fix nat helpers for ipv4, add rtsp nat helper

5 files changed, 418 insertions, 409 deletions

diff --git a/target/linux/config/Config.in.netfilter b/target/linux/config/Config.in.netfilter
index e831fd594..cb71b6551 100644
--- a/target/linux/config/Config.in.netfilter
+++ b/target/linux/config/Config.in.netfilter
@@ -138,62 +138,7 @@ config ADK_KERNEL_IP_NF_MATCH_STRING
 	default n
 
 menu "Core Netfilter Configuration"
-
-config ADK_KPACKAGE_KMOD_NF_CONNTRACK
-	tristate 'Netfilter connection tracking support'
-	select ADK_KERNEL_NETFILTER_XTABLES
-	help
-	  Connection tracking keeps a record of what packets have passed
-	  through your machine, in order to figure out how they are related
-	  into connections.
-
-	  Layer 3 independent connection tracking is experimental scheme
-	  which generalize ip_conntrack to support other layer 3 protocols.
-
-config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_CLASSIFY
-	tristate '"CLASSIFY" target support'
-	select ADK_KERNEL_NETFILTER_XTABLES
-	help
-	  This option adds a `CLASSIFY' target, which enables the user to set
-	  the priority of a packet. Some qdiscs can use this value for
-	  classification, among these are:
-
-  	  atm, cbq, dsmark, pfifo_fast, htb, prio
-
-config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_CONNMARK
-	tristate '"CONNMARK" target support'
-	select ADK_KERNEL_NETFILTER_XTABLES
-	select ADK_KPACKAGE_KMOD_NF_CONNTRACK
-	help
-	  This option adds a `CONNMARK' target, which allows one to manipulate
-	  the connection mark value.  Similar to the MARK target, but
-	  affects the connection mark value rather than the packet mark value.
-
-config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_MARK
-	tristate '"MARK" target support'
-	select ADK_KERNEL_NETFILTER_XTABLES
-	help
-	  This option adds a `MARK' target, which allows you to create rules
-	  in the `mangle' table which alter the netfilter mark (nfmark) field
-	  associated with the packet prior to routing. This can change
-	  the routing method (see `Use netfilter MARK value as routing
-	  key') and can also be used by other subsystems to change their
-	  behavior.
-
-config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_NFQUEUE
-	tristate '"NFQUEUE" target support'
-	select ADK_KERNEL_NETFILTER_XTABLES
-	help
-	  This target replaced the old obsolete QUEUE target.
-
-	  As opposed to QUEUE, it supports 65535 different queues,
-	  not just one.
-
-config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_TCPMSS
-	tristate 'TCPMSS target'
-	select ADK_KERNEL_NETFILTER_XTABLES
-	help
-
+source target/linux/config/Config.in.netfilter.core
 endmenu
 
 menu "IP: Netfilter Configuration"
@@ -206,239 +151,11 @@ source target/linux/config/Config.in.netfilter.ip6
 endmenu
 
 menu "Ethernet bridge firewalling"
-
-config ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	tristate 'Ethernet Bridge tables (ebtables) support'
-	select ADK_KERNEL_BRIDGE_NETFILTER
-	help
-	  ebtables is a general, extensible frame/packet identification
-	  framework. Say 'Y' or 'M' here if you want to do Ethernet
-	  filtering/NAT/brouting on the Ethernet bridge.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_BROUTE
-	tristate "ebt: broute table support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  The ebtables broute table is used to define rules that decide between
-	  bridging and routing frames, giving Linux the functionality of a
-	  brouter. See the man page for ebtables(8) and examples on the ebtables
-	  website.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_T_FILTER
-	tristate "ebt: filter table support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  The ebtables filter table is used to define frame filtering rules at
-	  local input, forwarding and local output. See the man page for
-	  ebtables(8).
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_T_NAT
-	tristate "ebt: nat table support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  The ebtables nat table is used to define rules that alter the MAC
-	  source address (MAC SNAT) or the MAC destination address (MAC DNAT).
