ipaddr match (from "Writing your own Netfilter module" PDF)

.gitignore

@@ -1,4 +1,3 @@
-*.gcno
 *.la
 *.lo
 *.loT

Makefile.am

@@ -11,10 +11,8 @@ FORCE:
 xtables-addons.8: FORCE
 	${MAKE} -f Makefile.mans all;
 
-clean-local-mans:
+install-exec-hook:
-	${MAKE} -f Makefile.mans clean;
+	depmod -a || :;
-
-clean-local: clean-local-mans
 
 config.status: Makefile.iptrules.in
 

Makefile.mans.in

@@ -3,8 +3,8 @@
 
 srcdir := @srcdir@
 
-wcman_matches := $(shell find "${srcdir}/extensions" -name 'libxt_[a-z]*.man' -print | sort)
+wcman_matches := $(shell find "${srcdir}" -name 'libxt_[a-z]*.man' | sort)
-wcman_targets := $(shell find "${srcdir}/extensions" -name 'libxt_[A-Z]*.man' -print | sort)
+wcman_targets := $(shell find "${srcdir}" -name 'libxt_[A-Z]*.man' | sort)
 wlist_matches := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_matches})
 wlist_targets := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_targets})
 
@@ -38,6 +38,3 @@ matches.man: .manpages.lst ${wcman_matches}
 
 targets.man: .manpages.lst ${wcman_targets}
 	$(call man_run,${wlist_targets})
-
-clean:
-	rm -f xtables-addons.8 matches.man targets.man

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([xtables-addons], [2.4])
+AC_INIT([xtables-addons], [2.1])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -63,8 +63,8 @@ if test -n "$kbuilddir"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 13; then
+		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 8; then
-			echo "WARNING: That kernel version is not officially supported yet. Continue at own luck.";
+			echo "WARNING: That kernel version is not officially supported.";
 		elif test "$kmajor" -eq 3 -a "$kminor" -ge 7; then
 			:;
 		else

doc/changelog.txt

@@ -3,36 +3,6 @@ HEAD
 ====
 
 
-v2.4 (2014-01-09)
-=================
-Enhancements:
-- Support for Linux 3.13
-Changes:
-- remove unmaintained RAWSNAT/RAWDNAT code
-- remove unused parts of compat_xtables that served Linux <3.7
-
-
-v2.3 (2013-06-18)
-=================
-Enhancements:
-- Support for Linux 3.10
-Fixes:
-- xt_DNETMAP, xt_condition, xt_quota2: resolve compile error when
-  CONFIG_UIDGID_STRICT_TYPE_CHECKS=y
-- xt_RAWNAT: ensure correct operation in the presence of IPv4 options
-- xt_geoip: do not throw a warnings when country database is size 0
-- xt_quota2: print "!" at the correct position during iptables-save
-Changes:
-- Make print (iptables -L) output the same as save (-S)
-
-
-v2.2 (2013-03-31)
-=================
-Enhancements:
-- Support for Linux 3.9
-- iptaccount: fix entire program being erroneously optimized away on PPC
-
-
 v2.1 (2012-11-27)
 =================
 Fixes:

extensions/ACCOUNT/iptaccount.c

@@ -64,7 +64,7 @@ int main(int argc, char *argv[])
 	struct ipt_ACCOUNT_context ctx;
 	struct ipt_acc_handle_ip *entry;
 	int i;
-	int optchar;
+	char optchar;
 	bool doHandleUsage = false, doHandleFree = false, doTableNames = false;
 	bool doFlush = false, doContinue = false, doCSV = false;
 

extensions/ACCOUNT/xt_ACCOUNT.c

@@ -474,15 +474,14 @@ static void ipt_acc_depth2_insert(struct ipt_acc_mask_8 *mask_8,
 	}
 }
 
-static unsigned int
+static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action_param *par)
-ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
 	const struct ipt_acc_info *info =
 		par->targinfo;
 
