Xtables-addons 1.43

xt_DNETMAP.c: In function 'dnetmap_tg_proc_write':
xt_DNETMAP.c:703:3: error: implicit declaration of function 'in4_pton'
[-Werror=implicit-function-declaration]

INSTALL

@@ -14,7 +14,7 @@ Supported configurations for this release
 
 	* iptables >= 1.4.5
 
-	* kernel-source >= 2.6.29
+	* kernel-devel >= 2.6.32
 	  with prepared build/output directory
 	  - CONFIG_NF_CONNTRACK or CONFIG_IP_NF_CONNTRACK
 	  - CONFIG_NF_CONNTRACK_MARK or CONFIG_IP_NF_CONNTRACK_MARK

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([xtables-addons], [1.42])
+AC_INIT([xtables-addons], [1.43])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -6,6 +6,7 @@ AC_PROG_INSTALL
 AM_INIT_AUTOMAKE([1.10b -Wall foreign subdir-objects])
 AC_PROG_CC
 AM_PROG_CC_C_O
+m4_ifdef([AM_PROG_AR], [AM_PROG_AR])
 AC_DISABLE_STATIC
 AC_PROG_LIBTOOL
 

doc/changelog.txt

@@ -3,6 +3,19 @@ HEAD
 ====
 
 
+v1.43 (2012-06-30)
+==================
+Fixes:
+- xt_psd: avoid crash due to curr->next corruption
+Changes:
+- xt_psd: reject invalid match options
+Enhancements:
+- Support for Linux 3.5
+- DNETMAP: new type: static binding
+- DNETMAP: new persistent flag option for prefix
+- DNETMAP: add write support to procfs interface
+
+
 v1.42 (2012-04-05)
 ==================
 Fixes:

extensions/Kbuild

@@ -11,7 +11,9 @@ obj-${build_CHECKSUM}    += xt_CHECKSUM.o
 obj-${build_DELUDE}      += xt_DELUDE.o
 obj-${build_DHCPMAC}     += xt_DHCPMAC.o
 obj-${build_DNETMAP}     += xt_DNETMAP.o
+ifeq (${VERSION},3)
 obj-${build_ECHO}        += xt_ECHO.o
+endif
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
 obj-${build_RAWNAT}      += xt_RAWNAT.o iptable_rawpost.o

extensions/compat_xtables.c

@@ -16,6 +16,7 @@
 #include <linux/version.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter_arp.h>
 #include <net/ip.h>
 #include <net/route.h>
@@ -612,4 +613,12 @@ void *HX_memmem(const void *space, size_t spacesize,
 }
 EXPORT_SYMBOL_GPL(HX_memmem);
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0)
+int xtnu_ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+    int target, unsigned short *fragoff, int *fragflg)
+{
+	return ipv6_find_hdr(skb, offset, target, fragoff);
+}
+#endif
+
 MODULE_LICENSE("GPL");

extensions/compat_xtables.h

@@ -119,6 +119,10 @@
 #	define NIPQUAD_FMT "%u.%u.%u.%u"
 #endif
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0)
+#	define ipv6_find_hdr xtnu_ipv6_find_hdr
+#endif
+
 #define ip_route_me_harder    xtnu_ip_route_me_harder
 #define skb_make_writable     xtnu_skb_make_writable
 #define xt_target             xtnu_target

extensions/compat_xtnu.h

@@ -162,6 +162,8 @@ extern void xtnu_csum_replace4(__u16 __bitwise *, __be32, __be32);
 extern void xtnu_proto_csum_replace4(__u16 __bitwise *, struct sk_buff *,
 	__be32, __be32, bool);
 extern int xtnu_skb_linearize(struct sk_buff *);
+extern int xtnu_ipv6_find_hdr(const struct sk_buff *, unsigned int *,
+	int, unsigned short *, int *);
 
 extern void *HX_memmem(const void *, size_t, const void *, size_t);
 

extensions/libxt_DNETMAP.c

@@ -20,6 +20,8 @@ static const struct option DNETMAP_opts[] = {
 	{"prefix", 1, NULL, 'p'},
 	{"reuse", 0, NULL, 'r'},
 	{"ttl", 1, NULL, 't'},
+	{"static", 0, NULL, 's'},
+	{"persistent", 0, NULL, 'e'},
 	{.name = NULL}
 };
 
@@ -33,9 +35,14 @@ static void DNETMAP_help(void)
 	       "  --%s seconds\n"
 	       "    Regenerate bindings ttl value to seconds. If negative value is specified,\n"
 	       "    bindings ttl is kept unchanged. If not specified then default ttl value (600s)\n"
-	       "    is used.\n\n",
+		"    is used\n"
-	       DNETMAP_opts[0].name, DNETMAP_opts[1].name,
+		"  --%s\n"
-	       DNETMAP_opts[2].name);
+		"    Match only static entries for this rule. Dynamic entries won't be created.\n"
+		"  --%s\n"
+		"    Set prefix persistent. It won't be removed after deleting last iptables rule.\n\n",
+		DNETMAP_opts[0].name, DNETMAP_opts[1].name,
+		DNETMAP_opts[2].name, DNETMAP_opts[3].name,
+		DNETMAP_opts[4].name);
 }
 
 static u_int32_t bits2netmask(int bits)
@@ -151,6 +158,20 @@ static int DNETMAP_parse(int c, char **argv, int invert, unsigned int *flags,
 		*flags |= XT_DNETMAP_REUSE;
 		tginfo->flags |= XT_DNETMAP_REUSE;
 		return 1;
+	case 's':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--static",
+				  *flags & XT_DNETMAP_STATIC);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--static", invert);
+		*flags |= XT_DNETMAP_STATIC;
+		tginfo->flags |= XT_DNETMAP_STATIC;
+		return 1;
+	case 'e':
+		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--persistent",
+				  *flags & XT_DNETMAP_PERSISTENT);
+		xtables_param_act(XTF_NO_INVERT, MODULENAME, "--persistent", invert);
+		*flags |= XT_DNETMAP_PERSISTENT;
+		tginfo->flags |= XT_DNETMAP_PERSISTENT;
+		return 1;
 	case 't':
 		xtables_param_act(XTF_ONLY_ONCE, MODULENAME, "--ttl",
 				  *flags & XT_DNETMAP_TTL);
@@ -198,7 +219,15 @@ static void DNETMAP_print(const void *ip, const struct xt_entry_target *target,
 	else
 		printf("any");
 