-	  See the man page for ebtables(8).
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-#
-# matches
-#
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_802_3
-	tristate "ebt: 802.3 filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds matching support for 802.3 Ethernet frames.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_AMONG
-	tristate "ebt: among filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the among match, which allows matching the MAC source
-	  and/or destination address on a list of addresses. Optionally,
-	  MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ARP
-	tristate "ebt: ARP filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the ARP match, which allows ARP and RARP header field
-	  filtering.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_IP
-	tristate "ebt: IP filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the IP match, which allows basic IP header field
-	  filtering.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_IP6
-	tristate "ebt: IP6 filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES && ADK_KPACKAGE_KMOD_IPV6
-	help
-	  This option adds the IP6 match, which allows basic IPV6 header field
-	  filtering.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_LIMIT
-	tristate "ebt: limit match support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the limit match, which allows you to control
-	  the rate at which a rule can be matched. This match is the
-	  equivalent of the iptables limit match.
-
-	  If you want to compile it as a module, say M here and read
-	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_MARK
-	tristate "ebt: mark filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the mark match, which allows matching frames based on
-	  the 'nfmark' value in the frame. This can be set by the mark target.
-	  This value is the same as the one used in the iptables mark match and
-	  target.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_PKTTYPE
-	tristate "ebt: packet type filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the packet type match, which allows matching on the
-	  type of packet based on its Ethernet "class" (as determined by
-	  the generic networking code): broadcast, multicast,
-	  for this host alone or for another host.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_STP
-	tristate "ebt: STP filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the Spanning Tree Protocol match, which
-	  allows STP header field filtering.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_VLAN
-	tristate "ebt: 802.1Q VLAN filter support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the 802.1Q vlan match, which allows the filtering of
-	  802.1Q vlan fields.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-#
-# targets
-#
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ARPREPLY
-	tristate "ebt: arp reply target support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the arp reply target, which allows
-	  automatically sending arp replies to arp requests.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_DNAT
-	tristate "ebt: dnat target support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the MAC DNAT target, which allows altering the MAC
-	  destination address of frames.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_MARK_T
-	tristate "ebt: mark target support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the mark target, which allows marking frames by
-	  setting the 'nfmark' value in the frame.
-	  This value is the same as the one used in the iptables mark match and
-	  target.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_REDIRECT
-	tristate "ebt: redirect target support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the MAC redirect target, which allows altering the MAC
-	  destination address of a frame to that of the device it arrived on.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_SNAT
-	tristate "ebt: snat target support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the MAC SNAT target, which allows altering the MAC
-	  source address of frames.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-#
-# watchers
-#
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_LOG
-	tristate "ebt: log support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option adds the log watcher, that you can use in any rule
-	  in any ebtables table. It records info about the frame header
-	  to the syslog.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ULOG
-	tristate "ebt: ulog support (OBSOLETE)"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option enables the old bridge-specific "ebt_ulog" implementation
-	  which has been obsoleted by the new "nfnetlink_log" code (see
-	  CONFIG_NETFILTER_NETLINK_LOG).
-
-	  This option adds the ulog watcher, that you can use in any rule
-	  in any ebtables table. The packet is passed to a userspace
-	  logging daemon using netlink multicast sockets. This differs
-	  from the log watcher in the sense that the complete packet is
-	  sent to userspace instead of a descriptive text and that
-	  netlink multicast sockets are used instead of the syslog.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-config ADK_KPACKAGE_KMOD_BRIDGE_EBT_NFLOG
-	tristate "ebt: nflog support"
-	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
-	help
-	  This option enables the nflog watcher, which allows to LOG
-	  messages through the netfilter logging API, which can use
-	  either the old LOG target, the old ULOG target or nfnetlink_log
-	  as backend.
-
-	  This option adds the nflog watcher, that you can use in any rule
-	  in any ebtables table.
