Xtables-addons 1.41

References: http://comments.gmane.org/gmane.comp.security.firewalls.netfilter.general/42337

.gitignore

@@ -2,9 +2,9 @@
 *.lo
 *.loT
 *.o
-.deps
+.deps/
 .dirstamp
-.libs
+.libs/
 Makefile
 Makefile.in
 
@@ -17,14 +17,10 @@ Makefile.in
 /targets.man
 
 /aclocal.m4
-/autom4te*.cache
-/compile
+/autom4te.cache/
+/build-aux/
 /config.*
 /configure
-/depcomp
-/install-sh
 /libtool
-/ltmain.sh
-/missing
 /stamp-h1
 /xtables-addons.8

INSTALL

@@ -22,14 +22,12 @@ Supported configurations for this release
 	  - CONFIG_CONNECTOR y/m if you wish to receive userspace
 	    notifications from pknock through netlink/connector
 
-Compilation of ipset-genl-6.x is enabled by default. This additionally
-requires
+Compilation of ipset-genl-6.x is disabled by default. It has
+additional requirements.
 
 	* libmnl
 	* Linux kernel >= 2.6.35
 
-so if you do not have these, turn it off in mconfig before compilation.
-
 
 Selecting extensions
 ====================
@@ -43,6 +41,10 @@ Configuring and compiling
 
 ./configure [options]
 
+--without-kbuild
+
+	Deactivate building kernel modules, and just do userspace parts.
+
 --with-kbuild=
 
 	Specifies the path to the kernel build output directory. We need

README

@@ -18,8 +18,7 @@ simplified, and sped up.
 
 Included in this package
 ========================
-- ipset 4.5
-- ipset 6.7-genl
+- ipset 6.10-genl
 - xt_ACCOUNT 1.16, libxt_ACCOUNT 1.3
 
 

configure.ac

@@ -1,4 +1,5 @@
-AC_INIT([xtables-addons], [1.40])
+AC_INIT([xtables-addons], [1.41])
+AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
 AC_PROG_INSTALL
@@ -10,7 +11,9 @@ AC_PROG_LIBTOOL
 
 AC_ARG_WITH([kbuild],
 	AS_HELP_STRING([--with-kbuild=PATH],
-	[Path to kernel build directory [[/lib/modules/CURRENT/build]]]),
+	[Path to kernel build directory [[/lib/modules/CURRENT/build]]])
+AS_HELP_STRING([--without-kbuild],
+	[Build only userspace tools]),
 	[kbuilddir="$withval"],
 	[kbuilddir="/lib/modules/$(uname -r)/build"])
 #
@@ -60,7 +63,7 @@ if test -n "$kbuilddir"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 1; then
+		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 2; then
 			echo "WARNING: You are trying a newer kernel. Results may vary. :-)";
 		elif test "$kmajor" -eq 3; then
 			:;

doc/changelog.txt

@@ -3,6 +3,16 @@ HEAD
 ====
 
 
+v1.41 (2012-01-04)
+==================
+Changes:
+- Deactivate build of ipset-genl by default.
+  I think the original ipset package can now take over, given there are
+  a handful of kernels (2.6.39 onwards) that do not need patching.
+Enhancements:
+- Support for Linux 3.2
+
+
 v1.40 (2011-11-30)
 ==================
 Fixes:

extensions/.gitignore

@@ -1,6 +1,6 @@
 .*.cmd
 .*.d
-.tmp_versions
+.tmp_versions/
 *.ko
 *.mod.c
 Module.markers

extensions/compat_xtables.c

@@ -8,7 +8,9 @@
  */
 #include <linux/ip.h>
 #include <linux/kernel.h>
+#include <linux/kmod.h>
 #include <linux/list.h>
+#include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/version.h>
@@ -17,6 +19,9 @@
 #include <linux/netfilter_arp.h>
 #include <net/ip.h>
 #include <net/route.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+#	include <linux/export.h>
+#endif
 #include "compat_skbuff.h"
 #include "compat_xtnu.h"
 

extensions/compat_xtables.h

@@ -92,6 +92,12 @@
 #	define rt_dst(rt)	(&(rt)->u.dst)
 #endif
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0)
+#	define nf_nat_ipv4_multi_range_compat nf_nat_multi_range_compat
+#	define nf_nat_ipv4_range nf_nat_range
+#	define NF_NAT_RANGE_MAP_IPS IP_NAT_RANGE_MAP_IPS
+#endif
+
 #if !defined(NIP6) && !defined(NIP6_FMT)
 #	define NIP6(addr) \
 		ntohs((addr).s6_addr16[0]), \

extensions/ipset-6/ip_set_getport.c

@@ -12,6 +12,7 @@
 #include <linux/icmp.h>
 #include <linux/icmpv6.h>
 #include <linux/sctp.h>
+#include <linux/version.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -115,9 +116,14 @@ ip_set_get_ip6_port(const struct sk_buff *skb, bool src,
 {
 	int protoff;
 	u8 nexthdr;
+	__be16 frag_off;
 
 	nexthdr = ipv6_hdr(skb)->nexthdr;
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 2, 0)
 	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
+#else
+	protoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, &frag_off);
+#endif
 	if (protoff < 0)
 		return false;
 