-	printf(" reuse %i", (*flags & XT_DNETMAP_REUSE) > 0);
+	if (*flags & XT_DNETMAP_REUSE)
+		printf(" reuse");
+
+	if (*flags & XT_DNETMAP_STATIC)
+		printf(" static");
+
+	if (*flags & XT_DNETMAP_PERSISTENT)
+		printf(" persistent");
+
 	if (*flags & XT_DNETMAP_TTL)
 		printf(" ttl %i", tginfo->ttl);
 	else
@@ -214,7 +243,15 @@ static void DNETMAP_save(const void *ip, const struct xt_entry_target *target)
 		printf(" --%s ", DNETMAP_opts[0].name);
 		DNETMAP_print_addr(ip, target, 0);
 	}
-	printf(" --reuse %i ", *flags & XT_DNETMAP_REUSE);
+
+	if (*flags & XT_DNETMAP_REUSE)
+		printf(" --reuse ");
+
+	if (*flags & XT_DNETMAP_STATIC)
+		printf(" --static ");
+
+	if (*flags & XT_DNETMAP_PERSISTENT)
+		printf(" --persistent ");
 
 	/* ommited because default value can change as kernel mod param */
 	if (*flags & XT_DNETMAP_TTL)

extensions/libxt_DNETMAP.man

@@ -18,6 +18,17 @@ Network subnet to map to. If not specified, all existing prefixes are used.
 \fB\-\-reuse\fR
 Reuse entry for given prenat-ip from any prefix despite bindings ttl < 0.
 .TP
+\fB\-\-persistent\fR
+Set prefix persistent. It won't be removed after deleting last iptables rule.
+Option is effective only in the first rule for a given prefix. If you
+need to change persistency for existing prefix, please use proc interface
+described below.
+.TP
+\fB\-\-static\fR
+Don't create dynamic mappings using this rule. Use static mappings only. Note
+that you need to create static mappings via proc interface for this rule with
+this option to have any effect.
+.TP
 \fB\-\-ttl\fR \fIseconds\fR
 Regenerate bindings ttl value to \fIseconds\fR. If negative value is specified,
 bindings ttl is kept unchanged. If not specified then default ttl value (600s)
@@ -30,16 +41,45 @@ Module creates following entries for each new specified subnet:
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR
 Contains binding table for subnet/mask. Each line contains \fBprenat-ip\fR,
 \fBpostnat-ip\fR,\fBttl\fR (seconds till entry times out), \fBlasthit\fR (last
-entry hit in seconds relative to system boot time).
+entry hit in seconds relative to system boot time). Please note that \fBttl\fR
+and \fBlasthit\fR entries contain \fBS\fR in case of static binding.
 .TP
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
-Contains statistics for given subnet/mask. Line contains contains three
+Contains statistics for given subnet/mask. Line contains contains four
 numerical values separated by spaces. First one is number of currently used
-addresses (bindings with negative ttl excluded), second one is number of all
+dynamic addresses (bindings with negative ttl excluded), second one is number
-usable addresses in subnet and third one is mean \fBttl\fR value for all active
+static assignments, third one is number of all usable addresses in subnet and
-entries.
+the fourth one is mean \fBttl\fR value for all active entries. If prefix has
+persistent flag set it'll be noted as fifth entry.
+.PP
+Following write operations are supported via proc interface:
+.TP
+echo "+\fIprenatIP\fR:\fIpostnatIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Adds static binding between prenatIP nad postnatIP. If postnatIP is already
+bound, previous binding will be timedout immediatelly. Static binding is never
+timedout.
+.TP
+echo "-\fIIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Removes binding with \fIIP\fR as prenat or postnat address. If removed binding
+is currently static, it'll make entry available for dynamic allocation.
+.TP
+echo "+persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Sets persistent flag for prefix. It's usefull if you don't want bindings to get
+flushed when firewall is restarted. You can check if prefix is persistent by
+printing \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
+contents.
+.TP
+echo "-persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Unsets persistent flag for prefix. In this mode prefix will be deleted if the
+last iptables rule for that prefix is removed.
+.TP
+echo "flush" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
+Flushes all bindings for specific prefix. All static entries are also flushed
+and are available for dynamic bindings.
+.PP
+Note! Entries are removed if the last iptables rule for a specific prefix is
+deleted unless there's persistent flag set.
 .PP
-Entries are removed if the last iptables rule for a specific subnet is deleted.
 
 \fB* Logging\fR
 
@@ -88,4 +128,45 @@ specify \fB\-\-prefix\fR parameter in PREROUTING rule, because this way it DNATs
 traffic to all active prefixes. You could specify prefix it you'd like to make
 DNAT work for specific prefix only.
 
+\fB4.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 with static assignments only:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+--static
+
+echo "+192.168.0.10:20.0.0.1" > /proc/net/xt_DNETMAP/20.0.0.0_26
+.br
+echo "+192.168.0.11:20.0.0.2" > /proc/net/xt_DNETMAP/20.0.0.0_26
+.br
+echo "+192.168.0.51:20.0.0.3" > /proc/net/xt_DNETMAP/20.0.0.0_26
+
+This configuration will allow only preconfigured static bindings to work due to
+\fBstatic\fR rule option. Without this flag dynamic bindings would be created
+using non-static entries.
+
+\fB5.\fR Persistent prefix:
+
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+--persistent
+.br
+\fBor\fR
+.br
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
+.br
+echo "+persistent" > /proc/net/xt_DNETMAP/20.0.0.0_26
+
+Now we can check persistent flag of the prefix:
+.br
+cat /proc/net/xt_DNETMAP/20.0.0.0_26
+.br
+0 0 64 0 \fBpersistent\fR
+
+Flush iptables nat table and see that prefix is still in existence:
+.br
+iptables -F -t nat
+.br
+ls -l /proc/net/xt_DNETMAP
+.br
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26
+.br
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26_stat
 .

extensions/libxt_psd.c

@@ -30,6 +30,8 @@
 #include "xt_psd.h"
 #include "compat_user.h"
 
+#define SCAN_DELAY_THRESHOLD		300
+
 /* Function which prints out usage message. */
 static void psd_mt_help(void) {
 	printf(
@@ -137,19 +139,19 @@ static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
 }
 
 static struct xtables_match psd_mt_reg = {
-	.name			= "psd",
+	.name           = "psd",
-	.version		= XTABLES_VERSION,
+	.version        = XTABLES_VERSION,
-	.revision   	= 1,
+	.revision       = 1,
-	.family        = NFPROTO_IPV4,
+	.family         = NFPROTO_IPV4,
-	.size			= XT_ALIGN(sizeof(struct xt_psd_info)),
+	.size           = XT_ALIGN(sizeof(struct xt_psd_info)),
 	.userspacesize	= XT_ALIGN(sizeof(struct xt_psd_info)),
-	.help			= psd_mt_help,
+	.help           = psd_mt_help,
-	.init			= psd_mt_init,
+	.init           = psd_mt_init,
-	.parse			= psd_mt_parse,
+	.parse          = psd_mt_parse,
-	.final_check	= psd_mt_final_check,
+	.final_check    = psd_mt_final_check,
-	.print			= psd_mt_print,
+	.print          = psd_mt_print,
-	.save			= psd_mt_save,
+	.save           = psd_mt_save,
-	.extra_opts		= psd_mt_opts,
+	.extra_opts     = psd_mt_opts,
 };
 
