diff -urN iptables-1.4.0-orig/extensions/Makefile iptables-1.4.0/extensions/Makefile
--- iptables-1.4.0-orig/extensions/Makefile	2010-11-26 15:58:47.000000000 +0800
+++ iptables-1.4.0/extensions/Makefile	2011-01-06 14:37:36.000000000 +0800
@@ -5,7 +5,7 @@
 # header files are present in the include/linux directory of this iptables
 # package (HW)
 #
-PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG
+PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG IPMARK SET set mset mset2
 PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT
 PFX_EXT_SLIB:=ipp2p ratelimit connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE
 
diff -urN iptables-1.4.0-orig/extensions/libipt_IPMARK.c iptables-1.4.0/extensions/libipt_IPMARK.c
--- iptables-1.4.0-orig/extensions/libipt_IPMARK.c	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/extensions/libipt_IPMARK.c	2010-12-29 11:41:41.000000000 +0800
@@ -0,0 +1,192 @@
+/* Shared library add-on to iptables to add IPMARK target support.
+ * (C) 2003 by Grzegorz Janoszka <Grzegorz.Janoszka@pro.onet.pl>
+ *
+ * based on original MARK target
+ * 
+ * This program is distributed under the terms of GNU GPL
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <iptables.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_IPMARK.h>
+
+#ifndef XTABLES_VERSION
+#define XTABLES_VERSION IPTABLES_VERSION
+#endif
+
+#ifdef IPT_LIB_DIR
+#define xtables_target iptables_target
+#define xtables_register_target register_target
+#endif
+
+#define IPT_ADDR_USED        1
+#define IPT_AND_MASK_USED    2
+#define IPT_OR_MASK_USED     4
+
+/* Function which prints out usage message. */
+static void
+help(void)
+{
+	printf(
+"IPMARK target v%s options:\n"
+"  --addr src/dst         use source or destination ip address\n"
+"  --and-mask value       logical AND ip address with this value becomes MARK\n"
+"  --or-mask value        logical OR ip address with this value becomes MARK\n"
+"\n",
+XTABLES_VERSION);
+}
+
+static struct option opts[] = {
+	{ "addr", 1, 0, '1' },
+	{ "and-mask", 1, 0, '2' },
+	{ "or-mask", 1, 0, '3' },
+	{ 0 }
+};
+
+/* Initialize the target. */
+static void
+#ifdef _XTABLES_H
+init(struct xt_entry_target *t)
+#else
+init(struct ipt_entry_target *t, unsigned int *nfcache)
+#endif
+{
+	struct ipt_ipmark_target_info *ipmarkinfo =
+		(struct ipt_ipmark_target_info *)t->data;
+
+	ipmarkinfo->andmask=0xffffffff;
+	ipmarkinfo->ormask=0;
+
+}
+
+/* Function which parses command options; returns true if it
+   ate an option */
+static int
+parse(int c, char **argv, int invert, unsigned int *flags,
+#ifdef _XTABLES_H
+      const void *entry, struct xt_entry_target **target)
+#else
+      const struct ipt_entry *entry, struct ipt_entry_target **target)
+#endif
+{
+	struct ipt_ipmark_target_info *ipmarkinfo
+		= (struct ipt_ipmark_target_info *)(*target)->data;
+
+	switch (c) {
+		char *end;
+	case '1':
+		if(!strcmp(optarg, "src")) ipmarkinfo->addr=IPT_IPMARK_SRC;
+		  else if(!strcmp(optarg, "dst")) ipmarkinfo->addr=IPT_IPMARK_DST;
+		    else exit_error(PARAMETER_PROBLEM, "Bad addr value `%s' - should be `src' or `dst'", optarg);
+		if (*flags & IPT_ADDR_USED)
+			exit_error(PARAMETER_PROBLEM,
+			           "IPMARK target: Can't specify --addr twice");
+		*flags |= IPT_ADDR_USED;
+		break;
+	
+	case '2':
+		ipmarkinfo->andmask = strtoul(optarg, &end, 0);
+		if (*end != '\0' || end == optarg)
+			exit_error(PARAMETER_PROBLEM, "Bad and-mask value `%s'", optarg);
+		if (*flags & IPT_AND_MASK_USED)
+			exit_error(PARAMETER_PROBLEM,
+			           "IPMARK target: Can't specify --and-mask twice");
+		*flags |= IPT_AND_MASK_USED;
+		break;
+	case '3':
+		ipmarkinfo->ormask = strtoul(optarg, &end, 0);
+		if (*end != '\0' || end == optarg)
+			exit_error(PARAMETER_PROBLEM, "Bad or-mask value `%s'", optarg);
+		if (*flags & IPT_OR_MASK_USED)
+			exit_error(PARAMETER_PROBLEM,
+			           "IPMARK target: Can't specify --or-mask twice");
+		*flags |= IPT_OR_MASK_USED;
+		break;
+
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void
+final_check(unsigned int flags)
+{
+	if (!(flags & IPT_ADDR_USED))
+		exit_error(PARAMETER_PROBLEM,
+		           "IPMARK target: Parameter --addr is required");
+	if (!(flags & (IPT_AND_MASK_USED | IPT_OR_MASK_USED)))
+		exit_error(PARAMETER_PROBLEM,
+		           "IPMARK target: Parameter --and-mask or --or-mask is required");
+}
+
+/* Prints out the targinfo. */
+static void
+#ifdef _XTABLES_H
+print(const void *ip,
+      const struct xt_entry_target *target,
+#else
+print(const struct ipt_ip *ip,
+      const struct ipt_entry_target *target,
+#endif
+      int numeric)
+{
+	const struct ipt_ipmark_target_info *ipmarkinfo =
+		(const struct ipt_ipmark_target_info *)target->data;
+
+	if(ipmarkinfo->addr == IPT_IPMARK_SRC)
+	  printf("IPMARK src");
+	else
+	  printf("IPMARK dst");
+	printf(" ip and 0x%lx or 0x%lx", ipmarkinfo->andmask, ipmarkinfo->ormask);
+}
+
+/* Saves the union ipt_targinfo in parsable form to stdout. */
+static void
+#ifdef _XTABLES_H
+save(const void *ip,
+     const struct xt_entry_target *target)