-	__be32 src_ip = ip_hdr(skb)->saddr;
+	__be32 src_ip = ip_hdr(*pskb)->saddr;
-	__be32 dst_ip = ip_hdr(skb)->daddr;
+	__be32 dst_ip = ip_hdr(*pskb)->daddr;
-	uint32_t size = ntohs(ip_hdr(skb)->tot_len);
+	uint32_t size = ntohs(ip_hdr(*pskb)->tot_len);
 
 	spin_lock_bh(&ipt_acc_lock);
 

extensions/Kbuild

@@ -15,7 +15,12 @@ obj-${build_ECHO}        += xt_ECHO.o
 endif
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
+obj-${build_RAWNAT}      += xt_RAWNAT.o iptable_rawpost.o
+ifneq (${CONFIG_IP6_NF_IPTABLES},)
+obj-${build_RAWNAT}      += ip6table_rawpost.o
+endif
 obj-${build_SYSRQ}       += xt_SYSRQ.o
+obj-${build_STEAL}       += xt_STEAL.o
 obj-${build_TARPIT}      += xt_TARPIT.o
 obj-${build_condition}   += xt_condition.o
 obj-${build_fuzzy}       += xt_fuzzy.o
@@ -29,5 +34,7 @@ obj-${build_pknock}      += pknock/
 obj-${build_psd}         += xt_psd.o
 obj-${build_quota2}      += xt_quota2.o
 
+obj-${build_ipaddr}   += xt_ipaddr.o
+
 -include ${M}/*.Kbuild
 -include ${M}/Kbuild.*

extensions/Mbuild

@@ -8,12 +8,15 @@ obj-${build_DNETMAP}     += libxt_DNETMAP.so
 obj-${build_ECHO}        += libxt_ECHO.so
 obj-${build_IPMARK}      += libxt_IPMARK.so
 obj-${build_LOGMARK}     += libxt_LOGMARK.so
+obj-${build_RAWNAT}      += libxt_RAWDNAT.so libxt_RAWSNAT.so
+obj-${build_STEAL}       += libxt_STEAL.so
 obj-${build_SYSRQ}       += libxt_SYSRQ.so
 obj-${build_TARPIT}      += libxt_TARPIT.so
 obj-${build_condition}   += libxt_condition.so
 obj-${build_fuzzy}       += libxt_fuzzy.so
 obj-${build_geoip}       += libxt_geoip.so
 obj-${build_iface}       += libxt_iface.so
+obj-${build_ipaddr}      += libxt_ipaddr.so
 obj-${build_ipp2p}       += libxt_ipp2p.so
 obj-${build_ipv4options} += libxt_ipv4options.so
 obj-${build_length2}     += libxt_length2.so

extensions/compat_nfinetaddr.h

@@ -0,0 +1,14 @@
+#ifndef _COMPAT_NFINETADDR_H
+#define _COMPAT_NFINETADDR_H 1
+
+#include <linux/in.h>
+#include <linux/in6.h>
+
+union nf_inet_addr {
+	__be32 ip;
+	__be32 ip6[4];
+	struct in_addr in;
+	struct in6_addr in6;
+};
+
+#endif /* _COMPAT_NFINETADDR_H */

extensions/compat_rawpost.h

@@ -0,0 +1,6 @@
+#ifndef XTA_COMPAT_RAWPOST_H
+#define XTA_COMPAT_RAWPOST_H 1
+
+typedef struct sk_buff sk_buff_t;
+
+#endif /* XTA_COMPAT_RAWPOST_H */