 static __attribute__((constructor)) void psd_mt_ldr(void)

extensions/xt_DNETMAP.c

@@ -3,7 +3,7 @@
  * or destination (PREROUTING),
  */
 
-/* (C) 2011 Marek Kierdelewicz <marek@koba.pl>
+/* (C) 2012 Marek Kierdelewicz <marek@koba.pl>
  *
  * module is dedicated to my wife Eliza and my daughters Jula and Ola :* :* :*
  *
@@ -19,6 +19,7 @@
  */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/inet.h>
 #include <linux/ip.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
@@ -40,7 +41,7 @@
 #include "xt_DNETMAP.h"
 
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Marek Kierdelewicz <marek@koba.pl>");
+MODULE_AUTHOR("Marek Kierdelewicz <marek@piasta.pl>");
 MODULE_DESCRIPTION(
 	"Xtables: dynamic two-way 1:1 NAT mapping of IPv4 addresses");
 MODULE_ALIAS("ipt_DNETMAP");
@@ -77,6 +78,7 @@ struct dnetmap_entry {
 	struct list_head lru_list;
 	__be32 prenat_addr;
 	__be32 postnat_addr;
+	__u8 flags;
 	unsigned long stamp;
 	struct dnetmap_prefix *prefix;
 };
@@ -84,12 +86,18 @@ struct dnetmap_entry {
 struct dnetmap_prefix {
 	struct nf_nat_ipv4_multi_range_compat prefix;
 	char prefix_str[16];
-	struct list_head list;
+#ifdef CONFIG_PROC_FS
+	char proc_str_data[20];
+	char proc_str_stat[25];
+#endif
+	struct list_head elist; // element list head
+	struct list_head list;	// prefix list
+	__u8 flags;
 	unsigned int refcnt;
 	/* lru entry list */
 	struct list_head lru_list;
-	/* hash based on prenat-ips */
+	/* pointer do dnetmap_net */
-	struct list_head iphash[0];
+	struct dnetmap_net *dnetmap;
 };
 
 struct dnetmap_net {
@@ -157,6 +165,18 @@ dnetmap_entry_rlookup(struct dnetmap_net *dnetmap_net, const __be32 addr)
 	return NULL;
 }
 
+static int
+dnetmap_addr_in_prefix(struct dnetmap_net *dnetmap_net, const __be32 addr,
+	struct dnetmap_prefix *p)
+{
+	struct dnetmap_entry *e;
+
+	list_for_each_entry(e, &p->elist, list)
+		if (memcmp(&e->postnat_addr, &addr, sizeof(addr)) == 0)
+			return 1;
+	return 0;
+}
+
 static struct dnetmap_prefix *
 dnetmap_prefix_lookup(struct dnetmap_net *dnetmap_net,
 		      const struct nf_nat_ipv4_multi_range_compat *mr)
@@ -169,12 +189,47 @@ dnetmap_prefix_lookup(struct dnetmap_net *dnetmap_net,
 	return NULL;
 }
 
-static void dnetmap_prefix_flush(struct dnetmap_net *dnetmap_net,
+static void dnetmap_prefix_destroy(struct dnetmap_net *dnetmap_net,
 				 struct dnetmap_prefix *p)
 {
 	struct dnetmap_entry *e, *next;
 	unsigned int i;
 
+#ifdef CONFIG_PROC_FS
+	remove_proc_entry(p->proc_str_data, dnetmap_net->xt_dnetmap);
+	remove_proc_entry(p->proc_str_stat, dnetmap_net->xt_dnetmap);
+#endif
+
+	for (i = 0; i < hash_size; i++) {
+		list_for_each_entry_safe(e, next,
+					 &dnetmap_net->dnetmap_iphash[i], glist)
+			if (e->prefix == p)
+				list_del(&e->glist);
+
+		list_for_each_entry_safe(e, next,
+					 &dnetmap_net->
+					 dnetmap_iphash[hash_size + i], grlist)
+			if (e->prefix == p)
+				list_del(&e->grlist);
+	}
+
+	list_for_each_entry_safe(e, next, &p->elist, list) {
+		list_del(&e->list);
+		if(! (e->flags & XT_DNETMAP_STATIC)) list_del(&e->lru_list);
+		kfree(e);
+	}
+
+	list_del(&p->list);
+	kfree(p);
+}
+
+/* function clears bindings without destroying prefix */
+static void dnetmap_prefix_softflush(struct dnetmap_prefix *p)
+{
+	struct dnetmap_net *dnetmap_net = p->dnetmap;
+	struct dnetmap_entry *e, *next;
+	unsigned int i;
+
 	for (i = 0; i < hash_size; i++) {
 		list_for_each_entry_safe(e, next,
 					 &dnetmap_net->dnetmap_iphash[i], glist)
@@ -186,12 +241,16 @@ static void dnetmap_prefix_flush(struct dnetmap_net *dnetmap_net,
 					 dnetmap_iphash[hash_size + i], grlist)
 			if (e->prefix == p)
 				list_del(&e->grlist);
+	}
+	list_for_each_entry_safe(e, next, &p->elist, list) {
 
-		list_for_each_entry_safe(e, next, &p->iphash[i], list) {
+		/* make dynamic entry of any static entry */
-			list_del(&e->list);
+		if(e->flags & XT_DNETMAP_STATIC){
-			list_del(&e->lru_list);
+			list_add_tail(&e->lru_list, &p->lru_list);
-			kfree(e);
+			e->flags&=~XT_DNETMAP_STATIC;
 		}
+		e->stamp=jiffies-1;
+		e->prenat_addr=0;
 	}
 }
 
@@ -204,11 +263,8 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 	struct dnetmap_entry *e;
 #ifdef CONFIG_PROC_FS
 	struct proc_dir_entry *pde_data, *pde_stat;
-	char proc_str_data[20];
-	char proc_str_stat[25];
 #endif
 	int ret = -EINVAL;
-	int i;
 	__be32 a;
 	__u32 ip_min, ip_max, ip;
 
@@ -243,11 +299,13 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 		goto out;
 	}
 	p->refcnt = 1;
+	p->flags = 0;
+	p->flags |= (tginfo->flags & XT_DNETMAP_PERSISTENT);
+	p->dnetmap = dnetmap_net;
 	memcpy(&p->prefix, mr, sizeof(*mr));
 