-
-	  To compile it as a module, choose M here.  If unsure, say N.
-
-
+source target/linux/config/Config.in.netfilter.ebt
 endmenu
 
+menu "Netfilter Addons"
 source package/ipset/Config.in.kmod
+endmenu
 
 endmenu
diff --git a/target/linux/config/Config.in.netfilter.core b/target/linux/config/Config.in.netfilter.core
new file mode 100644
index 000000000..0231b2d13
--- /dev/null
+++ b/target/linux/config/Config.in.netfilter.core
@@ -0,0 +1,182 @@
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	tristate 'Netfilter connection tracking support'
+	select ADK_KERNEL_NETFILTER_XTABLES
+	help
+	  Connection tracking keeps a record of what packets have passed
+	  through your machine, in order to figure out how they are related
+	  into connections.
+
+	  Layer 3 independent connection tracking is experimental scheme
+	  which generalize ip_conntrack to support other layer 3 protocols.
+
+config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_CLASSIFY
+	tristate '"CLASSIFY" target support'
+	select ADK_KERNEL_NETFILTER_XTABLES
+	help
+	  This option adds a `CLASSIFY' target, which enables the user to set
+	  the priority of a packet. Some qdiscs can use this value for
+	  classification, among these are:
+
+  	  atm, cbq, dsmark, pfifo_fast, htb, prio
+
+config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_CONNMARK
+	tristate '"CONNMARK" target support'
+	select ADK_KERNEL_NETFILTER_XTABLES
+	select ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  This option adds a `CONNMARK' target, which allows one to manipulate
+	  the connection mark value.  Similar to the MARK target, but
+	  affects the connection mark value rather than the packet mark value.
+
+config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_MARK
+	tristate '"MARK" target support'
+	select ADK_KERNEL_NETFILTER_XTABLES
+	help
+	  This option adds a `MARK' target, which allows you to create rules
+	  in the `mangle' table which alter the netfilter mark (nfmark) field
+	  associated with the packet prior to routing. This can change
+	  the routing method (see `Use netfilter MARK value as routing
+	  key') and can also be used by other subsystems to change their
+	  behavior.
+
+config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_NFQUEUE
+	tristate '"NFQUEUE" target support'
+	select ADK_KERNEL_NETFILTER_XTABLES
+	help
+	  This target replaced the old obsolete QUEUE target.
+
+	  As opposed to QUEUE, it supports 65535 different queues,
+	  not just one.
+
+config ADK_KPACKAGE_KMOD_NETFILTER_XT_TARGET_TCPMSS
+	tristate 'TCPMSS target'
+	select ADK_KERNEL_NETFILTER_XTABLES
+	help
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_MARK
+	bool 'Connection mark tracking support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	select ADK_KERNEL_IP_NF_MATCH_CONNMARK
+	help
+	  This option enables support for connection marks, used by the
+	  `CONNMARK' target and `connmark' match. Similar to the mark value
+	  of packets, but this mark value is kept in the conntrack session
+	  instead of the individual packets.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_SECMARK
+	bool 'Connection tracking security mark support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	#FIXME select NETWORK_SECMARK
+	help
+	  This option enables security markings to be applied to
+	  connections.  Typically they are copied to connections from
+	  packets using the CONNSECMARK target and copied back from
+	  connections to packets with the same target, with the packets
+	  being originally labeled via SECMARK.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_FTP
+	tristate 'FTP protocol support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  Tracking FTP connections is problematic: special helpers are
+	  required for tracking them, and doing masquerading and other forms
+	  of Network Address Translation on them.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_RTSP
+	tristate 'RTSP protocol support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  Tracking RTSP connections might be required for IPTV.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_IRC
+	tristate 'IRC protocol support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  There is a commonly-used extension to IRC called
+	  Direct Client-to-Client Protocol (DCC).  This enables users to send
+	  files to each other, and also chat to each other without the need
+	  of a server.  DCC Sending is used anywhere you send files over IRC,
+	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
+	  using NAT, this extension will enable you to send files and initiate
+	  chats.  Note that you do NOT need this extension to get files or
+	  have others initiate chats, or everything else in IRC.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_NETBIOS_NS
+	tristate 'NetBIOS name service protocol support (EXPERIMENTAL)'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  NetBIOS name service requests are sent as broadcast messages from an
+	  unprivileged port and responded to with unicast messages to the
+	  same port. This make them hard to firewall properly because connection
+	  tracking doesn't deal with broadcasts. This helper tracks locally
+	  originating NetBIOS name service requests and the corresponding
+	  responses. It relies on correct IP address configuration, specifically
+	  netmask and broadcast address. When properly configured, the output
+	  of "ip address show" should look similar to this:
+
+	  $ ip -4 address show eth0
+	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
+	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_TFTP
+	tristate 'TFTP protocol support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  TFTP connection tracking helper, this is required depending
+	  on how restrictive your ruleset is.