extensions/compat_xtables.c

@@ -28,6 +28,118 @@
 #	define WITH_IPV6 1
 #endif
 
+static unsigned int
+xtnu_target_run(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(par->target);
+
+	return nt->target(&skb, par);
+}
+
+int xtnu_register_target(struct xtnu_target *nt)
+{
+	struct xt_target *ct;
+	char *tmp;
+	int ret;
+
+	ct = kzalloc(sizeof(struct xt_target), GFP_KERNEL);
+	if (ct == NULL)
+		return -ENOMEM;
+
+	tmp = (char *)ct->name;
+	memcpy(tmp, nt->name, sizeof(nt->name));
+	tmp = (char *)(ct->name + sizeof(ct->name) - sizeof(void *));
+	*(tmp-1) = '\0';
+	memcpy(tmp, &nt, sizeof(void *));
+
+	ct->revision   = nt->revision;
+	ct->family     = nt->family;
+	ct->table      = (char *)nt->table;
+	ct->hooks      = nt->hooks;
+	ct->proto      = nt->proto;
+	ct->target     = xtnu_target_run;
+	ct->checkentry = nt->checkentry;
+	ct->destroy    = nt->destroy;
+	ct->targetsize = nt->targetsize;
+	ct->me         = nt->me;
+
+	nt->__compat_target = ct;
+	ret = xt_register_target(ct);
+	if (ret != 0)
+		kfree(ct);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(xtnu_register_target);
+
+int xtnu_register_targets(struct xtnu_target *nt, unsigned int num)
+{
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < num; ++i) {
+		ret = xtnu_register_target(&nt[i]);
+		if (ret < 0) {
+			if (i > 0)
+				xtnu_unregister_targets(nt, i);
+			return ret;
+		}
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(xtnu_register_targets);
+
+void xtnu_unregister_target(struct xtnu_target *nt)
+{
+	xt_unregister_target(nt->__compat_target);
+	kfree(nt->__compat_target);
+}
+EXPORT_SYMBOL_GPL(xtnu_unregister_target);
+
+void xtnu_unregister_targets(struct xtnu_target *nt, unsigned int num)
+{
+	unsigned int i;
+
+	for (i = 0; i < num; ++i)
+		xtnu_unregister_target(&nt[i]);
+}
+EXPORT_SYMBOL_GPL(xtnu_unregister_targets);
+
+struct xt_match *xtnu_request_find_match(unsigned int af, const char *name,
+    uint8_t revision)
+{
+	static const char *const xt_prefix[] = {
+		[AF_UNSPEC] = "x",
+		[AF_INET]   = "ip",
+		[AF_INET6]  = "ip6",
+#ifdef AF_ARP
+		[AF_ARP]    = "arp",
+#elif defined(NF_ARP) && NF_ARP != AF_UNSPEC
+		[NF_ARP]    = "arp",
+#endif
+	};
+	struct xt_match *match;
+
+	match = try_then_request_module(xt_find_match(af, name, revision),
+		"%st_%s", xt_prefix[af], name);
+	if (IS_ERR(match) || match == NULL)
+		return NULL;
+
+	return match;
+}
+EXPORT_SYMBOL_GPL(xtnu_request_find_match);
+
+int xtnu_ip_route_me_harder(struct sk_buff **pskb, unsigned int addr_type)
+{
+	return ip_route_me_harder(*pskb, addr_type);
+}
+EXPORT_SYMBOL_GPL(xtnu_ip_route_me_harder);
+
+int xtnu_skb_make_writable(struct sk_buff **pskb, unsigned int len)
+{
+	return skb_make_writable(*pskb, len);
+}
+EXPORT_SYMBOL_GPL(xtnu_skb_make_writable);
+
 void *HX_memmem(const void *space, size_t spacesize,
     const void *point, size_t pointsize)
 {