 	INIT_LIST_HEAD(&p->lru_list);
-	for (i = 0; i < hash_size * 2; i++)
+	INIT_LIST_HEAD(&p->elist);
-		INIT_LIST_HEAD(&p->iphash[i]);
 
 	ip_min = ntohl(mr->range[0].min_ip) + (whole_prefix == 0);
 	ip_max = ntohl(mr->range[0].max_ip) - (whole_prefix == 0);
@@ -255,9 +313,9 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 	sprintf(p->prefix_str, NIPQUAD_FMT "/%u", NIPQUAD(mr->range[0].min_ip),
 		33 - ffs(~(ip_min ^ ip_max)));
 #ifdef CONFIG_PROC_FS
-	sprintf(proc_str_data, NIPQUAD_FMT "_%u", NIPQUAD(mr->range[0].min_ip),
+	sprintf(p->proc_str_data, NIPQUAD_FMT "_%u", NIPQUAD(mr->range[0].min_ip),
 		33 - ffs(~(ip_min ^ ip_max)));
-	sprintf(proc_str_stat, NIPQUAD_FMT "_%u_stat", NIPQUAD(mr->range[0].min_ip),
+	sprintf(p->proc_str_stat, NIPQUAD_FMT "_%u_stat", NIPQUAD(mr->range[0].min_ip),
 		33 - ffs(~(ip_min ^ ip_max)));
 #endif
 	printk(KERN_INFO KBUILD_MODNAME ": new prefix %s\n", p->prefix_str);
@@ -271,12 +329,14 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 		e->prenat_addr = 0;
 		e->stamp = jiffies;
 		e->prefix = p;
+		e->flags = 0;
 		list_add_tail(&e->lru_list, &p->lru_list);
+		list_add_tail(&e->list, &p->elist);
 	}
 
 #ifdef CONFIG_PROC_FS
 	/* data */
-	pde_data = proc_create_data(proc_str_data, proc_perms,
+	pde_data = proc_create_data(p->proc_str_data, proc_perms,
 				    dnetmap_net->xt_dnetmap,
 				    &dnetmap_tg_fops, p);
 	if (pde_data == NULL) {
@@ -288,7 +348,7 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 	pde_data->gid = proc_gid;
 
 	/* statistics */
-	pde_stat = create_proc_entry(proc_str_stat, proc_perms,
+	pde_stat = create_proc_entry(p->proc_str_stat, proc_perms,
 				     dnetmap_net->xt_dnetmap);
 	if (pde_stat == NULL) {
 		kfree(p);
@@ -351,7 +411,7 @@ dnetmap_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 			if (memcmp(mr, &e->prefix, sizeof(*mr)))
 				goto no_rev_map;
 		/* don't reset ttl if flag is set */
-		if (jttl >= 0) {
+		if (jttl >= 0 && (! (e->flags & XT_DNETMAP_STATIC) ) ) {
 			p = e->prefix;
 			e->stamp = jiffies + jttl;
 			list_move_tail(&e->lru_list, &p->lru_list);
@@ -378,17 +438,24 @@ dnetmap_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 
 	if (e == NULL) {	/* need for new binding */
 
+		// finish if it's static only rule
+		if(tginfo->flags & XT_DNETMAP_STATIC)
+			goto no_free_ip;
+
 bind_new_prefix:
 		e = list_entry(p->lru_list.next, struct dnetmap_entry,
 			       lru_list);
 		if (e->prenat_addr != 0 && time_before(jiffies, e->stamp)) {
-			if (!disable_log)
+			if (!disable_log && ! (p->flags & XT_DNETMAP_FULL) ){
 				printk(KERN_INFO KBUILD_MODNAME
 				       ": ip " NIPQUAD_FMT " - no free adresses in prefix %s\n",
 				       NIPQUAD(prenat_ip), p->prefix_str);
+				p->flags |= XT_DNETMAP_FULL;
+			}
 			goto no_free_ip;
 		}
 
+		p->flags &= ~XT_DNETMAP_FULL;
 		postnat_ip = e->postnat_addr;
 
 		if (e->prenat_addr != 0) {
@@ -397,7 +464,6 @@ bind_new_prefix:
 				printk(KERN_INFO KBUILD_MODNAME
 				       ": timeout binding " NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
 				       NIPQUAD(prenat_ip_prev), NIPQUAD(postnat_ip) );
-			list_del(&e->list);
 			list_del(&e->glist);
 			list_del(&e->grlist);
 		}
@@ -405,8 +471,6 @@ bind_new_prefix:
 		e->prenat_addr = prenat_ip;
 		e->stamp = jiffies + jttl;
 		list_move_tail(&e->lru_list, &p->lru_list);
-		list_add_tail(&e->list,
-			      &p->iphash[dnetmap_entry_hash(prenat_ip)]);
 		list_add_tail(&e->glist,
 			      &dnetmap_net->
 			      dnetmap_iphash[dnetmap_entry_hash(prenat_ip)]);
@@ -421,21 +485,21 @@ bind_new_prefix:
 
 	} else {
 
-		if (!(tginfo->flags & XT_DNETMAP_REUSE))
+		if (!(tginfo->flags & XT_DNETMAP_REUSE) && !(e->flags & XT_DNETMAP_STATIC))
 			if (time_before(e->stamp, jiffies) && p != e->prefix) {
 				if (!disable_log)
 					printk(KERN_INFO KBUILD_MODNAME
 					       ": timeout binding " NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
 					       NIPQUAD(e->prenat_addr),
 					       NIPQUAD(e->postnat_addr));
-				list_del(&e->list);
 				list_del(&e->glist);
 				list_del(&e->grlist);
 				e->prenat_addr = 0;
 				goto bind_new_prefix;
 			}
-		/* don't reset ttl if flag is set */
+		/* don't reset ttl if flag is set
-		if (jttl >= 0) {
+		or it is static entry*/
+		if (jttl >= 0 && ! (e->flags & XT_DNETMAP_STATIC) ) {
 			e->stamp = jiffies + jttl;
 			p = e->prefix;
 			list_move_tail(&e->lru_list, &p->lru_list);
@@ -466,32 +530,17 @@ static void dnetmap_tg_destroy(const struct xt_tgdtor_param *par)
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
 	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
 	struct dnetmap_prefix *p;
-#ifdef CONFIG_PROC_FS
-	char str[25];
-#endif
 
 	if (!(tginfo->flags & XT_DNETMAP_PREFIX))
 		return;
 