+	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
+	  you will need this.
+
+#config ADK_KPACKAGE_KMOD_NF_CONNTRACK_AMANDA
+#	tristate 'Amanda backup protocol support'
+#	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+#	#FIXME TEXTSEARCH && TEXTSEARCH_KMP
+#	help
+#	  If you are running the Amanda backup package <http://www.amanda.org/>
+#	  on this machine or machines that will be MASQUERADED through this
+#	  machine, then you may want to enable this feature.  This allows the
+#	  connection tracking and natting code to allow the sub-channels that
+#	  Amanda requires for communication of the backup data, messages and
+#	  index.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_PPTP
+	tristate 'PPTP protocol support'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  This module adds support for PPTP (Point to Point Tunnelling
+	  Protocol, RFC2637) connection tracking and NAT. 
+	
+	  If you are running PPTP sessions over a stateful firewall or NAT
+	  box, you may want to enable this feature.  
+	
+	  Please note that not all PPTP modes of operation are supported yet.
+	  For more info, read top of the file
+	  net/ipv4/netfilter/ip_conntrack_pptp.c
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_H323
+	tristate 'H.323 protocol support (EXPERIMENTAL)'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
+	  important VoIP protocols, it is widely used by voice hardware and
+	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
+	  Gnomemeeting, etc.
+
+	  With this module you can support H.323 on a connection tracking/NAT
+	  firewall.
+
+	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
+	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
+	  whiteboard, file transfer, etc. For more information, please
+	  visit http://nath323.sourceforge.net/.
+
+config ADK_KPACKAGE_KMOD_NF_CONNTRACK_SIP
+	tristate 'SIP protocol support (EXPERIMENTAL)'
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	help
+	  SIP is an application-layer control protocol that can establish,
+	  modify, and terminate multimedia sessions (conferences) such as
+	  Internet telephony calls. With the ip_conntrack_sip and
+	  the ip_nat_sip modules you can support the protocol on a connection
+	  tracking/NATing firewall.
+
diff --git a/target/linux/config/Config.in.netfilter.ebt b/target/linux/config/Config.in.netfilter.ebt
new file mode 100644
index 000000000..9dfb5e5b9
--- /dev/null
+++ b/target/linux/config/Config.in.netfilter.ebt
@@ -0,0 +1,229 @@
+config ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	tristate 'Ethernet Bridge tables (ebtables) support'
+	select ADK_KERNEL_BRIDGE_NETFILTER
+	help
+	  ebtables is a general, extensible frame/packet identification
+	  framework. Say 'Y' or 'M' here if you want to do Ethernet
+	  filtering/NAT/brouting on the Ethernet bridge.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_BROUTE
+	tristate "ebt: broute table support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  The ebtables broute table is used to define rules that decide between
+	  bridging and routing frames, giving Linux the functionality of a
+	  brouter. See the man page for ebtables(8) and examples on the ebtables
+	  website.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_T_FILTER
+	tristate "ebt: filter table support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  The ebtables filter table is used to define frame filtering rules at
+	  local input, forwarding and local output. See the man page for
+	  ebtables(8).