extensions/compat_xtables.h

@@ -21,6 +21,11 @@
 #	warning You need CONFIG_NF_CONNTRACK.
 #endif
 
+#define ipt_unregister_table(tbl) ipt_unregister_table(&init_net, (tbl))
+#define ip6t_unregister_table(tbl) ip6t_unregister_table(&init_net, (tbl))
+
+#define rt_dst(rt)	(&(rt)->dst)
+
 #if !defined(NIP6) && !defined(NIP6_FMT)
 #	define NIP6(addr) \
 		ntohs((addr).s6_addr16[0]), \
@@ -42,31 +47,14 @@
 #	define NIPQUAD_FMT "%u.%u.%u.%u"
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
+#define ip_route_me_harder    xtnu_ip_route_me_harder
-static inline struct inode *file_inode(struct file *f)
+#define skb_make_writable     xtnu_skb_make_writable
-{
+#define xt_target             xtnu_target
-	return f->f_path.dentry->d_inode;
+#define xt_register_target    xtnu_register_target
-}
+#define xt_unregister_target  xtnu_unregister_target
-#endif
+#define xt_register_targets   xtnu_register_targets
+#define xt_unregister_targets xtnu_unregister_targets
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
+#define xt_request_find_match xtnu_request_find_match
-static inline void
-proc_set_user(struct proc_dir_entry *de, kuid_t uid, kgid_t gid)
-{
-	de->uid = uid;
-	de->gid = gid;
-}
-
-static inline void *PDE_DATA(struct inode *inode)
-{
-	return PDE(inode)->data;
-}
-
-static inline void proc_remove(struct proc_dir_entry *de)
-{
-	if (de != NULL)
-		remove_proc_entry(de->name, de->parent);
-}
-#endif
 
 #endif /* _XTABLES_COMPAT_H */

extensions/compat_xtnu.h

@@ -1,9 +1,14 @@
 #ifndef _COMPAT_XTNU_H
 #define _COMPAT_XTNU_H 1
 
+#include <linux/list.h>
 #include <linux/netfilter/x_tables.h>
+#include <linux/spinlock.h>
 
+struct flowi;
 struct module;
+struct net_device;
+struct rtable;
 struct sk_buff;
 
 struct xtnu_match {
@@ -53,7 +58,11 @@ static inline struct xtnu_target *xtcompat_nutarget(const struct xt_target *t)
 	return q;
 }
 
+extern int xtnu_ip_local_out(struct sk_buff *);
+extern int xtnu_ip_route_me_harder(struct sk_buff **, unsigned int);
+extern int xtnu_skb_make_writable(struct sk_buff **, unsigned int);
 extern int xtnu_register_match(struct xtnu_match *);
+extern int xtnu_ip_route_output_key(void *, struct rtable **, struct flowi *);
 extern void xtnu_unregister_match(struct xtnu_match *);
 extern int xtnu_register_matches(struct xtnu_match *, unsigned int);
 extern void xtnu_unregister_matches(struct xtnu_match *, unsigned int);
@@ -61,6 +70,14 @@ extern int xtnu_register_target(struct xtnu_target *);
 extern void xtnu_unregister_target(struct xtnu_target *);
 extern int xtnu_register_targets(struct xtnu_target *, unsigned int);
 extern void xtnu_unregister_targets(struct xtnu_target *, unsigned int);
+extern struct xt_match *xtnu_request_find_match(unsigned int,
+	const char *, uint8_t);
+extern void xtnu_proto_csum_replace4(__u16 __bitwise *, struct sk_buff *,
+	__be32, __be32, bool);
+extern int xtnu_ipv6_skip_exthdr(const struct sk_buff *, int,
+	uint8_t *, __be16 *);
+extern int xtnu_ipv6_find_hdr(const struct sk_buff *, unsigned int *,
+	int, unsigned short *, int *);
 
 extern void *HX_memmem(const void *, size_t, const void *, size_t);
 

