
The unclean match allows you to do very detailed checks on every bit of
of the packet header.   It is present in the 2.4.x kernels and was removed
before 2.6.x was released since it is considered to be a very harmful and
potentially future-incompatible way of doing packet filtering.

So in order to prevent stuff like the ECN blackholes from happening again,
we moved it into patch-o-matic-ng, where lots of other potentially harmful
code resides ;)