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_T_NAT
+	tristate "ebt: nat table support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  The ebtables nat table is used to define rules that alter the MAC
+	  source address (MAC SNAT) or the MAC destination address (MAC DNAT).
+	  See the man page for ebtables(8).
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+#
+# matches
+#
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_802_3
+	tristate "ebt: 802.3 filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds matching support for 802.3 Ethernet frames.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_AMONG
+	tristate "ebt: among filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the among match, which allows matching the MAC source
+	  and/or destination address on a list of addresses. Optionally,
+	  MAC/IP address pairs can be matched, f.e. for anti-spoofing rules.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ARP
+	tristate "ebt: ARP filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the ARP match, which allows ARP and RARP header field
+	  filtering.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_IP
+	tristate "ebt: IP filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the IP match, which allows basic IP header field
+	  filtering.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_IP6
+	tristate "ebt: IP6 filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES && ADK_KPACKAGE_KMOD_IPV6
+	help
+	  This option adds the IP6 match, which allows basic IPV6 header field
+	  filtering.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_LIMIT
+	tristate "ebt: limit match support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the limit match, which allows you to control
+	  the rate at which a rule can be matched. This match is the
+	  equivalent of the iptables limit match.
+
+	  If you want to compile it as a module, say M here and read
+	  <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_MARK
+	tristate "ebt: mark filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the mark match, which allows matching frames based on
+	  the 'nfmark' value in the frame. This can be set by the mark target.
+	  This value is the same as the one used in the iptables mark match and
+	  target.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_PKTTYPE
+	tristate "ebt: packet type filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the packet type match, which allows matching on the
+	  type of packet based on its Ethernet "class" (as determined by
+	  the generic networking code): broadcast, multicast,
+	  for this host alone or for another host.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_STP
+	tristate "ebt: STP filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the Spanning Tree Protocol match, which
+	  allows STP header field filtering.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_VLAN
+	tristate "ebt: 802.1Q VLAN filter support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the 802.1Q vlan match, which allows the filtering of
+	  802.1Q vlan fields.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+#
+# targets
+#
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ARPREPLY
+	tristate "ebt: arp reply target support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the arp reply target, which allows
+	  automatically sending arp replies to arp requests.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_DNAT
+	tristate "ebt: dnat target support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the MAC DNAT target, which allows altering the MAC
+	  destination address of frames.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_MARK_T
+	tristate "ebt: mark target support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the mark target, which allows marking frames by
+	  setting the 'nfmark' value in the frame.
+	  This value is the same as the one used in the iptables mark match and
+	  target.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_REDIRECT
+	tristate "ebt: redirect target support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the MAC redirect target, which allows altering the MAC
+	  destination address of a frame to that of the device it arrived on.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_SNAT
+	tristate "ebt: snat target support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the MAC SNAT target, which allows altering the MAC
+	  source address of frames.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+#
+# watchers
+#
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_LOG
+	tristate "ebt: log support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option adds the log watcher, that you can use in any rule
+	  in any ebtables table. It records info about the frame header
+	  to the syslog.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_ULOG
+	tristate "ebt: ulog support (OBSOLETE)"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option enables the old bridge-specific "ebt_ulog" implementation
+	  which has been obsoleted by the new "nfnetlink_log" code (see
+	  CONFIG_NETFILTER_NETLINK_LOG).
+
+	  This option adds the ulog watcher, that you can use in any rule
+	  in any ebtables table. The packet is passed to a userspace
+	  logging daemon using netlink multicast sockets. This differs
+	  from the log watcher in the sense that the complete packet is
+	  sent to userspace instead of a descriptive text and that
+	  netlink multicast sockets are used instead of the syslog.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
+config ADK_KPACKAGE_KMOD_BRIDGE_EBT_NFLOG
+	tristate "ebt: nflog support"
+	depends on ADK_KPACKAGE_KMOD_BRIDGE_NF_EBTABLES
+	help
+	  This option enables the nflog watcher, which allows to LOG
+	  messages through the netfilter logging API, which can use
+	  either the old LOG target, the old ULOG target or nfnetlink_log
+	  as backend.