 	mutex_lock(&dnetmap_mutex);
+	spin_lock_bh(&dnetmap_lock);
 	p = dnetmap_prefix_lookup(dnetmap_net, mr);
-	if (--p->refcnt == 0) {
+	if (--p->refcnt == 0 && (! (p->flags & XT_DNETMAP_PERSISTENT) ) ) {
-		spin_lock_bh(&dnetmap_lock);
+		dnetmap_prefix_destroy(dnetmap_net, p);
-		list_del(&p->list);
-		spin_unlock_bh(&dnetmap_lock);
-#ifdef CONFIG_PROC_FS
-		sprintf(str, NIPQUAD_FMT "_%u", NIPQUAD(mr->range[0].min_ip),
-			33 - ffs(~(ntohl(mr->range[0].min_ip ^
-			mr->range[0].max_ip))));
-		remove_proc_entry(str, dnetmap_net->xt_dnetmap);
-		sprintf(str, NIPQUAD_FMT "_%u_stat", NIPQUAD(mr->range[0].min_ip),
-			33 - ffs(~(ntohl(mr->range[0].min_ip ^
-			mr->range[0].max_ip))));
-		remove_proc_entry(str, dnetmap_net->xt_dnetmap);
-#endif
-		dnetmap_prefix_flush(dnetmap_net, p);
-		kfree(p);
 	}
+	spin_unlock_bh(&dnetmap_lock);
 	mutex_unlock(&dnetmap_mutex);
 }
 
@@ -511,7 +560,7 @@ __acquires(dnetmap_lock)
 
 	spin_lock_bh(&dnetmap_lock);
 
-	list_for_each_entry(e, &prefix->lru_list, lru_list)
+	list_for_each_entry(e, &prefix->elist, list)
 		if (p-- == 0)
 			return e;
 	return NULL;
@@ -522,13 +571,13 @@ static void *dnetmap_seq_next(struct seq_file *seq, void *v, loff_t * pos)
 	struct dnetmap_iter_state *st = seq->private;
 	const struct dnetmap_prefix *prefix = st->p;
 	const struct dnetmap_entry *e = v;
-	const struct list_head *head = e->lru_list.next;
+	const struct list_head *head = e->list.next;
 
-	if (head == &prefix->lru_list)
+	if (head == &prefix->elist)
 		return NULL;
 
 	++*pos;
-	return list_entry(head, struct dnetmap_entry, lru_list);
+	return list_entry(head, struct dnetmap_entry, list);
 }
 
 static void dnetmap_seq_stop(struct seq_file *s, void *v)
@@ -541,9 +590,14 @@ static int dnetmap_seq_show(struct seq_file *seq, void *v)
 {
 	const struct dnetmap_entry *e = v;
 
-	seq_printf(seq, NIPQUAD_FMT " -> " NIPQUAD_FMT " --- ttl: %d lasthit: %lu\n",
+	if((e->flags & XT_DNETMAP_STATIC) == 0){
-		   NIPQUAD(e->prenat_addr), NIPQUAD(e->postnat_addr),
+		seq_printf(seq, NIPQUAD_FMT " -> " NIPQUAD_FMT " --- ttl: %d lasthit: %lu\n",
-		   (int)(e->stamp - jiffies) / HZ, (e->stamp - jtimeout) / HZ);
+				NIPQUAD(e->prenat_addr), NIPQUAD(e->postnat_addr),
+				(int)(e->stamp - jiffies) / HZ, (e->stamp - jtimeout) / HZ);
+	}else{
+		seq_printf(seq, NIPQUAD_FMT " -> " NIPQUAD_FMT " --- ttl: S lasthit: S\n",
+				NIPQUAD(e->prenat_addr), NIPQUAD(e->postnat_addr));
+	}
 	return 0;
 }
 
@@ -567,9 +621,180 @@ static int dnetmap_seq_open(struct inode *inode, struct file *file)
 	return 0;
 }
 