+#else
+save(const struct ipt_ip *ip,
+     const struct ipt_entry_target *target)
+#endif
+{
+	const struct ipt_ipmark_target_info *ipmarkinfo =
+		(const struct ipt_ipmark_target_info *)target->data;
+
+	if (ipmarkinfo->addr == IPT_IPMARK_SRC)
+		printf("--addr=src ");
+	else
+		printf("--addr=dst ");
+
+	if (ipmarkinfo->andmask != 0xffffffff)
+		printf("--and-mask 0x%lx ", ipmarkinfo->andmask);
+
+	if (ipmarkinfo->ormask != 0)
+		printf("--or-mask 0x%lx ", ipmarkinfo->ormask);
+}
+
+static struct xtables_target ipmark = { 
+	.next		= NULL,
+	.name		= "IPMARK",
+	.version	= XTABLES_VERSION,
+	.size		= IPT_ALIGN(sizeof(struct ipt_ipmark_target_info)),
+	.userspacesize	= IPT_ALIGN(sizeof(struct ipt_ipmark_target_info)),
+	.help		= &help,
+	.init		= &init,
+	.parse		= &parse,
+	.final_check	= &final_check,
+	.print		= &print,
+	.save		= &save,
+	.extra_opts	= opts
+};
+
+void _init(void)
+{
+	xtables_register_target(&ipmark);
+}
diff -urN iptables-1.4.0-orig/extensions/libipt_IPMARK.man iptables-1.4.0/extensions/libipt_IPMARK.man
--- iptables-1.4.0-orig/extensions/libipt_IPMARK.man	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/extensions/libipt_IPMARK.man	2010-12-29 11:41:41.000000000 +0800
@@ -0,0 +1,45 @@
+Allows you to mark a received packet basing on its IP address. This
+can replace many mangle/mark entries with only one, if you use
+firewall based classifier.
+
+This target is to be used inside the mangle table, in the PREROUTING,
+POSTROUTING or FORWARD hooks.
+.TP
+.BI "--addr " "src/dst"
+Use source or destination IP address.
+.TP
+.BI "--and-mask " "mask"
+Perform bitwise `and' on the IP address and this mask.
+.TP
+.BI "--or-mask " "mask"
+Perform bitwise `or' on the IP address and this mask.
+.P
+The order of IP address bytes is reversed to meet "human order of bytes":
+192.168.0.1 is 0xc0a80001. At first the `and' operation is performed, then
+`or'.
+
+Examples:
+
+We create a queue for each user, the queue number is adequate
+to the IP address of the user, e.g.: all packets going to/from 192.168.5.2
+are directed to 1:0502 queue, 192.168.5.12 -> 1:050c etc.
+
+We have one classifier rule:
+.IP
+tc filter add dev eth3 parent 1:0 protocol ip fw
+.P
+Earlier we had many rules just like below:
+.IP
+iptables -t mangle -A POSTROUTING -o eth3 -d 192.168.5.2 -j MARK
+--set-mark 0x10502
+.IP
+iptables -t mangle -A POSTROUTING -o eth3 -d 192.168.5.3 -j MARK
+--set-mark 0x10503
+.P
+Using IPMARK target we can replace all the mangle/mark rules with only one:
+.IP
+iptables -t mangle -A POSTROUTING -o eth3 -j IPMARK --addr=dst
+--and-mask=0xffff --or-mask=0x10000
+.P
+On the routers with hundreds of users there should be significant load
+decrease (e.g. twice).
diff -urN iptables-1.4.0-orig/extensions/libipt_mset.c iptables-1.4.0/extensions/libipt_mset.c
--- iptables-1.4.0-orig/extensions/libipt_mset.c	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/extensions/libipt_mset.c	2010-12-29 11:41:41.000000000 +0800
@@ -0,0 +1,186 @@
+/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
+ *                         Patrick Schaaf <bof@bof.de>
+ *                         Martin Josefsson <gandalf@wlug.westbo.se>
+ * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.  
+ */
+
+/* Shared library add-on to iptables to add IP set matching. */
+#include <stdio.h>
+#include <netdb.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <ctype.h>
+#include <errno.h>
+
+#include <iptables.h>
+#include <linux/netfilter_ipv4/ipt_set.h>
+#include "libipt_set.h"
+
+/* Function which prints out usage message. */
+static void mset_help(void)
+{
+	printf("set v%s options:\n"
+	       " [!] --set     name flags\n"
+	       "		'name' is the set name from to match,\n" 
+	       "		'flags' are the comma separated list of\n"
+	       "		'src', 'dst', 'log', and 'debug'.\n"
+	       "\n", IPTABLES_VERSION);
+}
+
+static const struct option mset_opts[] = {
+	{"set", 1, 0, '1'},
+	{0}
+};
+
+/* Initialize the match. */
+static void mset_init(struct xt_entry_match *match)
+{
+	struct ipt_mset_info_match *info = 
+		(struct ipt_mset_info_match *) match->data;
+	int i;
+	memset(info, 0, sizeof(struct ipt_mset_info_match));
+	for(i = 0; i < MAXSET; i++) {
+		info->match_set[i].index = IP_SET_INVALID_ID;
+	}
+}
+
+/* Function which parses command options; returns true if it ate an option */
+static int mset_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_match **match)
+{
+	struct ipt_mset_info_match *myinfo = 
+		(struct ipt_mset_info_match *) (*match)->data;
+	struct ipt_set_info *info;
+	
+	if (*flags >= MAXSET) {
+		exit_error(PARAMETER_PROBLEM,
+			"max set number is %d\n", MAXSET);
+	}
+	
+	info = &myinfo->match_set[*flags];
+	switch (c) {
+	case '1':		/* --set <set> <flag>[,<flag> */
+		if (info->flags[0])
+			exit_error(PARAMETER_PROBLEM,
+				   "--set can be specified only once");
+
+		check_inverse(optarg, &invert, &optind, 0);
+		if (invert)
+			info->flags[0] |= IPSET_MATCH_INV;
+
+		if (!argv[optind]
+		    || argv[optind][0] == '-'
+		    || argv[optind][0] == '!')