+
+	  This option adds the nflog watcher, that you can use in any rule
+	  in any ebtables table.
+
+	  To compile it as a module, choose M here.  If unsure, say N.
+
diff --git a/target/linux/config/Config.in.netfilter.ip4 b/target/linux/config/Config.in.netfilter.ip4
index 34eb14449..95a71b917 100644
--- a/target/linux/config/Config.in.netfilter.ip4
+++ b/target/linux/config/Config.in.netfilter.ip4
@@ -8,7 +8,7 @@ config ADK_KPACKAGE_KMOD_NF_CONNTRACK_IPV4
 
 config ADK_KPACKAGE_KMOD_IP_NF_CT_ACCT
 	bool 'Connection tracking flow accounting'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
+	depends on ADK_KPACKAGE_KMOD_NF_CONNTRACK
 	help
 	  If this option is enabled, the connection tracking code will
 	  keep per-flow packet and byte counters.
@@ -16,127 +16,6 @@ config ADK_KPACKAGE_KMOD_IP_NF_CT_ACCT
 	  Those counters can be used for flow-based accounting or the
 	  `connbytes' match.
 
-config ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK_MARK
-	bool 'Connection mark tracking support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	select ADK_KERNEL_IP_NF_MATCH_CONNMARK
-	help
-	  This option enables support for connection marks, used by the
-	  `CONNMARK' target and `connmark' match. Similar to the mark value
-	  of packets, but this mark value is kept in the conntrack session
-	  instead of the individual packets.
-
-config ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK_SECMARK
-	bool 'Connection tracking security mark support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	#FIXME select NETWORK_SECMARK
-	help
-	  This option enables security markings to be applied to
-	  connections.  Typically they are copied to connections from
-	  packets using the CONNSECMARK target and copied back from
-	  connections to packets with the same target, with the packets
-	  being originally labeled via SECMARK.
-
-config ADK_KPACKAGE_KMOD_IP_NF_FTP
-	tristate 'FTP protocol support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  Tracking FTP connections is problematic: special helpers are
-	  required for tracking them, and doing masquerading and other forms
-	  of Network Address Translation on them.
-
-config ADK_KPACKAGE_KMOD_IP_NF_IRC
-	tristate 'IRC protocol support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  There is a commonly-used extension to IRC called
-	  Direct Client-to-Client Protocol (DCC).  This enables users to send
-	  files to each other, and also chat to each other without the need
-	  of a server.  DCC Sending is used anywhere you send files over IRC,
-	  and DCC Chat is most commonly used by Eggdrop bots.  If you are
-	  using NAT, this extension will enable you to send files and initiate
-	  chats.  Note that you do NOT need this extension to get files or
-	  have others initiate chats, or everything else in IRC.
-
-config ADK_KPACKAGE_KMOD_IP_NF_NETBIOS_NS
-	tristate 'NetBIOS name service protocol support (EXPERIMENTAL)'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  NetBIOS name service requests are sent as broadcast messages from an
-	  unprivileged port and responded to with unicast messages to the
-	  same port. This make them hard to firewall properly because connection
-	  tracking doesn't deal with broadcasts. This helper tracks locally
-	  originating NetBIOS name service requests and the corresponding
-	  responses. It relies on correct IP address configuration, specifically
-	  netmask and broadcast address. When properly configured, the output
-	  of "ip address show" should look similar to this:
-
-	  $ ip -4 address show eth0
-	  4: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
-	      inet 172.16.2.252/24 brd 172.16.2.255 scope global eth0
-
-config ADK_KPACKAGE_KMOD_IP_NF_TFTP
-	tristate 'TFTP protocol support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  TFTP connection tracking helper, this is required depending
-	  on how restrictive your ruleset is.
