet, so there must be a rule for every value */
+               if (states[counter].number == info->packet)
+               {
+                       /* only increment the counter when a match happens */
+                       if (states[counter].number >= info->every)
+                               states[counter].number = 0; /* reset the counter */
+                       else
+                               ++states[counter].number;
+                       goto match;
+               }
+               else
+                       goto dontmatch;
+       }
+
+ dontmatch:
+       /* don't match */
+       spin_unlock(&states[counter].lock);
+       return 0;
+
+ match:
+       spin_unlock(&states[counter].lock);
+       return 1;
+}
+
+static int
+ip6t_nth_checkentry(const char *tablename,
+                  const struct ip6t_ip6 *e,
+                  void *matchinfo,
+                  unsigned int matchsize,
+                  unsigned int hook_mask)
+{
+       /* Parameters from userspace */
+       const struct ip6t_nth_info *info = matchinfo;
+        unsigned counter = info->counter;
+        if((counter < 0) || (counter >= IP6T_NTH_NUM_COUNTERS)) 
+       {
+               printk(KERN_WARNING "nth: invalid counter %u. counter between 0 and %u\n", counter, IP6T_NTH_NUM_COUNTERS-1);
+                       return 0;
+               };
+
+       if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_nth_info))) {
+               printk("nth: matchsize %u != %u\n", matchsize,
+                      IP6T_ALIGN(sizeof(struct ip6t_nth_info)));
+               return 0;
+       }
+
+       states[counter].number = info->startat;
+
+       return 1;
+}
+
+static struct ip6t_match ip6t_nth_reg = { 
+       {NULL, NULL},
+       "nth",
+       ip6t_nth_match,
+       ip6t_nth_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       unsigned counter;
+        memset(&states, 0, sizeof(states));
+       if (ip6t_register_match(&ip6t_nth_reg))
+               return -EINVAL;
+
+        for(counter = 0; counter < IP6T_NTH_NUM_COUNTERS; counter++) 
+       {
+               spin_lock_init(&(states[counter].lock));
+        };
+
+       printk("ip6t_nth match loaded\n");
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ip6t_unregister_match(&ip6t_nth_reg);
+       printk("ip6t_nth match unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);
diff -Nur linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_random.c linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_random.c
--- linux-2.6.3-rc3.org/net/ipv6/netfilter/ip6t_random.c        1970-01-01 01:00:00.000000000 +0100
+++ linux-2.6.3-rc3/net/ipv6/netfilter/ip6t_random.c    2004-02-16 11:07:24.379118074 +0100
@@ -0,0 +1,97 @@
+/*
+  This is a module which is used for a "random" match support.
+  This file is distributed under the terms of the GNU General Public
+  License (GPL). Copies of the GPL can be obtained from:
+     ftp://prep.ai.mit.edu/pub/gnu/GPL
+
+  2001-10-14 Fabrice MARIE <fabrice@netfilter.org> : initial implementation.
+  2003-04-30 Maciej Soltysiak <solt@dns.toxicfilms.tv> : IPv6 Port
+*/
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/random.h>
+#include <net/tcp.h>
+#include <linux/spinlock.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv6/ip6t_random.h>
+
+MODULE_LICENSE("GPL");
+
+static int
+ip6t_rand_match(const struct sk_buff *pskb,
+              const struct net_device *in,
+              const struct net_device *out,
+              const void *matchinfo,
+              int offset,
+              const void *hdr,
+              u_int16_t datalen,
+              int *hotdrop)
+{
+       /* Parameters from userspace */
+       const struct ip6t_rand_info *info = matchinfo;
+       u_int8_t random_number;
+
+       /* get 1 random number from the kernel random number generation routine */
+       get_random_bytes((void *)(&random_number), 1);
+
+       /* Do we match ? */
+       if (random_number <= info->average)
+               return 1;
+       else
+               return 0;
+}
+
+static int
+ip6t_rand_checkentry(const char *tablename,
+                  const struct ip6t_ip6 *e,
+                  void *matchinfo,
+                  unsigned int matchsize,
+                  unsigned int hook_mask)
+{
+       /* Parameters from userspace */
+       const struct ip6t_rand_info *info = matchinfo;
+
+       if (matchsize != IP6T_ALIGN(sizeof(struct ip6t_rand_info))) {
+               printk("ip6t_random: matchsize %u != %u\n", matchsize,
+                      IP6T_ALIGN(sizeof(struct ip6t_rand_info)));
+               return 0;
+       }
+
+       /* must be  1 <= average % <= 99 */
+       /* 1  x 2.55 = 2   */
+       /* 99 x 2.55 = 252 */
+       if ((info->average < 2) || (info->average > 252)) {
+               printk("ip6t_random:  invalid average %u\n", info->average);
+               return 0;
+       }
+
+       return 1;
+}
+
+static struct ip6t_match ip6t_rand_reg = { 
+       {NULL, NULL},
+       "random",
+       ip6t_rand_match,
+       ip6t_rand_checkentry,
+       NULL,
+       THIS_MODULE };
+
+static int __init init(void)
+{
+       if (ip6t_register_match(&ip6t_rand_reg))
+               return -EINVAL;
+
+       printk("ip6t_random match loaded\n");
+       return 0;
+}
+
+static void __exit fini(void)
+{
+       ip6t_unregister_match(&ip6t_rand_reg);
+       printk("ip6t_random match unloaded\n");
+}
+
+module_init(init);
+module_exit(fini);