+			exit_error(PARAMETER_PROBLEM,
+				   "--set requires two args.");
+
+		if (strlen(argv[optind-1]) > IP_SET_MAXNAMELEN - 1)
+			exit_error(PARAMETER_PROBLEM,
+				   "setname `%s' too long, max %d characters.",
+				   argv[optind-1], IP_SET_MAXNAMELEN - 1);
+
+		get_set_byname(argv[optind - 1], info);
+		parse_bindings(argv[optind], info);
+		DEBUGP("parse: set index %u\n", info->index);
+		optind++;
+		
+		*flags = *flags + 1;
+		break;
+
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+/* Final check; must have specified --set. */
+static void mset_check(unsigned int flags)
+{
+	if (!flags)
+		exit_error(PARAMETER_PROBLEM,
+			   "You must specify `--set' with proper arguments");
+	DEBUGP("final check OK\n");
+}
+
+static void
+print_match(const char *prefix, const struct ipt_set_info *info)
+{
+	int i;
+	char setname[IP_SET_MAXNAMELEN];
+
+	get_set_byid(setname, info->index);
+	printf("%s%s %s", 
+	       (info->flags[0] & IPSET_MATCH_INV) ? "! " : "",
+	       prefix,
+	       setname); 
+	for (i = 0; i < IP_SET_MAX_BINDINGS; i++) {
+		if (!info->flags[i])
+			break;		
+		printf("%s%s",
+		       i == 0 ? " " : ",",
+		       info->flags[i] & IPSET_SRC ? "src" : "dst");
+	}
+	if (info->flags[0] & IPSET_MATCH_LOG)
+		printf(",log");
+	if (info->flags[0] & IPSET_MATCH_DEBUG)
+		printf(",debug");	
+	if (info->flags[0] & IPSET_MATCH_REJ)
+		printf(",rej");	
+	if (info->flags[0] & IPSET_MATCH_PASS)
+		printf(",pass");	
+	printf(" ");
+}
+
+/* Prints out the matchinfo. */
+static void mset_print(const void *ip, const struct xt_entry_match *match,
+                      int numeric)
+{
+	struct ipt_mset_info_match *info = 
+		(struct ipt_mset_info_match *) match->data;
+	int i;
+	for(i = 0; i < MAXSET; i++) {
+		if (info->match_set[i].index < IP_SET_INVALID_ID)
+			print_match("set", &info->match_set[i]);
+		else
+			break;
+	}
+}
+
+/* Saves the matchinfo in parsable form to stdout. */
+static void mset_save(const void *ip, const struct xt_entry_match *match)
+{
+	struct ipt_mset_info_match *info = 
+		(struct ipt_mset_info_match *) match->data;
+	int i;
+	for(i = 0; i < MAXSET; i++) {
+		if (info->match_set[i].index < IP_SET_INVALID_ID)
+			print_match("--set", &info->match_set[i]);
+		else
+			break;
+	}
+}
+
+static struct iptables_match mset_match = {
+	.name		= "mset",
+	.version	= IPTABLES_VERSION,
+	.size		= IPT_ALIGN(sizeof(struct ipt_mset_info_match)),
+	.userspacesize	= IPT_ALIGN(sizeof(struct ipt_mset_info_match)),
+	.help		= mset_help,
+	.init		= mset_init,
+	.parse		= mset_parse,
+	.final_check	= mset_check,
+	.print		= mset_print,
+	.save		= mset_save,
+	.extra_opts	= mset_opts,
+};
+
+void _init(void)
+{
+	register_match(&mset_match);
+}
diff -urN iptables-1.4.0-orig/extensions/libipt_mset2.c iptables-1.4.0/extensions/libipt_mset2.c
--- iptables-1.4.0-orig/extensions/libipt_mset2.c	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/extensions/libipt_mset2.c	2010-12-29 11:41:41.000000000 +0800
@@ -0,0 +1,186 @@
+/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
+ *                         Patrick Schaaf <bof@bof.de>
+ *                         Martin Josefsson <gandalf@wlug.westbo.se>
+ * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.  