-	  If you are using a tftp client behind -j SNAT or -j MASQUERADING
-	  you will need this.
-
-config ADK_KPACKAGE_KMOD_IP_NF_AMANDA
-	tristate 'Amanda backup protocol support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	#FIXME TEXTSEARCH && TEXTSEARCH_KMP
-	help
-	  If you are running the Amanda backup package <http://www.amanda.org/>
-	  on this machine or machines that will be MASQUERADED through this
-	  machine, then you may want to enable this feature.  This allows the
-	  connection tracking and natting code to allow the sub-channels that
-	  Amanda requires for communication of the backup data, messages and
-	  index.
-
-config ADK_KPACKAGE_KMOD_IP_NF_PPTP
-	tristate 'PPTP protocol support'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  This module adds support for PPTP (Point to Point Tunnelling
-	  Protocol, RFC2637) connection tracking and NAT. 
-	
-	  If you are running PPTP sessions over a stateful firewall or NAT
-	  box, you may want to enable this feature.  
-	
-	  Please note that not all PPTP modes of operation are supported yet.
-	  For more info, read top of the file
-	  net/ipv4/netfilter/ip_conntrack_pptp.c
-
-config ADK_KPACKAGE_KMOD_IP_NF_H323
-	tristate 'H.323 protocol support (EXPERIMENTAL)'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  H.323 is a VoIP signalling protocol from ITU-T. As one of the most
-	  important VoIP protocols, it is widely used by voice hardware and
-	  software including voice gateways, IP phones, Netmeeting, OpenPhone,
-	  Gnomemeeting, etc.
-
-	  With this module you can support H.323 on a connection tracking/NAT
-	  firewall.
-
-	  This module supports RAS, Fast Start, H.245 Tunnelling, Call
-	  Forwarding, RTP/RTCP and T.120 based audio, video, fax, chat,
-	  whiteboard, file transfer, etc. For more information, please
-	  visit http://nath323.sourceforge.net/.
-
-config ADK_KPACKAGE_KMOD_IP_NF_SIP
-	tristate 'SIP protocol support (EXPERIMENTAL)'
-	depends on ADK_KPACKAGE_KMOD_IP_NF_CONNTRACK
-	help
-	  SIP is an application-layer control protocol that can establish,
-	  modify, and terminate multimedia sessions (conferences) such as
-	  Internet telephony calls. With the ip_conntrack_sip and
-	  the ip_nat_sip modules you can support the protocol on a connection
-	  tracking/NATing firewall.
-
 
 config ADK_KPACKAGE_KMOD_IP_NF_IPTABLES
 	tristate 'IP tables support (required for filtering/masq/NAT)'
diff --git a/target/linux/config/Config.in.netfilter.ip6 b/target/linux/config/Config.in.netfilter.ip6
index a0bb7beba..cb9700cbd 100644
--- a/target/linux/config/Config.in.netfilter.ip6
+++ b/target/linux/config/Config.in.netfilter.ip6
@@ -1,6 +1,7 @@
 config ADK_KPACKAGE_KMOD_NF_CONNTRACK_IPV6
 	tristate "IPv6 connection tracking support"
 	select ADK_KPACKAGE_KMOD_NF_CONNTRACK
+	select ADK_KPACKAGE_KMOD_IPV6
 	---help---
 	  Connection tracking keeps a record of what packets have passed
 	  through your machine, in order to figure out how they are related
@@ -15,6 +16,7 @@ config ADK_KPACKAGE_KMOD_NF_CONNTRACK_IPV6
 config ADK_KPACKAGE_KMOD_IP6_NF_IPTABLES
 	tristate "IP6 tables support (required for filtering)"
 	select ADK_KERNEL_NETFILTER_XTABLES
+	select ADK_KPACKAGE_KMOD_IPV6
 	help
 	  ip6tables is a general, extensible packet identification framework.
 	  Currently only the packet filtering and packet mangling subsystem