extensions/ip6table_rawpost.c

@@ -0,0 +1,93 @@
+/*
+ *	rawpost table for ip6_tables
+ *	written by Jan Engelhardt, 2008 - 2009
+ *	placed in the Public Domain
+ */
+#include <linux/module.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <net/ip.h>
+#include "compat_xtables.h"
+#include "compat_rawpost.h"
+
+enum {
+	RAWPOST_VALID_HOOKS = 1 << NF_INET_POST_ROUTING,
+};
+
+static struct {
+	struct ip6t_replace repl;
+	struct ip6t_standard entries[1];
+	struct ip6t_error term;
+} rawpost6_initial __initdata = {
+	.repl = {
+		.name        = "rawpost",
+		.valid_hooks = RAWPOST_VALID_HOOKS,
+		.num_entries = 2,
+		.size        = sizeof(struct ip6t_standard) +
+		               sizeof(struct ip6t_error),
+		.hook_entry  = {
+			[NF_INET_POST_ROUTING] = 0,
+		},
+		.underflow = {
+			[NF_INET_POST_ROUTING] = 0,
+		},
+	},
+	.entries = {
+		IP6T_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
+	},
+	.term = IP6T_ERROR_INIT,		/* ERROR */
+};
+
+static struct xt_table *rawpost6_ptable;
+
+static struct xt_table rawpost6_itable = {
+	.name        = "rawpost",
+	.af          = NFPROTO_IPV6,
+	.valid_hooks = RAWPOST_VALID_HOOKS,
+	.me          = THIS_MODULE,
+};
+
+static unsigned int rawpost6_hook_fn(unsigned int hook, sk_buff_t *skb,
+    const struct net_device *in, const struct net_device *out,
+    int (*okfn)(struct sk_buff *))
+{
+	return ip6t_do_table(skb, hook, in, out, rawpost6_ptable);
+}
+
+static struct nf_hook_ops rawpost6_hook_ops __read_mostly = {
+	.hook     = rawpost6_hook_fn,
+	.pf       = NFPROTO_IPV6,
+	.hooknum  = NF_INET_POST_ROUTING,
+	.priority = NF_IP6_PRI_LAST,
+	.owner    = THIS_MODULE,
+};
+
+static int __init rawpost6_table_init(void)
+{
+	int ret;
+
+	rawpost6_ptable = ip6t_register_table(&init_net, &rawpost6_itable,
+	                  &rawpost6_initial.repl);
+	if (IS_ERR(rawpost6_ptable))
+		return PTR_ERR(rawpost6_ptable);
+
+	ret = nf_register_hook(&rawpost6_hook_ops);
+	if (ret < 0)
+		goto out;
+
+	return ret;
+
+ out:
+	ip6t_unregister_table(rawpost6_ptable);
+	return ret;
+}
+
+static void __exit rawpost6_table_exit(void)
+{
+	nf_unregister_hook(&rawpost6_hook_ops);
+	ip6t_unregister_table(rawpost6_ptable);
+}
+
+module_init(rawpost6_table_init);
+module_exit(rawpost6_table_exit);
+MODULE_AUTHOR("Jan Engelhardt ");
+MODULE_LICENSE("GPL");

