I've spent the last few days learning how to apply this patch to openwrt, only to later find out it will not work on connections to localhost.  That fact asside, someone might have a use for this functionality in openwrt, so I am posting my notes here.  Perhaps this will save someone some time.

The cttproxy patch can be found here: http://www.balabit.com/products/oss/tproxy/

NOTE: the stock patch did require a little tweaking to apply correctly: 

The following sections in the iptables patch:

line 131:

+struct iptables_target tproxy
+= { .next = NULL,
+    .name = "TPROXY",
+    .version = IPTABLES_VERSION,
+    .size = IPT_ALIGN(sizeof(struct ipt_tproxy_target_info)),
+    .userspacesize = IPT_ALIGN(sizeof(struct ipt_tproxy_target_info)),
+    .help = &help,
+    .init = &init,
+    .parse = &parse,
+    .final_check = &final_check,
+    .print = &print,
+    .save &save,
+    .extra_opts = opts
+};

line 212:

+struct iptables_match tproxy
+= { .next = NULL,
+    .name = "tproxy",
+    .version = IPTABLES_VERSION,
+    .size = 0, 
+    .userspacesize = 0, 
+    .help = &help,
+    .init = &init,
+    .parse = &parse,
+    .final_check = &final_check,
+    .print = &print,
+    .save = &save,
+    .extra_opts = opts
+};

The following section in tcp_window_tracking.diff
dump_packet call on line 1986

+    spin_lock_bh(&log_lock);
+    printk(KERN_WARNING "%s", prefix);
+    dump_packet(&loginfo, ipv6h, len, 1);
+    printk("\n");
+    spin_unlock_bh(&log_lock);

NOTE: please see buildroot/buildroot-documentation.html

- unbzip/untar experimental
- cd buildroot
- put kernel patches into buildroot/package/linux/kernel-patches
  + rename as necessary to match numbering scheme
- update buildroot/package/linux/linux.conf as needed

CONFIG_IP_NF_NAT_NRES=y
CONFIG_IP_NF_TPROXY=y
CONFIG_IP_NF_TARGET_TPROXY=y
CONFIG_IP_NF_MATCH_TPROXY=y

- put iptables patches into buildroot/package/iptables*/patches
  + Update [buildroot]/package/iptables/Makefile with chmod command:

$(PKG_BUILD_DIR)/.patched: $(DL_DIR)/$(PKG_SOURCE_FILE)
        mkdir -p $(PKG_BUILD_DIR)/modules
        $(PKG_SOURCE_CAT) $(DL_DIR)/$(PKG_SOURCE_FILE) | tar -C $(BUILD_DIR) $(TAR_OPTIONS) -
        $(PATCH) $(PKG_BUILD_DIR) ./patches
        chmod 755 $(PKG_BUILD_DIR)/extensions/.tproxy-test
        touch $(PKG_BUILD_DIR)/.patched

+ to include iptables modules in firmware, modify [buildroot]/packages/iptables/kernelconfig.mk

ext-$(CONFIG_IP_NF_TARGET_TPROXY) += TPROXY
ext-$(CONFIG_IP_NF_MATCH_TPROXY) += tproxy

- Use 'make menuconfig' to configure build
  + you must have make v 3.80 or higher
  + leave telnet enabled for 'failsafe' mode
- use make to build a patched firmware

make | tee build.log

- flash the new firmware:

chmod u+x [path_to_buildroot]/scripts/flash.sh
cd [path_to_buildroot]/bin
../scripts/flash.sh openwrt-wrt54gs-squashfs.bin linksys