+static ssize_t
+dnetmap_tg_proc_write(struct file *file, const char __user *input,size_t size, loff_t *loff)
+{
+	const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
+	struct dnetmap_prefix *p = pde->data;
+	struct dnetmap_entry *e;
+	char buf[sizeof("+192.168.100.100:200.200.200.200")];
+	const char *c = buf;
+	const char *c2;
+	//union nf_inet_addr addr = {};
+	__be32 addr1,addr2;
+	bool add;
+	char str[25];
+
+	if (size == 0)
+		return 0;
+	if (size > sizeof(buf))
+		size = sizeof(buf);
+	if (copy_from_user(buf, input, size) != 0)
+		return -EFAULT;
+	if(strcspn(c,"\n") < size)
+		buf[strcspn(c,"\n")]='\0';
+
+	/* Strict protocol! */
+	if (*loff != 0)
+		return -ESPIPE;
+	switch (*c) {
+		case 'f': /* flush table */
+			if( strcmp(c,"flush") != 0 )
+				goto invalid_arg;
+			printk(KERN_INFO KBUILD_MODNAME ": flushing prefix %s\n", p->prefix_str);
+			spin_lock_bh(&dnetmap_lock);
+			dnetmap_prefix_softflush(p);
+			spin_unlock_bh(&dnetmap_lock);
+			return size;
+		case '-': /* remove address or attribute */
+			if( strcmp(c,"-persistent") == 0){
+				/* case if persistent flag is already unset */
+				if( ! (p->flags & XT_DNETMAP_PERSISTENT) ){
+					printk(KERN_INFO KBUILD_MODNAME ": prefix %s is not persistent already - doing nothing\n", p->prefix_str);
+					return size;
+				}
+				printk(KERN_INFO KBUILD_MODNAME ": prefix %s is now non-persistent\n", p->prefix_str);
+				spin_lock_bh(&dnetmap_lock);
+				p->flags &= ~XT_DNETMAP_PERSISTENT;
+				spin_unlock_bh(&dnetmap_lock);
+				return size;
+			}
+			add = false;
+			break;
+		case '+': /* add address or attribute */
+			if( strcmp(c,"+persistent") == 0){
+				/* case if persistent flag is already unset */
+				if( p->flags & XT_DNETMAP_PERSISTENT ){
+					printk(KERN_INFO KBUILD_MODNAME ": prefix %s is persistent already - doing nothing\n", p->prefix_str);
+					return size;
+				}
+				printk(KERN_INFO KBUILD_MODNAME ": prefix %s is now persistent\n", p->prefix_str);
+				spin_lock_bh(&dnetmap_lock);
+				p->flags |= XT_DNETMAP_PERSISTENT;
+				spin_unlock_bh(&dnetmap_lock);
+				return size;
+			}
+			add = true;
+			break;
+		default:
+			goto invalid_arg;
+	}
+
+	spin_lock_bh(&dnetmap_lock);
+
+	// in case static entry is added we need to parse second ip addresses
+	if (add){
+		c2 = strchr(c,':');
+		if(c2 == NULL)
+			goto invalid_arg_unlock;
+
+		c++;
+		c2++;
+
+		if( ! (in4_pton(c2,strlen(c2),(void *)&addr2, '\0', NULL) &&
+			  in4_pton(c,strlen(c),(void *)&addr1, ':', NULL)))
+			goto invalid_arg_unlock;
+
+		// sanity check - prenat ip can't belong to postnat prefix
+		if ( dnetmap_addr_in_prefix(p->dnetmap, addr1, p)){
+			printk(KERN_INFO KBUILD_MODNAME ": add static binding operation failed - prenat ip can't belong to postnat prefix\n");
+			goto invalid_arg_unlock;
+		}
+
+		// make sure postnat ip belongs to postnat prefix
+		if ( ! dnetmap_addr_in_prefix(p->dnetmap, addr2, p)){
+			printk(KERN_INFO KBUILD_MODNAME ": add static binding operation failed - postnat ip must belong to postnat prefix\n");
+			goto invalid_arg_unlock;
+		}
+
+		e = dnetmap_entry_rlookup(p->dnetmap,addr2);
+		if(e != NULL){
+			if (!disable_log)
+				printk(KERN_INFO KBUILD_MODNAME
+				       ": timeout binding " NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
+				       NIPQUAD(e->prenat_addr), NIPQUAD(e->postnat_addr) );
+			list_del(&e->glist);
+			list_del(&e->grlist);
+		}else{
+			// find existing entry in prefix elist
+			list_for_each_entry(e, &p->elist, list)
+				if (memcmp(&e->postnat_addr, &addr2, sizeof(addr2)) == 0){
+					break;
+				}
+		}
+
+		e->prenat_addr=addr1;
+		e->flags |= XT_DNETMAP_STATIC;
+		list_add_tail(&e->glist,
+			      &p->dnetmap->
+			      dnetmap_iphash[dnetmap_entry_hash(e->prenat_addr)]);
+		list_add_tail(&e->grlist,
+			      &p->dnetmap->dnetmap_iphash[hash_size +
+							   dnetmap_entry_hash
+							   (e->postnat_addr)]);
+		list_del(&e->lru_list);
+
+		sprintf(str, NIPQUAD_FMT ":" NIPQUAD_FMT, NIPQUAD(addr1),NIPQUAD(addr2));
+		printk(KERN_INFO KBUILD_MODNAME ": adding static binding %s\n", str);
+
+	// case of removing binding
+	}else{
+
+		c++;
+		if( ! in4_pton(c,strlen(c),(void *)&addr1, '\0', NULL))
+			goto invalid_arg_unlock;
+
+		e = dnetmap_entry_rlookup(p->dnetmap,addr1);
+		if(e == NULL) e = dnetmap_entry_lookup(p->dnetmap,addr1);
+
+		if(e != NULL){
+			if (!disable_log)
+				printk(KERN_INFO KBUILD_MODNAME
+				       ": remove binding " NIPQUAD_FMT " -> " NIPQUAD_FMT "\n",
+				       NIPQUAD(e->prenat_addr), NIPQUAD(e->postnat_addr) );
+			list_del(&e->glist);
+			list_del(&e->grlist);
+			if(e->flags & XT_DNETMAP_STATIC){
+				list_add_tail(&e->lru_list,&p->lru_list);
+				e->flags &= ~XT_DNETMAP_STATIC;
+			}
+			e->prenat_addr=0;
+			e->stamp=jiffies-1;
+		}else{
+			goto invalid_arg_unlock;
+		}
+	}
+
+	spin_unlock_bh(&dnetmap_lock);
+
+	/* Note we removed one above */
+	*loff += size + 1;
+	return size + 1;
+
+	invalid_arg_unlock:
+		spin_unlock_bh(&dnetmap_lock);
+
+	invalid_arg:
+		//printk(KERN_INFO KBUILD_MODNAME ": Need \"+prenat_ip:postnat_ip\", \"-ip\" or \"/\"\n");
+		printk(KERN_INFO KBUILD_MODNAME ": Error! Invalid option passed via procfs.\n");
+		return -EINVAL;
+}
+
+
 static const struct file_operations dnetmap_tg_fops = {
 	.open = dnetmap_seq_open,
 	.read = seq_read,
+	.write   = dnetmap_tg_proc_write,
 	.release = seq_release_private,
 	.owner = THIS_MODULE,
 };
@@ -581,27 +806,31 @@ static int dnetmap_stat_proc_read(char __user *buffer, char **start,
 {
 	const struct dnetmap_prefix *p = data;
 	struct dnetmap_entry *e;
-	unsigned int used, all;
+	unsigned int used, used_static, all;
 	long int ttl, sum_ttl;
 
-	used = 0;
+	used=used_static=all=sum_ttl=0;
-	all = 0;
-	sum_ttl = 0;
 
 	spin_lock_bh(&dnetmap_lock);
 
-	list_for_each_entry(e, &p->lru_list, lru_list) {
+	list_for_each_entry(e, &p->elist, list) {
 
-		ttl = e->stamp - jiffies;
+		if (e->prenat_addr != 0){
-		if (e->prenat_addr != 0 && ttl >= 0) {
+			if (e->flags & XT_DNETMAP_STATIC){
-			used++;
+				used_static++;
-			sum_ttl += ttl;
+			}else{
+				ttl = e->stamp - jiffies;
+				if (e->prenat_addr != 0 && ttl >= 0) {
+					used++;
+					sum_ttl += ttl;
+				}
+			}
 		}
 		all++;
 	}
 
 	sum_ttl = used > 0 ? sum_ttl / (used * HZ) : 0;
-	sprintf(buffer, "%u %u %ld\n", used, all, sum_ttl);
+	sprintf(buffer, "%u %u %u %ld %s\n", used, used_static, all, sum_ttl,(p->flags & XT_DNETMAP_PERSISTENT ? "persistent" : ""));
 
 	if (length >= strlen(buffer))
 		*eof = true;
@@ -663,12 +892,24 @@ static int __net_init dnetmap_net_init(struct net *net)
 static void __net_exit dnetmap_net_exit(struct net *net)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
+	struct dnetmap_prefix *p,*next;
+
+	mutex_lock(&dnetmap_mutex);
+	spin_lock_bh(&dnetmap_lock);
+
+	list_for_each_entry_safe(p, next, &dnetmap_net->prefixes, list){
+		BUG_ON(p->refcnt != 0);
+		dnetmap_prefix_destroy(dnetmap_net, p);
+	}
+
+	spin_unlock_bh(&dnetmap_lock);
+	mutex_unlock(&dnetmap_mutex);
 
-	BUG_ON(!list_empty(&dnetmap_net->prefixes));
 	kfree(dnetmap_net->dnetmap_iphash);
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 	kfree(dnetmap_net);
 #endif
+
 	dnetmap_proc_net_exit(net);
 }
 