extensions/ipset-6/ip_set_hash_ip.c

@@ -241,7 +241,7 @@ hash_ip6_data_isnull(const struct hash_ip6_elem *elem)
 static inline void
 hash_ip6_data_copy(struct hash_ip6_elem *dst, const struct hash_ip6_elem *src)
 {
-	ipv6_addr_copy(&dst->ip.in6, &src->ip.in6);
+	dst->ip.in6 = src->ip.in6;
 }
 
 static inline void

extensions/ipset-6/ip_set_hash_net.c

@@ -267,7 +267,7 @@ static inline void
 hash_net6_data_copy(struct hash_net6_elem *dst,
 		    const struct hash_net6_elem *src)
 {
-	ipv6_addr_copy(&dst->ip.in6, &src->ip.in6);
+	dst->ip.in6 = src->ip.in6;
 	dst->cidr = src->cidr;
 }
 

extensions/xt_DNETMAP.c

@@ -31,8 +31,13 @@
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #endif
-#include "xt_DNETMAP.h"
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0)
+#	include <net/netfilter/nf_nat.h>
+#else
+#	include <linux/netfilter/nf_nat.h>
+#endif
 #include "compat_xtables.h"
+#include "xt_DNETMAP.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Marek Kierdelewicz <marek@koba.pl>");
@@ -77,7 +82,7 @@ struct dnetmap_entry {
 };
 
 struct dnetmap_prefix {
-	struct nf_nat_multi_range_compat prefix;
+	struct nf_nat_ipv4_multi_range_compat prefix;
 	char prefix_str[16];
 	struct list_head list;
 	unsigned int refcnt;
@@ -154,7 +159,7 @@ dnetmap_entry_rlookup(struct dnetmap_net *dnetmap_net, const __be32 addr)
 
 static struct dnetmap_prefix *
 dnetmap_prefix_lookup(struct dnetmap_net *dnetmap_net,
-		      const struct nf_nat_multi_range_compat *mr)
+		      const struct nf_nat_ipv4_multi_range_compat *mr)
 {
 	struct dnetmap_prefix *p;
 
@@ -194,7 +199,7 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(par->net);
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
-	const struct nf_nat_multi_range_compat *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
 	struct dnetmap_prefix *p;
 	struct dnetmap_entry *e;
 #ifdef CONFIG_PROC_FS
@@ -213,7 +218,7 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 		return ret;
 	}
 
-	if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
+	if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
 		pr_debug("DNETMAP:check: bad MAP_IPS.\n");
 		return -EINVAL;
 	}
@@ -316,8 +321,8 @@ dnetmap_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 	enum ip_conntrack_info ctinfo;
 	__be32 prenat_ip, postnat_ip, prenat_ip_prev;
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
-	const struct nf_nat_multi_range_compat *mr = &tginfo->prefix;
-	struct nf_nat_range newrange;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
+	struct nf_nat_ipv4_range newrange;
 	struct dnetmap_entry *e;
 	struct dnetmap_prefix *p;
 	__s32 jttl;
@@ -354,8 +359,8 @@ dnetmap_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 
 		spin_unlock_bh(&dnetmap_lock);
 
-		newrange = ((struct nf_nat_range) {
-			    mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
+		newrange = ((struct nf_nat_ipv4_range) {
+			    mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
 			    e->prenat_addr, e->prenat_addr,
 			    mr->range[0].min, mr->range[0].max});
 
@@ -440,8 +445,8 @@ bind_new_prefix:
 
 	spin_unlock_bh(&dnetmap_lock);
 
-	newrange = ((struct nf_nat_range) {
-		    mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
+	newrange = ((struct nf_nat_ipv4_range) {
+		    mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
 		    postnat_ip, postnat_ip,
 		    mr->range[0].min, mr->range[0].max});
 
@@ -459,7 +464,7 @@ static void dnetmap_tg_destroy(const struct xt_tgdtor_param *par)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(par->net);
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
-	const struct nf_nat_multi_range_compat *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
 	struct dnetmap_prefix *p;
 #ifdef CONFIG_PROC_FS
 	char str[25];

extensions/xt_DNETMAP.h

@@ -8,7 +8,11 @@ enum {
 };
 
 struct xt_DNETMAP_tginfo {
+#ifdef __KERNEL__
+	struct nf_nat_ipv4_multi_range_compat prefix;
+#else
 	struct nf_nat_multi_range_compat prefix;
+#endif
 	__u8 flags;
 	__s16 ttl;
 };

extensions/xt_STEAL.c

@@ -3,6 +3,7 @@
  *	written by Jan Engelhardt <jengelh [at] medozas de>, 2008 - 2009
  *	placed in the Public Domain
  */
+#include <linux/module.h>
 #include <linux/netfilter.h>
 #include <linux/skbuff.h>
 #include "compat_xtables.h"

extensions/xt_quota2.c

@@ -12,6 +12,7 @@
  *	version 2, as published by the Free Software Foundation.
  */
 #include <linux/list.h>
+#include <linux/module.h>
 #include <linux/proc_fs.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>

mconfig

@@ -20,7 +20,7 @@ build_geoip=m
 build_gradm=m
 build_iface=m
 build_ipp2p=m
-build_ipset6=m
+build_ipset6=
 build_ipv4options=m
 build_length2=m
 build_lscan=m

xtables-addons.8.in

@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "v1.40 (2011-11-30)" "" "v1.40 (2011-11-30)"
+.TH xtables-addons 8 "v1.41 (2012-01-04)" "" "v1.41 (2012-01-04)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets