Merge remote-tracking branch 'origin/master' into next

Conflicts:
	config/cfgroot/general-functions.pl

diff --combined src/initscripts/init.d/firewall
index 93c4c79c0aa8fd8f0d02b10407e4a5c5fbb2a4e7,97186c399249ae58106a873cc1d951bd7223f55e..23d0c23ff7a3a03642727c85b102ce3589d3d118
--- 1/src/initscripts/init.d/firewall
--- 2/src/initscripts/init.d/firewall
+++ b/src/initscripts/init.d/firewall
@@@ -64,20 -64,16 +64,20 @@@ iptables_init() 
        iptables -A BADTCP -i lo -j RETURN
  
        # Disallow packets frequently used by port-scanners
 -      # nmap xmas
 -      iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH  -j PSCAN
 -      # Null
 -      iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
 -      # FIN
 +      # NMAP FIN/URG/PSH (XMAS scan)
 +      iptables -A BADTCP -p tcp --tcp-flags ALL FIN,URG,PSH -j PSCAN
 +      # SYN/RST/ACK/FIN/URG
 +      iptables -A BADTCP -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j PSCAN
 +      # ALL/ALL
 +      iptables -A BADTCP -p tcp --tcp-flags ALL ALL -j PSCAN
 +      # FIN Stealth
        iptables -A BADTCP -p tcp --tcp-flags ALL FIN -j PSCAN
        # SYN/RST (also catches xmas variants that set SYN+RST+...)
        iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j PSCAN
        # SYN/FIN (QueSO or nmap OS probe)
        iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j PSCAN
 +      # Null
 +      iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j PSCAN
        # NEW TCP without SYN
        iptables -A BADTCP -p tcp ! --syn -m conntrack --ctstate NEW -j NEWNOTSYN
  
@@@ -87,7 -83,6 +87,7 @@@
        # Connection tracking chain
        iptables -N CONNTRACK
        iptables -A CONNTRACK -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
 +      iptables -A CONNTRACK -m conntrack --ctstate INVALID -j DROP
  
        # Fix for braindead ISP's
        iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
@@@ -259,20 -254,6 +259,6 @@@
        iptables -t nat -N REDNAT
        iptables -t nat -A POSTROUTING -j REDNAT
  
-       # Filter logging of incoming broadcasts.
-       iptables -N BROADCAST_FILTER
-       iptables -A INPUT -j BROADCAST_FILTER
- 
-       iptables -A BROADCAST_FILTER -i "${GREEN_DEV}" -d "${GREEN_BROADCAST}" -j DROP
- 
-       if [ -n "${BLUE_DEV}" -a -n "${BLUE_BROADCAST}" ]; then
-               iptables -A BROADCAST_FILTER -i "${BLUE_DEV}" -d "${BLUE_BROADCAST}" -j DROP
-       fi
- 
-       if [ -n "${ORANGE_DEV}" -a -n "${ORANGE_BROADCAST}" ]; then
-               iptables -A BROADCAST_FILTER -i "${ORANGE_DEV}" -d "${ORANGE_BROADCAST}" -j DROP
-       fi
- 
        # Apply OpenVPN firewall rules
        /usr/local/bin/openvpnctrl --firewall-rules