@@ -714,6 +955,8 @@ static int __init dnetmap_tg_init(void)
 	if (err)
 		unregister_pernet_subsys(&dnetmap_net_ops);
 
+	printk( KERN_INFO KBUILD_MODNAME " INIT successfull (version %d)\n", DNETMAP_VERSION );
+
 	return err;
 }
 

extensions/xt_DNETMAP.h

@@ -1,16 +1,21 @@
 #ifndef _LINUX_NETFILTER_XT_DNETMAP_H
 #define _LINUX_NETFILTER_XT_DNETMAP_H 1
 
+#define DNETMAP_VERSION 2
+
 enum {
-	XT_DNETMAP_TTL = 1 << 0,
+	XT_DNETMAP_TTL 					= 1 << 0,
-	XT_DNETMAP_REUSE = 1 << 1,
+	XT_DNETMAP_REUSE 				= 1 << 1,
-	XT_DNETMAP_PREFIX = 1 << 2,
+	XT_DNETMAP_PREFIX 			= 1 << 2,
+	XT_DNETMAP_STATIC 			= 1 << 3,
+	XT_DNETMAP_PERSISTENT 	= 1 << 4,
+	XT_DNETMAP_FULL				 	= 1 << 5,
 };
 
 struct xt_DNETMAP_tginfo {
 	struct nf_nat_ipv4_multi_range_compat prefix;
 	__u8 flags;
-	__s16 ttl;
+	__s32 ttl;
 };
 
 #endif

extensions/xt_RAWNAT.c

@@ -181,7 +181,7 @@ static bool rawnat6_prepare_l4(struct sk_buff **pskb, unsigned int *l4offset,
 	*l4proto = NEXTHDR_MAX;
 
 	for (i = 0; i < ARRAY_SIZE(types); ++i) {
-		err = ipv6_find_hdr(*pskb, l4offset, types[i], NULL);
+		err = ipv6_find_hdr(*pskb, l4offset, types[i], NULL, NULL);
 		if (err >= 0) {
 			*l4proto = types[i];
 			break;

extensions/xt_SYSRQ.c

@@ -247,8 +247,9 @@ sysrq_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 		return NF_DROP;
 
 	iph = ipv6_hdr(skb);
-	if ((ipv6_find_hdr(skb, &th_off, IPPROTO_UDP, &frag_off) < 0 &&
+	/* Should probably be using %IP6T_FH_F_AUTH */
-	    ipv6_find_hdr(skb, &th_off, IPPROTO_UDPLITE, &frag_off) < 0) ||
+	if ((ipv6_find_hdr(skb, &th_off, IPPROTO_UDP, &frag_off, NULL) < 0 &&
+	    ipv6_find_hdr(skb, &th_off, IPPROTO_UDPLITE, &frag_off, NULL) < 0) ||
 	    frag_off > 0)
 		return NF_DROP;
 

extensions/xt_length2.c

@@ -185,7 +185,7 @@ llayer4_proto(const struct sk_buff *skb, unsigned int *offset, bool *hotdrop)
 	int err;
 
 	for (i = 0; i < ARRAY_SIZE(types); ++i) {
-		err = ipv6_find_hdr(skb, offset, types[i], NULL);
+		err = ipv6_find_hdr(skb, offset, types[i], NULL, NULL);
 		if (err >= 0)
 			return types[i];
 		if (err != -ENOENT) {

extensions/xt_psd.c

@@ -40,10 +40,15 @@ MODULE_AUTHOR(" Mohd Nawawi Mohamad Jamili <nawawi@tracenetworkcorporation.com>"
 MODULE_DESCRIPTION("Xtables: PSD - portscan detection");
 MODULE_ALIAS("ipt_psd");
 
-#define HF_DADDR_CHANGING   0x01
+/*
-#define HF_SPORT_CHANGING   0x02
+ * Keep track of up to LIST_SIZE source addresses, using a hash table of
-#define HF_TOS_CHANGING	    0x04
+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
-#define HF_TTL_CHANGING	    0x08
+ * HASH_MAX source addresses per the same hash value.
+ */
+#define LIST_SIZE			0x100
+#define HASH_LOG			9
+#define HASH_SIZE			(1 << HASH_LOG)
+#define HASH_MAX			0x10
 
 /*
  * Information we keep per each target port
@@ -51,35 +56,37 @@ MODULE_ALIAS("ipt_psd");
 struct port {
 	u_int16_t number;      /* port number */
 	u_int8_t proto;        /* protocol number */
-	u_int8_t and_flags;    /* tcp ANDed flags */
-	u_int8_t or_flags;     /* tcp ORed flags */
 };
 
-/*
+/**
  * Information we keep per each source address.
+ * @next:	next entry with the same hash
+ * @timestamp:	last update time
+ * @count:	number of ports in the list
+ * @weight:	total weight of ports in the list
  */
 struct host {
-	struct host *next;						/* Next entry with the same hash */
+	struct host *next;
-	unsigned long timestamp;					/* Last update time */
+	unsigned long timestamp;
-	struct in_addr src_addr;				/* Source address */
+	struct in_addr src_addr;
-	struct in_addr dest_addr;				/* Destination address */
+	struct in_addr dest_addr;
-	unsigned short src_port;				/* Source port */
+	__be16 src_port;
-	int count;								/* Number of ports in the list */
+	uint16_t count;
-	int weight;								/* Total weight of ports in the list */
+	uint8_t weight;
-	struct port ports[SCAN_MAX_COUNT - 1];	/* List of ports */
+	struct port ports[SCAN_MAX_COUNT-1];
-	unsigned char tos;						/* TOS */
-	unsigned char ttl;						/* TTL */
-	unsigned char flags;					/* HF_ flags bitmask */
 };
 
-/*
+/**
  * State information.
+ * @list:	list of source addresses
+ * @hash:	pointers into the list
+ * @index:	oldest entry to be replaced
  */
 static struct {
 	spinlock_t lock;
-	struct host list[LIST_SIZE];	/* List of source addresses */
+	struct host list[LIST_SIZE];
-	struct host *hash[HASH_SIZE];	/* Hash: pointers into the list */
+	struct host *hash[HASH_SIZE];
-	int index;						/* Oldest entry to be replaced */
+	int index;
 } state;
 
 /*
@@ -111,26 +118,20 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 	} _buf;
 	struct in_addr addr;
 	u_int16_t src_port,dest_port;
-  	u_int8_t tcp_flags, proto;
+	u_int8_t proto;
 	unsigned long now;
 	struct host *curr, *last, **head;
 	int hash, index, count;
 	/* Parameters from userspace */
 	const struct xt_psd_info *psdinfo = match->matchinfo;
 