+ */
+
+/* Shared library add-on to iptables to add IP set matching. */
+#include <stdio.h>
+#include <netdb.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <ctype.h>
+#include <errno.h>
+
+#include <iptables.h>
+#include <linux/netfilter_ipv4/ipt_set.h>
+#include "libipt_set.h"
+
+/* Function which prints out usage message. */
+static void mset2_help(void)
+{
+	printf("set v%s options:\n"
+	       " [!] --set2     name flags\n"
+	       "		'name' is the set name from to match,\n" 
+	       "		'flags' are the comma separated list of\n"
+	       "		'src', 'dst', 'log', and 'debug'.\n"
+	       "\n", IPTABLES_VERSION);
+}
+
+static const struct option mset2_opts[] = {
+	{"set2", 1, 0, '1'},
+	{0}
+};
+
+/* Initialize the match. */
+static void mset2_init(struct xt_entry_match *match)
+{
+	struct ipt_mset_info_match *info = 
+		(struct ipt_mset_info_match *) match->data;
+	int i;
+	memset(info, 0, sizeof(struct ipt_mset_info_match));
+	for(i = 0; i < MAXSET; i++) {
+		info->match_set[i].index = IP_SET_INVALID_ID;
+	}
+}
+
+/* Function which parses command options; returns true if it ate an option */
+static int mset2_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_match **match)
+{
+	struct ipt_mset_info_match *myinfo = 
+		(struct ipt_mset_info_match *) (*match)->data;
+	struct ipt_set_info *info;
+	
+	if (*flags >= MAXSET) {
+		exit_error(PARAMETER_PROBLEM,
+			"max set number is %d\n", MAXSET);
+	}
+	
+	info = &myinfo->match_set[*flags];
+	switch (c) {
+	case '1':		/* --set2 <set> <flag>[,<flag> */
+		if (info->flags[0])
+			exit_error(PARAMETER_PROBLEM,
+				   "--set2 can be specified only once");
+
+		check_inverse(optarg, &invert, &optind, 0);
+		if (invert)
+			info->flags[0] |= IPSET_MATCH_INV;
+
+		if (!argv[optind]
+		    || argv[optind][0] == '-'
+		    || argv[optind][0] == '!')
+			exit_error(PARAMETER_PROBLEM,
+				   "--set2 requires two args.");
+
+		if (strlen(argv[optind-1]) > IP_SET_MAXNAMELEN - 1)
+			exit_error(PARAMETER_PROBLEM,
+				   "setname `%s' too long, max %d characters.",
+				   argv[optind-1], IP_SET_MAXNAMELEN - 1);
+
+		get_set_byname(argv[optind - 1], info);
+		parse_bindings(argv[optind], info);
+		DEBUGP("parse: set index %u\n", info->index);
+		optind++;
+		
+		*flags = *flags + 1;
+		break;
+
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+/* Final check; must have specified --set. */
+static void mset2_check(unsigned int flags)
+{
+	if (!flags)
+		exit_error(PARAMETER_PROBLEM,
+			   "You must specify `--set2' with proper arguments");
+	DEBUGP("final check OK\n");
+}
+
+static void
+print_match(const char *prefix, const struct ipt_set_info *info)
+{
+	int i;
+	char setname[IP_SET_MAXNAMELEN];
+
+	get_set_byid(setname, info->index);
+	printf("%s%s %s", 
+	       (info->flags[0] & IPSET_MATCH_INV) ? "! " : "",
+	       prefix,
+	       setname); 
+	for (i = 0; i < IP_SET_MAX_BINDINGS; i++) {
+		if (!info->flags[i])
+			break;		
+		printf("%s%s",
+		       i == 0 ? " " : ",",
+		       info->flags[i] & IPSET_SRC ? "src" : "dst");
+	}
+	if (info->flags[0] & IPSET_MATCH_LOG)
+		printf(",log");
+	if (info->flags[0] & IPSET_MATCH_DEBUG)
+		printf(",debug");	
+	if (info->flags[0] & IPSET_MATCH_REJ)
+		printf(",rej");	
+	if (info->flags[0] & IPSET_MATCH_PASS)
+		printf(",pass");	
+	printf(" ");
+}
+
+/* Prints out the matchinfo. */
+static void mset2_print(const void *ip, const struct xt_entry_match *match,
+                      int numeric)
+{
+	struct ipt_mset_info_match *info = 
+		(struct ipt_mset_info_match *) match->data;
+	int i;
+	for(i = 0; i < MAXSET; i++) {
+		if (info->match_set[i].index < IP_SET_INVALID_ID)
+			print_match("set2", &info->match_set[i]);
+		else
+			break;
+	}
+}
+
+/* Saves the matchinfo in parsable form to stdout. */
+static void mset2_save(const void *ip, const struct xt_entry_match *match)
+{
+	struct ipt_mset_info_match *info = 
+		(struct ipt_mset_info_match *) match->data;
+	int i;
+	for(i = 0; i < MAXSET; i++) {
+		if (info->match_set[i].index < IP_SET_INVALID_ID)
+			print_match("--set2", &info->match_set[i]);
+		else
+			break;
+	}
+}
+
+static struct iptables_match mset2_match = {
+	.name		= "mset2",
+	.version	= IPTABLES_VERSION,
+	.size		= IPT_ALIGN(sizeof(struct ipt_mset_info_match)),
+	.userspacesize	= IPT_ALIGN(sizeof(struct ipt_mset_info_match)),
+	.help		= mset2_help,
+	.init		= mset2_init,
+	.parse		= mset2_parse,
+	.final_check	= mset2_check,
+	.print		= mset2_print,
+	.save		= mset2_save,
+	.extra_opts	= mset2_opts,
+};
+
+void _init(void)
+{
+	register_match(&mset2_match);
+}
diff -urN iptables-1.4.0-orig/include/linux/netfilter_ipv4/ip_set.h iptables-1.4.0/include/linux/netfilter_ipv4/ip_set.h
--- iptables-1.4.0-orig/include/linux/netfilter_ipv4/ip_set.h	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/include/linux/netfilter_ipv4/ip_set.h	2010-12-29 11:42:07.000000000 +0800
@@ -0,0 +1,566 @@
+#ifndef _IP_SET_H
+#define _IP_SET_H
+
+/* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
+ *                         Patrick Schaaf <bof@bof.de>
+ *                         Martin Josefsson <gandalf@wlug.westbo.se>
+ * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.  