extensions/iptable_rawpost.c

@@ -0,0 +1,95 @@
+/*
+ *	rawpost table for ip_tables
+ *	written by Jan Engelhardt, 2008 - 2009
+ *	placed in the Public Domain
+ */
+#include <linux/module.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/version.h>
+#include <net/ip.h>
+#include "compat_xtables.h"
+#include "compat_rawpost.h"
+
+enum {
+	RAWPOST_VALID_HOOKS = 1 << NF_INET_POST_ROUTING,
+};
+
+static struct {
+	struct ipt_replace repl;
+	struct ipt_standard entries[1];
+	struct ipt_error term;
+} rawpost4_initial __initdata = {
+	.repl = {
+		.name        = "rawpost",
+		.valid_hooks = RAWPOST_VALID_HOOKS,
+		.num_entries = 2,
+		.size        = sizeof(struct ipt_standard) +
+		               sizeof(struct ipt_error),
+		.hook_entry  = {
+			[NF_INET_POST_ROUTING] = 0,
+		},
+		.underflow = {
+			[NF_INET_POST_ROUTING] = 0,
+		},
+	},
+	.entries = {
+		IPT_STANDARD_INIT(NF_ACCEPT),	/* POST_ROUTING */
+	},
+	.term = IPT_ERROR_INIT,			/* ERROR */
+};
+
+static struct xt_table *rawpost4_ptable;
+
+static struct xt_table rawpost4_itable = {
+	.name        = "rawpost",
+	.af          = NFPROTO_IPV4,
+	.valid_hooks = RAWPOST_VALID_HOOKS,
+	.me          = THIS_MODULE,
+};
+
+static unsigned int rawpost4_hook_fn(unsigned int hook, sk_buff_t *skb,
+    const struct net_device *in, const struct net_device *out,
+    int (*okfn)(struct sk_buff *))
+{
+	return ipt_do_table(skb, hook, in, out, rawpost4_ptable);
+}
+
+static struct nf_hook_ops rawpost4_hook_ops __read_mostly = {
+	.hook     = rawpost4_hook_fn,
+	.pf       = NFPROTO_IPV4,
+	.hooknum  = NF_INET_POST_ROUTING,
+	.priority = NF_IP_PRI_LAST,
+	.owner    = THIS_MODULE,
+};
+
+static int __init rawpost4_table_init(void)
+{
+	int ret;
+
+	rawpost4_ptable = ipt_register_table(&init_net, &rawpost4_itable,
+	                  &rawpost4_initial.repl);
+	if (IS_ERR(rawpost4_ptable))
+		return PTR_ERR(rawpost4_ptable);
+
+	ret = nf_register_hook(&rawpost4_hook_ops);
+	if (ret < 0)
+		goto out;
+
+	return ret;
+
+ out:
+	ipt_unregister_table(rawpost4_ptable);
+	return ret;
+}
+
+static void __exit rawpost4_table_exit(void)
+{
+	nf_unregister_hook(&rawpost4_hook_ops);
+	ipt_unregister_table(rawpost4_ptable);
+}
+
+module_init(rawpost4_table_init);
+module_exit(rawpost4_table_exit);
+MODULE_DESCRIPTION("Xtables: rawpost table for use with RAWNAT");
+MODULE_AUTHOR("Jan Engelhardt ");
+MODULE_LICENSE("GPL");

extensions/libxt_CHAOS.c

@@ -64,6 +64,21 @@ static void chaos_tg_check(unsigned int flags)
 		           "may be specified");
 }
 
+static void chaos_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_chaos_tginfo *info = (const void *)target->data;
+
+	switch (info->variant) {
+	case XTCHAOS_DELUDE:
+		printf(" DELUDE ");
+		break;
+	case XTCHAOS_TARPIT:
+		printf(" TARPIT ");
+		break;
+	}
+}
+
 static void chaos_tg_save(const void *ip, const struct xt_entry_target *target)
 {
 	const struct xt_chaos_tginfo *info = (const void *)target->data;
@@ -78,13 +93,6 @@ static void chaos_tg_save(const void *ip, const struct xt_entry_target *target)
 	}
 }
 
-static void chaos_tg_print(const void *ip,
-    const struct xt_entry_target *target, int numeric)
-{
-	printf(" -j CHAOS");
-	chaos_tg_save(ip, target);
-}
-
 static struct xtables_target chaos_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "CHAOS",

extensions/libxt_CHAOS.man

@@ -1,4 +1,3 @@
-.PP
 Causes confusion on the other end by doing odd things with incoming packets.
 CHAOS will randomly reply (or not) with one of its configurable subtargets:
 .TP

extensions/libxt_DELUDE.man

@@ -1,4 +1,3 @@
-.PP
 The DELUDE target will reply to a SYN packet with SYN-ACK, and to all other
 packets with an RST. This will terminate the connection much like REJECT, but
 network scanners doing TCP half-open discovery can be spoofed to make them

extensions/libxt_DHCPMAC.c

@@ -61,6 +61,15 @@ static void dhcpmac_tg_check(unsigned int flags)
 		           "--set-mac parameter required");
 }
 
+static void dhcpmac_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct dhcpmac_info *info = (void *)target->data;
+
+	printf(" DHCPMAC %s" DH_MAC_FMT "/%u ",
+	       info->invert ? "!" : "", DH_MAC_HEX(info->addr), info->mask);
+}
+
 static void dhcpmac_tg_save(const void *ip,
     const struct xt_entry_target *target)
 {
@@ -72,13 +81,6 @@ static void dhcpmac_tg_save(const void *ip,
 	       DH_MAC_HEX(info->addr), info->mask);
 }
 