-	/* IP header */
 	iph = ip_hdr(pskb);
-
-	/* Sanity check */
 	if (iph->frag_off & htons(IP_OFFSET)) {
 		pr_debug("sanity check failed\n");
 		return false;
 	}
 
-	/* TCP or UDP ? */
 	proto = iph->protocol;
-	/* Get the source address, source & destination ports, and TCP flags */
-
 	addr.s_addr = iph->saddr;
 	/* We're using IP address 0.0.0.0 for a special purpose here, so don't let
 	 * them spoof us. [DHCP needs this feature - HW] */
@@ -148,7 +149,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 		/* Yep, it's dirty */
 		src_port = tcph->source;
 		dest_port = tcph->dest;
-		tcp_flags = *((u_int8_t*)tcph + 13);
 	} else if (proto == IPPROTO_UDP || proto == IPPROTO_UDPLITE) {
 		udph = skb_header_pointer(pskb, match->thoff,
 		       sizeof(_buf.udph), &_buf.udph);
@@ -156,14 +156,11 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 			return false;
 		src_port  = udph->source;
 		dest_port = udph->dest;
-		tcp_flags = 0;
 	} else {
 		pr_debug("protocol not supported\n");
 		return false;
 	}
 
-	/* Use jiffies here not to depend on someone setting the time while we're
-	 * running; we need to be careful with possible return value overflows. */
 	now = jiffies;
 
 	spin_lock(&state.lock);
@@ -181,7 +178,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 		} while ((curr = curr->next) != NULL);
 
 	if (curr != NULL) {
-
 		/* We know this address, and the entry isn't too old. Update it. */
 		if (now - curr->timestamp <= (psdinfo->delay_threshold*HZ)/100 &&
 		    time_after_eq(now, curr->timestamp)) {
@@ -190,8 +186,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 			for (index = 0; index < curr->count; index++) {
 				if (curr->ports[index].number == dest_port) {
 					curr->ports[index].proto = proto;
-					curr->ports[index].and_flags &= tcp_flags;
-					curr->ports[index].or_flags |= tcp_flags;
 					goto out_no_match;
 				}
 			}
@@ -203,35 +197,22 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 			/* Packet to a new port, and not TCP/ACK: update the timestamp */
 			curr->timestamp = now;
 
-			/* Logged this scan already? Then drop the packet. */
+			/* Matched this scan already? Then Leave. */
 			if (curr->weight >= psdinfo->weight_threshold)
 				goto out_match;
 
-			/* Specify if destination address, source port, TOS or TTL are not fixed */
-			if (curr->dest_addr.s_addr != iph->daddr)
-				curr->flags |= HF_DADDR_CHANGING;
-			if (curr->src_port != src_port)
-				curr->flags |= HF_SPORT_CHANGING;
-			if (curr->tos != iph->tos)
-				curr->flags |= HF_TOS_CHANGING;
-			if (curr->ttl != iph->ttl)
-				curr->flags |= HF_TTL_CHANGING;
-
 			/* Update the total weight */
 			curr->weight += (ntohs(dest_port) < 1024) ?
 				psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
 
 			/* Got enough destination ports to decide that this is a scan? */
-			/* Then log it and drop the packet. */
 			if (curr->weight >= psdinfo->weight_threshold)
 				goto out_match;
 
 			/* Remember the new port */
-			if (curr->count < SCAN_MAX_COUNT) {
+			if (curr->count < ARRAY_SIZE(curr->ports)) {
 				curr->ports[curr->count].number = dest_port;
 				curr->ports[curr->count].proto = proto;
-				curr->ports[curr->count].and_flags = tcp_flags;
-				curr->ports[curr->count].or_flags = tcp_flags;
 				curr->count++;
 			}
 
@@ -303,10 +284,6 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
 	curr->weight = (ntohs(dest_port) < 1024) ? psdinfo->lo_ports_weight : psdinfo->hi_ports_weight;
 	curr->ports[0].number = dest_port;
 	curr->ports[0].proto = proto;
-	curr->ports[0].and_flags = tcp_flags;
-	curr->ports[0].or_flags = tcp_flags;
-	curr->tos = iph->tos;
-	curr->ttl = iph->ttl;
 
 out_no_match:
 	spin_unlock(&state.lock);
@@ -317,13 +294,35 @@ out_match:
 	return true;
 }
 
+static int psd_mt_check(const struct xt_mtchk_param *par)
+{
+	const struct xt_psd_info *info = par->matchinfo;
+
+	if (info->weight_threshold == 0)
+		/* 0 would match on every 1st packet */
+		return -EINVAL;
+
+	if ((info->lo_ports_weight | info->hi_ports_weight) == 0)
+		/* would never match */
+		return -EINVAL;
+
+	if (info->delay_threshold > PSD_MAX_RATE ||
+	    info->weight_threshold > PSD_MAX_RATE ||
+	    info->lo_ports_weight > PSD_MAX_RATE ||
+	    info->hi_ports_weight > PSD_MAX_RATE)
+		return -EINVAL;
+
+	return 0;
+}
+
 static struct xt_match xt_psd_reg __read_mostly = {
-	.name		= "psd",
+	.name       = "psd",
-	.family    = NFPROTO_IPV4,
+	.family     = NFPROTO_IPV4,
-	.revision  = 1,
+	.revision   = 1,
-	.match		= xt_psd_match,
+	.checkentry = psd_mt_check,
-	.matchsize	= sizeof(struct xt_psd_info),
+	.match      = xt_psd_match,
-	.me			= THIS_MODULE,
+	.matchsize  = sizeof(struct xt_psd_info),
+	.me         = THIS_MODULE,
 };
 
 static int __init xt_psd_init(void)

extensions/xt_psd.h

@@ -19,17 +19,6 @@
 #define SCAN_MIN_COUNT			7
 #define SCAN_MAX_COUNT			(SCAN_MIN_COUNT * PORT_WEIGHT_PRIV)
 #define SCAN_WEIGHT_THRESHOLD		SCAN_MAX_COUNT
-#define SCAN_DELAY_THRESHOLD		(300) /* old usage of HZ here was erroneously and broke under uml */
-
-/*
- * Keep track of up to LIST_SIZE source addresses, using a hash table of
- * HASH_SIZE entries for faster lookups, but limiting hash collisions to
- * HASH_MAX source addresses per the same hash value.
- */
-#define LIST_SIZE			0x100
-#define HASH_LOG			9
-#define HASH_SIZE			(1 << HASH_LOG)
-#define HASH_MAX			0x10
 
 struct xt_psd_info {
 	__u32 weight_threshold;

xtables-addons.8.in

@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "v1.42 (2012-04-05)" "" "v1.42 (2012-04-05)"
+.TH xtables-addons 8 "v1.43 (2012-06-30)" "" "v1.43 (2012-06-30)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets