--- iptables-1.4.21/extensions/GNUmakefile.in	2013-11-22 12:18:13.000000000 +0100
+++ src/extensions/GNUmakefile.in	2014-02-10 18:59:59.015816135 +0100
@@ -36,12 +36,139 @@
 endif
 
 #
-#	Wildcard module list
+#	module list
 #
-pfx_build_mod := $(patsubst ${srcdir}/libxt_%.c,%,$(sort $(wildcard ${srcdir}/libxt_*.c)))
+
+include ../../config
+
+#
+# generic
+#
+modl-$(CONFIG_MATCH_ADDRTYPE) += libxt_addrtype.c
+modl-$(CONFIG_MATCH_BPF) += libxt_bpf.c
+modl-$(CONFIG_MATCH_CLUSTER) += libxt_cluster.c
+modl-$(CONFIG_MATCH_COMMENT) += libxt_comment.c
+modl-$(CONFIG_MATCH_CONNBYTES) += libxt_connbytes.c
+modl-$(CONFIG_MATCH_CONNLABEL) += libxt_connlabel.c
+modl-$(CONFIG_MATCH_CONNLIMIT) += libxt_connlimit.c
+modl-$(CONFIG_MATCH_CONNMARK) += libxt_connmark.c
+modl-$(CONFIG_MATCH_CONNTRACK) += libxt_conntrack.c
+modl-$(CONFIG_MATCH_CPU) += libxt_cpu.c
+modl-$(CONFIG_MATCH_DCCP) += libxt_dccp.c
+modl-$(CONFIG_MATCH_DEVGROUP) += libxt_devgroup.c
+modl-$(CONFIG_MATCH_DSCP) += libxt_dscp.c
+modl-$(CONFIG_MATCH_ECN) += libxt_ecn.c
+modl-$(CONFIG_MATCH_ESP) += libxt_esp.c
+modl-$(CONFIG_MATCH_HASHLIMIT) += libxt_hashlimit.c
+modl-$(CONFIG_MATCH_HELPER) += libxt_helper.c
+modl-$(CONFIG_MATCH_IPRANGE) += libxt_iprange.c
+modl-$(CONFIG_MATCH_IPVS) += libxt_ipvs.c
+modl-$(CONFIG_MATCH_LENGTH) += libxt_length.c
+modl-$(CONFIG_MATCH_LIMIT) += libxt_limit.c
+modl-$(CONFIG_MATCH_MAC) += libxt_mac.c
+modl-$(CONFIG_MATCH_MARK) += libxt_mark.c
+modl-$(CONFIG_MATCH_MULTIPORT) += libxt_multiport.c
+modl-$(CONFIG_MATCH_NFACCT) += libxt_nfacct.c
+modl-$(CONFIG_MATCH_OSF) += libxt_osf.c
+modl-$(CONFIG_MATCH_OWNER) += libxt_owner.c
+modl-$(CONFIG_MATCH_PHYSDEV) += libxt_physdev.c
+modl-$(CONFIG_MATCH_PKTTYPE) += libxt_pkttype.c
+modl-$(CONFIG_MATCH_POLICY) += libxt_policy.c
+modl-$(CONFIG_MATCH_QUOTA) += libxt_quota.c
+modl-$(CONFIG_MATCH_RATEEST) += libxt_rateest.c
+modl-$(CONFIG_MATCH_RECENT) += libxt_recent.c
+modl-$(CONFIG_MATCH_RPFILTER) += libxt_rpfilter.c
+modl-$(CONFIG_MATCH_SCTP) += libxt_sctp.c
+modl-$(CONFIG_MATCH_SET) += libxt_set.c
+modl-$(CONFIG_MATCH_SOCKET) += libxt_socket.c
+modl-$(CONFIG_MATCH_STANDARD) += libxt_standard.c
+modl-$(CONFIG_MATCH_STATISTIC) += libxt_statistic.c
+modl-$(CONFIG_MATCH_STRING) += libxt_string.c
+modl-$(CONFIG_MATCH_TCP) += libxt_tcp.c
+modl-$(CONFIG_MATCH_TCPMSS) += libxt_tcpmss.c
+modl-$(CONFIG_MATCH_TIME) += libxt_time.c
+modl-$(CONFIG_MATCH_TOS) += libxt_tos.c
+modl-$(CONFIG_MATCH_U32) += libxt_u32.c
+modl-$(CONFIG_MATCH_UDP) += libxt_udp.c
+
+modl-$(CONFIG_TARGET_AUDIT) += libxt_AUDIT.c
+modl-$(CONFIG_TARGET_CHECKSUM) += libxt_CHECKSUM.c
+modl-$(CONFIG_TARGET_CLASSIFY) += libxt_CLASSIFY.c
+modl-$(CONFIG_TARGET_CONNMARK) += libxt_CONNMARK.c
+modl-$(CONFIG_TARGET_CONNSECMARK) += libxt_CONNSECMARK.c
+modl-$(CONFIG_TARGET_CT) += libxt_CT.c
+modl-$(CONFIG_TARGET_DSCP) += libxt_DSCP.c
+modl-$(CONFIG_TARGET_HMARK) += libxt_HMARK.c
+modl-$(CONFIG_TARGET_IDLETIMER) += libxt_IDLETIMER.c
+modl-$(CONFIG_TARGET_LED) += libxt_LED.c
+modl-$(CONFIG_TARGET_MARK) += libxt_MARK.c
+modl-$(CONFIG_TARGET_NFLOG) += libxt_NFLOG.c
+modl-$(CONFIG_TARGET_NFQUEUE) += libxt_NFQUEUE.c
+modl-$(CONFIG_TARGET_RATEEST) += libxt_RATEEST.c
+modl-$(CONFIG_TARGET_SECMARK) += libxt_SECMARK.c
+modl-$(CONFIG_TARGET_SET) += libxt_SET.c
+modl-$(CONFIG_TARGET_SYNPROXY) += libxt_SYNPROXY.c
+modl-$(CONFIG_TARGET_TCPMSS) += libxt_TCPMSS.c
+modl-$(CONFIG_TARGET_TCPOPTSTRIP) += libxt_TCPOPTSTRIP.c
+modl-$(CONFIG_TARGET_TEE) += libxt_TEE.c
+modl-$(CONFIG_TARGET_TOS) += libxt_TOS.c
+modl-$(CONFIG_TARGET_TPROXY) += libxt_TPROXY.c
+modl-$(CONFIG_TARGET_TRACE) += libxt_TRACE.c
+
+#
+# ipv4
+#
+mod4l-$(CONFIG_MATCH_AH) += libipt_ah.c
+mod4l-$(CONFIG_MATCH_ICMP) += libipt_icmp.c
+mod4l-$(CONFIG_MATCH_REALM) += libipt_realm.c
+mod4l-$(CONFIG_MATCH_TTL) += libipt_ttl.c
+mod4l-$(CONFIG_MATCH_UNCLEAN) += libipt_unclean.c
+
+mod4l-$(CONFIG_TARGET_CLUSTERIP) += libipt_CLUSTERIP.c
+mod4l-$(CONFIG_TARGET_DNAT) += libipt_DNAT.c
+mod4l-$(CONFIG_TARGET_ECN) += libipt_ECN.c
+mod4l-$(CONFIG_TARGET_LOG) += libipt_LOG.c
+mod4l-$(CONFIG_TARGET_MASQUERADE) += libipt_MASQUERADE.c
+mod4l-$(CONFIG_TARGET_MIRROR) += libipt_MIRROR.c
+mod4l-$(CONFIG_TARGET_NETMAP) += libipt_NETMAP.c
+mod4l-$(CONFIG_TARGET_REDIRECT) += libipt_REDIRECT.c
+mod4l-$(CONFIG_TARGET_REJECT) += libipt_REJECT.c
+mod4l-$(CONFIG_TARGET_SAME) += libipt_SAME.c
+mod4l-$(CONFIG_TARGET_SNAT) += libipt_SNAT.c
+mod4l-$(CONFIG_TARGET_TTL) += libipt_TTL.c
+mod4l-$(CONFIG_TARGET_ULOG) += libipt_ULOG.c
+
+
+#
+# ipv6
+#
+mod6l-$(CONFIG_MATCH6_AH) += libip6t_ah.c
+mod6l-$(CONFIG_MATCH6_DST) += libip6t_dst.c
+mod6l-$(CONFIG_MATCH6_EUI64) += libip6t_eui64.c
+mod6l-$(CONFIG_MATCH6_FRAG) += libip6t_frag.c
+mod6l-$(CONFIG_MATCH6_HBH) += libip6t_hbh.c
+mod6l-$(CONFIG_MATCH6_HL) += libip6t_hl.c
+mod6l-$(CONFIG_MATCH6_ICMP6) += libip6t_icmp6.c
+mod6l-$(CONFIG_MATCH6_IPV6HEADER) += libip6t_ipv6header.c
+mod6l-$(CONFIG_MATCH6_MH) += libip6t_mh.c
+mod6l-$(CONFIG_MATCH6_RT) += libip6t_rt.c
+
+mod6l-$(CONFIG_TARGET6_DNAT) += libip6t_DNAT.c
+mod6l-$(CONFIG_TARGET6_DNPT) += libip6t_DNPT.c
+mod6l-$(CONFIG_TARGET6_HL) += libip6t_HL.c
+mod6l-$(CONFIG_TARGET6_LOG) += libip6t_LOG.c
+mod6l-$(CONFIG_TARGET6_MASQUERADE) += libip6t_MASQUERADE.c
+mod6l-$(CONFIG_TARGET6_NETMAP) += libip6t_NETMAP.c
+mod6l-$(CONFIG_TARGET6_REDIRECT) += libip6t_REDIRECT.c
+mod6l-$(CONFIG_TARGET6_REJECT) += libip6t_REJECT.c
+mod6l-$(CONFIG_TARGET6_SNAT) += libip6t_SNAT.c
+mod6l-$(CONFIG_TARGET6_SNPT) += libip6t_SNPT.c
+
+
+pfx_build_mod := $(patsubst libxt_%.c,%,$(modl-y))
 pfx_symlinks  := NOTRACK state
-@ENABLE_IPV4_TRUE@ pf4_build_mod := $(patsubst ${srcdir}/libipt_%.c,%,$(sort $(wildcard ${srcdir}/libipt_*.c)))
-@ENABLE_IPV6_TRUE@ pf6_build_mod := $(patsubst ${srcdir}/libip6t_%.c,%,$(sort $(wildcard ${srcdir}/libip6t_*.c)))
+@ENABLE_IPV4_TRUE@ pf4_build_mod := $(patsubst libipt_%.c,%,$(mod4l-y))
+@ENABLE_IPV6_TRUE@ pf6_build_mod := $(patsubst libip6t_%.c,%,$(mod6l-y))
 pfx_build_mod := $(filter-out @blacklist_modules@,${pfx_build_mod})
 pf4_build_mod := $(filter-out @blacklist_modules@,${pf4_build_mod})
 pf6_build_mod := $(filter-out @blacklist_modules@,${pf6_build_mod})