+ */
+
+#if 0
+#define IP_SET_DEBUG
+#endif
+
+/*
+ * A sockopt of such quality has hardly ever been seen before on the open
+ * market!  This little beauty, hardly ever used: above 64, so it's
+ * traditionally used for firewalling, not touched (even once!) by the
+ * 2.0, 2.2 and 2.4 kernels!
+ *
+ * Comes with its own certificate of authenticity, valid anywhere in the
+ * Free world!
+ *
+ * Rusty, 19.4.2000
+ */
+#define SO_IP_SET 		83
+
+/*
+ * Heavily modify by Joakim Axelsson 08.03.2002
+ * - Made it more modulebased
+ *
+ * Additional heavy modifications by Jozsef Kadlecsik 22.02.2004
+ * - bindings added
+ * - in order to "deal with" backward compatibility, renamed to ipset
+ */
+
+/* 
+ * Used so that the kernel module and ipset-binary can match their versions 
+ */
+#define IP_SET_PROTOCOL_UNALIGNED	3
+#define IP_SET_PROTOCOL_VERSION		4
+
+#define IP_SET_MAXNAMELEN 32	/* set names and set typenames */
+
+/* Lets work with our own typedef for representing an IP address.
+ * We hope to make the code more portable, possibly to IPv6...
+ *
+ * The representation works in HOST byte order, because most set types
+ * will perform arithmetic operations and compare operations.
+ * 
+ * For now the type is an uint32_t.
+ *
+ * Make sure to ONLY use the functions when translating and parsing
+ * in order to keep the host byte order and make it more portable:
+ *  parse_ip()
+ *  parse_mask()
+ *  parse_ipandmask()
+ *  ip_tostring()
+ * (Joakim: where are they???)
+ */
+
+typedef uint32_t ip_set_ip_t;
+
+/* Sets are identified by an id in kernel space. Tweak with ip_set_id_t
+ * and IP_SET_INVALID_ID if you want to increase the max number of sets.
+ */
+typedef uint16_t ip_set_id_t;
+
+#define IP_SET_INVALID_ID	65535
+
+/* How deep we follow bindings */
+#define IP_SET_MAX_BINDINGS	6
+
+/*
+ * Option flags for kernel operations (ipt_set_info)
+ */
+#define IPSET_SRC 		0x01	/* Source match/add */
+#define IPSET_DST		0x02	/* Destination match/add */
+#define IPSET_MATCH_INV		0x04	/* Inverse matching */
+#define IPSET_MATCH_LOG		0x08	/* Inverse matching */
+#define IPSET_MATCH_DEBUG		0x10	/* Inverse matching */
+#define IPSET_MATCH_REJ   0x20	/* Reject target matching */
+#define IPSET_MATCH_PASS  0x40	/* Accpet flag for syslog print */
+#define IPSET_MATCH_DRP 0x80
+
+/*
+ * Set features
+ */
+#define IPSET_TYPE_IP		0x01	/* IP address type of set */
+#define IPSET_TYPE_PORT		0x02	/* Port type of set */
+#define IPSET_DATA_SINGLE	0x04	/* Single data storage */
+#define IPSET_DATA_DOUBLE	0x08	/* Double data storage */
+#define IPSET_DATA_TRIPLE	0x10	/* Triple data storage */
+#define IPSET_TYPE_IP1		0x20	/* IP address type of set */
+#define IPSET_TYPE_SETNAME	0x40	/* setname type of set */
+
+/* Reserved keywords */
+#define IPSET_TOKEN_DEFAULT	":default:"
+#define IPSET_TOKEN_ALL		":all:"
+
+/* SO_IP_SET operation constants, and their request struct types.
+ *
+ * Operation ids:
+ *	  0-99:	 commands with version checking
+ *	100-199: add/del/test/bind/unbind
+ *	200-299: list, save, restore
+ */
+
+/* Single shot operations: 
+ * version, create, destroy, flush, rename and swap 
+ *
+ * Sets are identified by name.
+ */
+
+#define IP_SET_REQ_STD		\
+	unsigned op;		\
+	unsigned version;	\
+	char name[IP_SET_MAXNAMELEN]
+
+#define IP_SET_OP_CREATE	0x00000001	/* Create a new (empty) set */
+struct ip_set_req_create {
+	IP_SET_REQ_STD;
+	char typename[IP_SET_MAXNAMELEN];
+};
+
+#define IP_SET_OP_DESTROY	0x00000002	/* Remove a (empty) set */
+struct ip_set_req_std {
+	IP_SET_REQ_STD;
+};
+
+#define IP_SET_OP_FLUSH		0x00000003	/* Remove all IPs in a set */
+/* Uses ip_set_req_std */
+
+#define IP_SET_OP_RENAME	0x00000004	/* Rename a set */
+/* Uses ip_set_req_create */
+
+#define IP_SET_OP_SWAP		0x00000005	/* Swap two sets */
+/* Uses ip_set_req_create */
+
+union ip_set_name_index {
+	char name[IP_SET_MAXNAMELEN];
+	ip_set_id_t index;
+};
+
+#define IP_SET_OP_GET_BYNAME	0x00000006	/* Get set index by name */
+struct ip_set_req_get_set {
+	unsigned op;
+	unsigned version;
+	union ip_set_name_index set;
+};
+
+#define IP_SET_OP_GET_BYINDEX	0x00000007	/* Get set name by index */
+/* Uses ip_set_req_get_set */
+
+#define IP_SET_OP_VERSION	0x00000100	/* Ask kernel version */
+struct ip_set_req_version {
+	unsigned op;
+	unsigned version;
+};
+
+/* Double shots operations: 
+ * add, del, test, bind and unbind.
+ *
+ * First we query the kernel to get the index and type of the target set,
+ * then issue the command. Validity of IP is checked in kernel in order
+ * to minimalize sockopt operations.
+ */
+
+/* Get minimal set data for add/del/test/bind/unbind IP */
+#define IP_SET_OP_ADT_GET	0x00000010	/* Get set and type */
+struct ip_set_req_adt_get {
+	unsigned op;
+	unsigned version;
+	union ip_set_name_index set;
+	char typename[IP_SET_MAXNAMELEN];
+};
+
+#define IP_SET_REQ_BYINDEX	\
+	unsigned op;		\
+	ip_set_id_t index;
+
+struct ip_set_req_adt {
+	IP_SET_REQ_BYINDEX;
+};
+
+#define IP_SET_OP_ADD_IP	0x00000101	/* Add an IP to a set */
+/* Uses ip_set_req_adt, with type specific addage */
+
+#define IP_SET_OP_DEL_IP	0x00000102	/* Remove an IP from a set */
+/* Uses ip_set_req_adt, with type specific addage */
+
+#define IP_SET_OP_TEST_IP	0x00000103	/* Test an IP in a set */
+/* Uses ip_set_req_adt, with type specific addage */
+
+#define IP_SET_OP_BIND_SET	0x00000104	/* Bind an IP to a set */
+/* Uses ip_set_req_bind, with type specific addage */
+struct ip_set_req_bind {
+	IP_SET_REQ_BYINDEX;
+	char binding[IP_SET_MAXNAMELEN];
+};
+
+#define IP_SET_OP_UNBIND_SET	0x00000105	/* Unbind an IP from a set */
+/* Uses ip_set_req_bind, with type speficic addage 
+ * index = 0 means unbinding for all sets */
+
+#define IP_SET_OP_TEST_BIND_SET	0x00000106	/* Test binding an IP to a set */
+/* Uses ip_set_req_bind, with type specific addage */
+
+/* Multiple shots operations: list, save, restore.
+ *
+ * - check kernel version and query the max number of sets
+ * - get the basic information on all sets
+ *   and size required for the next step
+ * - get actual set data: header, data, bindings
+ */
+
+/* Get max_sets and the index of a queried set
+ */
+#define IP_SET_OP_MAX_SETS	0x00000020
+struct ip_set_req_max_sets {
+	unsigned op;
+	unsigned version;
+	ip_set_id_t max_sets;		/* max_sets */
+	ip_set_id_t sets;		/* real number of sets */
+	union ip_set_name_index set;	/* index of set if name used */
+};
+
+/* Get the id and name of the sets plus size for next step */
+#define IP_SET_OP_LIST_SIZE	0x00000201
+#define IP_SET_OP_SAVE_SIZE	0x00000202
+struct ip_set_req_setnames {
+	unsigned op;
+	ip_set_id_t index;		/* set to list/save */
+	u_int32_t size;			/* size to get setdata */
+	/* followed by sets number of struct ip_set_name_list */
+};
+
+struct ip_set_name_list {
+	char name[IP_SET_MAXNAMELEN];
+	char typename[IP_SET_MAXNAMELEN];
+	ip_set_id_t index;
+	ip_set_id_t id;
+};
+
+/* The actual list operation */
+#define IP_SET_OP_LIST		0x00000203
+struct ip_set_req_list {
+	IP_SET_REQ_BYINDEX;
+	/* sets number of struct ip_set_list in reply */ 
+};
+
+struct ip_set_list {
+	ip_set_id_t index;
+	ip_set_id_t binding;
+	u_int32_t ref;
+	u_int32_t header_size;	/* Set header data of header_size */
+	u_int32_t members_size;	/* Set members data of members_size */
+	u_int32_t bindings_size;/* Set bindings data of bindings_size */
+};
+
+struct ip_set_hash_list {
+	ip_set_ip_t ip;
+	ip_set_id_t binding;
+};
+
+/* The save operation */
+#define IP_SET_OP_SAVE		0x00000204
+/* Uses ip_set_req_list, in the reply replaced by
+ * sets number of struct ip_set_save plus a marker
+ * ip_set_save followed by ip_set_hash_save structures.
+ */
+struct ip_set_save {
+	ip_set_id_t index;
+	ip_set_id_t binding;
+	u_int32_t header_size;	/* Set header data of header_size */
+	u_int32_t members_size;	/* Set members data of members_size */
+};
+
+/* At restoring, ip == 0 means default binding for the given set: */
+struct ip_set_hash_save {
+	ip_set_ip_t ip;
+	ip_set_id_t id;
+	ip_set_id_t binding;
+};
+
+/* The restore operation */
+#define IP_SET_OP_RESTORE	0x00000205
+/* Uses ip_set_req_setnames followed by ip_set_restore structures
+ * plus a marker ip_set_restore, followed by ip_set_hash_save 
+ * structures.
+ */
+struct ip_set_restore {
+	char name[IP_SET_MAXNAMELEN];
+	char typename[IP_SET_MAXNAMELEN];
+	ip_set_id_t index;
+	u_int32_t header_size;	/* Create data of header_size */
+	u_int32_t members_size;	/* Set members data of members_size */
+};
+
+static inline int bitmap_bytes(ip_set_ip_t a, ip_set_ip_t b)
+{
+	return 4 * ((((b - a + 8) / 8) + 3) / 4);
+}
+
+/* General limit for the elements in a set */
+#define MAX_RANGE 0x0000FFFF
+
+/* Alignment: 'unsigned long' unsupported */
+#define IPSET_ALIGNTO		4
+#define	IPSET_ALIGN(len) (((len) + IPSET_ALIGNTO - 1) & ~(IPSET_ALIGNTO - 1))
+#define IPSET_VALIGN(len, old) ((old) ? (len) : IPSET_ALIGN(len))
+
+#ifdef __KERNEL__
+#include <linux/netfilter_ipv4/ip_set_compat.h>
+#include <linux/netfilter_ipv4/ip_set_malloc.h>
+
+#define ip_set_printk(format, args...) 			\
+	do {							\
+		printk("%s: %s: ", __FILE__, __FUNCTION__);	\
+		printk(format "\n" , ## args);			\
+	} while (0)
+
+#if defined(IP_SET_DEBUG)
+#define DP(format, args...) 					\
+	do {							\
+		printk("%s: %s (DBG): ", __FILE__, __FUNCTION__);\
+		printk(format "\n" , ## args);			\
+	} while (0)
+#define IP_SET_ASSERT(x)					\
+	do {							\
+		if (!(x))					\
+			printk("IP_SET_ASSERT: %s:%i(%s)\n",	\
+				__FILE__, __LINE__, __FUNCTION__); \
+	} while (0)
+#else
+#define DP(format, args...)
