diff -urN iptables-1.4.0-orig/extensions/libipt_ipp2p.c iptables-1.4.0/extensions/libipt_ipp2p.c
--- iptables-1.4.0-orig/extensions/libipt_ipp2p.c	2011-01-10 18:46:50.932237221 +0800
+++ iptables-1.4.0/extensions/libipt_ipp2p.c	2011-01-14 11:15:08.221876000 +0800
@@ -15,7 +15,7 @@
 #include <stdlib.h>
 #include <getopt.h>
 #include <ctype.h>
-#include "../include/linux/netfilter/xt_appe.h"
+#include <linux/netfilter/xt_appe.h>
 #include <xtables.h>
 
 static void ipp2p_mt_help(void)
diff -urN iptables-1.4.0-orig/extensions/libipt_set.c iptables-1.4.0/extensions/libipt_set.c
--- iptables-1.4.0-orig/extensions/libipt_set.c	2011-01-10 18:46:50.912237218 +0800
+++ iptables-1.4.0/extensions/libipt_set.c	2011-01-14 14:44:59.154875000 +0800
@@ -28,7 +28,7 @@
 	       " [!] --set     name flags\n"
 	       "		'name' is the set name from to match,\n" 
 	       "		'flags' are the comma separated list of\n"
-	       "		'src' and 'dst'.\n"
+	       "		'src', 'dst', 'log', and 'debug'.\n"
 	       "\n", IPTABLES_VERSION);
 }
 
@@ -119,6 +119,14 @@
 		       i == 0 ? " " : ",",
 		       info->flags[i] & IPSET_SRC ? "src" : "dst");
 	}
+	if (info->flags[0] & IPSET_MATCH_LOG)
+		printf(",log");
+	if (info->flags[0] & IPSET_MATCH_DEBUG)
+		printf(",debug");	
+	if (info->flags[0] & IPSET_MATCH_REJ)
+		printf(",rej");	
+	if (info->flags[0] & IPSET_MATCH_PASS)
+		printf(",pass");	
 	printf(" ");
 }
 
diff -urN iptables-1.4.0-orig/extensions/libipt_set.h iptables-1.4.0/extensions/libipt_set.h
--- iptables-1.4.0-orig/extensions/libipt_set.h	2011-01-10 18:46:50.836237305 +0800
+++ iptables-1.4.0/extensions/libipt_set.h	2011-01-14 14:46:47.061125000 +0800
@@ -24,9 +24,19 @@
 			info->flags[i++] |= IPSET_SRC;
 		else if (strncmp(ptr, "dst", 3) == 0)
 			info->flags[i++] |= IPSET_DST;
+		else if (strncmp(ptr, "log", 3) == 0)
+			info->flags[0] |= IPSET_MATCH_LOG;
+		else if (strncmp(ptr, "debug", 5) == 0)
+			info->flags[0] |= IPSET_MATCH_DEBUG;		
+		else if (strncmp(ptr, "rej", 3) == 0)
+			info->flags[0] |= IPSET_MATCH_REJ;
+		else if (strncmp(ptr, "pass", 4) == 0)
+			info->flags[0] |= IPSET_MATCH_PASS;
+		else if (strncmp(ptr, "drop", 4) == 0)
+			info->flags[0] |= IPSET_MATCH_DRP;
 		else
 			exit_error(PARAMETER_PROBLEM,
-				   "You must spefify (the comma separated list of) 'src' or 'dst'.");
+				   "You must specify (the comma separated list of) 'src', 'dst', 'rej', 'pass', 'log', or 'debug'");
 	}
 
 	if (tmp)
diff -urN iptables-1.4.0-orig/extensions/Makefile iptables-1.4.0/extensions/Makefile
--- iptables-1.4.0-orig/extensions/Makefile	2011-01-10 18:46:50.932237221 +0800
+++ iptables-1.4.0/extensions/Makefile	2011-01-14 18:32:11.674437000 +0800
@@ -7,7 +7,7 @@
 #
 PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG IPMARK SET set mset mset2
 PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT
-PFX_EXT_SLIB:=ipp2p ratelimit connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE
+PFX_EXT_SLIB:=ipp2p ratelimit connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE WEBCATEGORY
 
 PF_EXT_SELINUX_SLIB:=
 PF6_EXT_SELINUX_SLIB:=
diff -urN iptables-1.4.0-orig/include/linux/netfilter/xt_tcpudp.h iptables-1.4.0/include/linux/netfilter/xt_tcpudp.h
--- iptables-1.4.0-orig/include/linux/netfilter/xt_tcpudp.h	2011-01-10 18:46:51.056237208 +0800
+++ iptables-1.4.0/include/linux/netfilter/xt_tcpudp.h	2011-01-10 19:35:15.907586934 +0800
@@ -32,5 +32,23 @@
 #define XT_UDP_INV_DSTPT	0x02	/* Invert the sense of dest ports. */
 #define XT_UDP_INV_MASK	0x03	/* All possible flags. */
 
+/* Service matching stuff */
+struct xt_service
+{
+	u_int32_t flg_service;
+	u_int16_t spts[2];			/* Source port range. */
+	u_int16_t dpts[2];			/* Destination port range. */
+	u_int8_t option;			/* TCP Option iff non-zero*/
+	u_int8_t flg_mask;			/* TCP flags mask byte */
+	u_int8_t flg_cmp;			/* TCP flags compare byte */
+	u_int8_t invflags;			/* Inverse flags */
+};
+
+/* Values for "inv" field in struct ipt_tcp. */
+#define XT_SERVICE_ICMP	0x01
+#define XT_SERVICE_IGMP	0x02
+#define XT_SERVICE_TCP	0x04
+#define XT_SERVICE_UDP	0x08
+#define XT_SERVICE_MASK	0x0F
 
 #endif
diff -urN iptables-1.4.0-orig/include/linux/netfilter_ipv4/ip_tables.h iptables-1.4.0/include/linux/netfilter_ipv4/ip_tables.h
--- iptables-1.4.0-orig/include/linux/netfilter_ipv4/ip_tables.h	2011-01-10 18:46:51.048237727 +0800
+++ iptables-1.4.0/include/linux/netfilter_ipv4/ip_tables.h	2011-01-11 14:02:16.511697000 +0800
@@ -54,7 +54,8 @@
 /* Values for "flag" field in struct ipt_ip (general ip structure). */
 #define IPT_F_FRAG		0x01	/* Set if rule is a fragment rule */
 #define IPT_F_GOTO		0x02	/* Set if jump is a goto */
-#define IPT_F_MASK		0x03	/* All possible flag bits mask. */
+#define IPT_F_UNEN		0x04	/* Set if disable this rule */
+#define IPT_F_MASK		0x07	/* All possible flag bits mask. */
 
 /* Values for "inv" field in struct ipt_ip. */
 #define IPT_INV_VIA_IN		0x01	/* Invert the sense of IN IFACE. */