+#define IP_SET_ASSERT(x)
+#endif
+
+struct ip_set;
+
+/*
+ * The ip_set_type definition - one per set type, e.g. "ipmap".
+ *
+ * Each individual set has a pointer, set->type, going to one
+ * of these structures. Function pointers inside the structure implement
+ * the real behaviour of the sets.
+ *
+ * If not mentioned differently, the implementation behind the function
+ * pointers of a set_type, is expected to return 0 if ok, and a negative
+ * errno (e.g. -EINVAL) on error.
+ */
+struct ip_set_type {
+	struct list_head list;	/* next in list of set types */
+
+	/* test for IP in set (kernel: iptables -m set src|dst)
+	 * return 0 if not in set, 1 if in set.
+	 */
+	int (*testip_kernel) (struct ip_set *set,
+			      const struct sk_buff * skb, 
+			      const u_int32_t *flags);
+
+	/* test for IP in set (userspace: ipset -T set IP)
+	 * return 0 if not in set, 1 if in set.
+	 */
+	int (*testip) (struct ip_set *set,
+		       const void *data, u_int32_t size);
+
+	/*
+	 * Size of the data structure passed by when
+	 * adding/deletin/testing an entry.
+	 */
+	u_int32_t reqsize;
+
+	/* Add IP into set (userspace: ipset -A set IP)
+	 * Return -EEXIST if the address is already in the set,
+	 * and -ERANGE if the address lies outside the set bounds.
+	 * If the address was not already in the set, 0 is returned.
+	 */
+	int (*addip) (struct ip_set *set, 
+		      const void *data, u_int32_t size);
+
+	/* Add IP into set (kernel: iptables ... -j SET set src|dst)
+	 * Return -EEXIST if the address is already in the set,
+	 * and -ERANGE if the address lies outside the set bounds.
+	 * If the address was not already in the set, 0 is returned.
+	 */
+	int (*addip_kernel) (struct ip_set *set,
+			     const struct sk_buff * skb,
+			     const u_int32_t *flags);
+
+	/* remove IP from set (userspace: ipset -D set --entry x)
+	 * Return -EEXIST if the address is NOT in the set,
+	 * and -ERANGE if the address lies outside the set bounds.
+	 * If the address really was in the set, 0 is returned.
+	 */
+	int (*delip) (struct ip_set *set, 
+		      const void *data, u_int32_t size);
+
+	/* remove IP from set (kernel: iptables ... -j SET --entry x)
+	 * Return -EEXIST if the address is NOT in the set,
+	 * and -ERANGE if the address lies outside the set bounds.
+	 * If the address really was in the set, 0 is returned.
+	 */
+	int (*delip_kernel) (struct ip_set *set,
+			     const struct sk_buff * skb,
+			     const u_int32_t *flags);
+
+	/* new set creation - allocated type specific items
+	 */
+	int (*create) (struct ip_set *set,
+		       const void *data, u_int32_t size);
+
+	/* retry the operation after successfully tweaking the set
+	 */
+	int (*retry) (struct ip_set *set);
+
+	/* set destruction - free type specific items
+	 * There is no return value.
+	 * Can be called only when child sets are destroyed.
+	 */
+	void (*destroy) (struct ip_set *set);
+
+	/* set flushing - reset all bits in the set, or something similar.
+	 * There is no return value.
+	 */
+	void (*flush) (struct ip_set *set);
+
+	/* Listing: size needed for header
+	 */
+	u_int32_t header_size;
+
+	/* Listing: Get the header
+	 *
+	 * Fill in the information in "data".
+	 * This function is always run after list_header_size() under a 
+	 * writelock on the set. Therefor is the length of "data" always 
+	 * correct. 
+	 */
+	void (*list_header) (const struct ip_set *set, 
+			     void *data);
+
+	/* Listing: Get the size for the set members
+	 */
+	int (*list_members_size) (const struct ip_set *set, char dont_align);
+
+	/* Listing: Get the set members
+	 *
+	 * Fill in the information in "data".
+	 * This function is always run after list_member_size() under a 
+	 * writelock on the set. Therefor is the length of "data" always 
+	 * correct. 
+	 */
+	void (*list_members) (const struct ip_set *set,
+			      void *data, char dont_align);
+
+	char typename[IP_SET_MAXNAMELEN];
+	unsigned char features;
+	int protocol_version;
+
+	/* Set this to THIS_MODULE if you are a module, otherwise NULL */
+	struct module *me;
+};
+
+extern int ip_set_register_set_type(struct ip_set_type *set_type);
+extern void ip_set_unregister_set_type(struct ip_set_type *set_type);
+
+/* A generic ipset */
+struct ip_set {
+	char name[IP_SET_MAXNAMELEN];	/* the name of the set */
+	rwlock_t lock;			/* lock for concurrency control */
+	ip_set_id_t id;			/* set id for swapping */
+	atomic_t ref;			/* in kernel and in hash references */
+	struct ip_set_type *type; 	/* the set types */
+	void *data;			/* pooltype specific data */
+};
+
+/* register and unregister set references */
+extern ip_set_id_t ip_set_get_byname(const char name[IP_SET_MAXNAMELEN]);
+extern ip_set_id_t ip_set_get_byindex(ip_set_id_t index);
+extern void ip_set_put_byindex(ip_set_id_t index);
+extern ip_set_id_t ip_set_id(ip_set_id_t index);
+extern ip_set_id_t __ip_set_get_byname(const char name[IP_SET_MAXNAMELEN],
+				       struct ip_set **set);
+extern void __ip_set_put_byindex(ip_set_id_t index);
+
+/* API for iptables set match, and SET target */
+extern int ip_set_addip_kernel(ip_set_id_t id,
+			       const struct sk_buff *skb,
+			       const u_int32_t *flags);
+extern int ip_set_delip_kernel(ip_set_id_t id,
+			       const struct sk_buff *skb,
+			       const u_int32_t *flags);
+extern int ip_set_testip_kernel(ip_set_id_t id,
+				const struct sk_buff *skb,
+				const u_int32_t *flags);
+
+/* Macros to generate functions */
+
+#define STRUCT(pre, type)	CONCAT2(pre, type)
+#define CONCAT2(pre, type)	struct pre##type
+
+#define FNAME(pre, mid, post)	CONCAT3(pre, mid, post)
+#define CONCAT3(pre, mid, post)	pre##mid##post
+
+#define UADT0(type, adt, args...)					\
+static int								\
+FNAME(type,_u,adt)(struct ip_set *set, const void *data, u_int32_t size)\
+{									\
+	const STRUCT(ip_set_req_,type) *req = data;			\
+									\
+	return FNAME(type,_,adt)(set , ## args);			\
+}
+
+#define UADT(type, adt, args...)					\
+	UADT0(type, adt, req->ip , ## args)
+
+#define KADT(type, adt, getfn, args...)					\
+static int								\
+FNAME(type,_k,adt)(struct ip_set *set,					\
+	     const struct sk_buff *skb,					\
+	     const u_int32_t *flags)					\
+{									\
+	ip_set_ip_t ip = getfn(skb, flags);				\
+									\
+	KADT_CONDITION							\
+	return FNAME(type,_,adt)(set, ip , ##args);			\
+}
+
+#define REGISTER_MODULE(type)						\
+static int __init ip_set_##type##_init(void)				\
+{									\
+	init_max_page_size();						\
+	return ip_set_register_set_type(&ip_set_##type);		\
+}									\
+									\
+static void __exit ip_set_##type##_fini(void)				\
+{									\
+	/* FIXME: possible race with ip_set_create() */			\
+	ip_set_unregister_set_type(&ip_set_##type);			\
+}									\
+									\
+module_init(ip_set_##type##_init);					\
+module_exit(ip_set_##type##_fini);
+
+/* Common functions */
+
+static inline ip_set_ip_t
+ipaddr(const struct sk_buff *skb, const u_int32_t *flags)
+{
+	return ntohl(flags[0] & IPSET_SRC ? ip_hdr(skb)->saddr : ip_hdr(skb)->daddr);
+}
+
+#define jhash_ip(map, i, ip)	jhash_1word(ip, *(map->initval + i))
+
+#define pack_ip_port(map, ip, port) \
+	(port + ((ip - ((map)->first_ip)) << 16))
+
+#endif				/* __KERNEL__ */
+
+#define UNUSED __attribute__ ((unused))
+
+#endif /*_IP_SET_H*/
diff -urN iptables-1.4.0-orig/include/linux/netfilter_ipv4/ipt_IPMARK.h iptables-1.4.0/include/linux/netfilter_ipv4/ipt_IPMARK.h
--- iptables-1.4.0-orig/include/linux/netfilter_ipv4/ipt_IPMARK.h	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/include/linux/netfilter_ipv4/ipt_IPMARK.h	2011-01-06 16:58:55.000000000 +0800
@@ -0,0 +1,13 @@
+#ifndef _IPT_IPMARK_H_target
+#define _IPT_IPMARK_H_target
+
+struct ipt_ipmark_target_info {
+	unsigned long andmask;
+	unsigned long ormask;
+	unsigned char addr;
+};
+
+#define IPT_IPMARK_SRC    0
+#define IPT_IPMARK_DST    1
+
+#endif /*_IPT_IPMARK_H_target*/
diff -urN iptables-1.4.0-orig/include/linux/netfilter_ipv4/ipt_set.h iptables-1.4.0/include/linux/netfilter_ipv4/ipt_set.h
--- iptables-1.4.0-orig/include/linux/netfilter_ipv4/ipt_set.h	1970-01-01 08:00:00.000000000 +0800
+++ iptables-1.4.0/include/linux/netfilter_ipv4/ipt_set.h	2010-12-29 11:42:28.000000000 +0800
@@ -0,0 +1,28 @@
+#ifndef _IPT_SET_H
+#define _IPT_SET_H
+
+#include <linux/netfilter_ipv4/ip_set.h>
+
+#define MAXSET 32
+
+struct ipt_set_info {
+	ip_set_id_t index;
+	u_int32_t flags[IP_SET_MAX_BINDINGS + 1];
+};
+
+/* match info */
+struct ipt_set_info_match {
+	struct ipt_set_info match_set;
+};
+
+/* multi match info */
+struct ipt_mset_info_match {
+	struct ipt_set_info match_set[MAXSET];
+};
+
+struct ipt_set_info_target {
+	struct ipt_set_info add_set;
+	struct ipt_set_info del_set;
+};
+
+#endif /*_IPT_SET_H*/