-static void dhcpmac_tg_print(const void *ip,
-    const struct xt_entry_target *target, int numeric)
-{
-	printf(" -j DHCPMAC");
-	dhcpmac_tg_save(ip, target);
-}
-
 static struct xtables_target dhcpmac_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "DHCPMAC",

extensions/libxt_DHCPMAC.man

@@ -1,4 +1,3 @@
-.PP
 In conjunction with ebtables, DHCPMAC can be used to completely change all MAC
 addresses from and to a VMware-based virtual machine. This is needed because
 VMware does not allow to set a non-VMware MAC address before an operating

extensions/libxt_DNETMAP.c

@@ -195,6 +195,33 @@ static void DNETMAP_print_addr(const void *ip,
 		printf("/%d", bits);
 }
 
+static void DNETMAP_print(const void *ip, const struct xt_entry_target *target,
+			  int numeric)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
+	const __u8 *flags = &tginfo->flags;
+
+	printf(" prefix ");
+	if (*flags & XT_DNETMAP_PREFIX)
+		DNETMAP_print_addr(ip, target, numeric);
+	else
+		printf("any");
+
+	if (*flags & XT_DNETMAP_REUSE)
+		printf(" reuse");
+
+	if (*flags & XT_DNETMAP_STATIC)
+		printf(" static");
+
+	if (*flags & XT_DNETMAP_PERSISTENT)
+		printf(" persistent");
+
+	if (*flags & XT_DNETMAP_TTL)
+		printf(" ttl %i", tginfo->ttl);
+	else
+		printf(" ttl default");
+}
+
 static void DNETMAP_save(const void *ip, const struct xt_entry_target *target)
 {
 	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
@@ -219,13 +246,6 @@ static void DNETMAP_save(const void *ip, const struct xt_entry_target *target)
 		printf(" --ttl %i ", tginfo->ttl);
 }
 
-static void DNETMAP_print(const void *ip, const struct xt_entry_target *target,
-			  int numeric)
-{
-	printf(" -j DNETMAP");
-	DNETMAP_save(ip, target);
-}
-
 static struct xtables_target dnetmap_tg_reg = {
 	.name          = MODULENAME,
 	.version       = XTABLES_VERSION,

extensions/libxt_DNETMAP.man

@@ -1,179 +1,172 @@
-.PP
+The \fBDNETMAP\fR target allows dynamic two-way 1:1 mapping of IPv4 subnets.
-The \fBDNETMAP\fR target allows dynamic two-way 1:1 mapping of IPv4 subnets. A
+Single rule can map private subnet to shorter public subnet creating and
-single rule can map a private subnet to a shorter public subnet, creating and
+maintaining unambigeous private-public ip bindings. Second rule can be used to
-maintaining unambiguous private-public IP address bindings. The second rule can
+map new flows to private subnet according to maintained bindings. Target allows
-be used to map new flows to a private subnet according to maintained bindings.
+efficient public IPv4 space usage and unambigeous NAT at the same time.
-The target allows efficient public IPv4 space usage and unambiguous NAT at the
+
-same time.
+Target can be used only in \fBnat\fR table in \fBPOSTROUTING\fR or \fBOUTPUT\fR
-.PP
+chains for SNAT and in \fBPREROUTING\fR for DNAT. Only flows directed to bound
-The target can be used only in the \fBnat\fR table in \fBPOSTROUTING\fR or
+IPs will be DNATed. Packet continues chain traversal if there is no free
-\fBOUTPUT\fR chains for SNAT, and in \fBPREROUTING\fR for DNAT. Only flows
+postnat-ip to be assigned to prenat-ip. Default binding \fBttl\fR is \fI10
-directed to bound addresses will be DNATed. The packet continues chain
+minutes\fR and can be changed using \fBdefault_ttl\fR module option. Default ip
-traversal if there is no free postnat address to be assigned to the prenat
+hash size is 256 and can be changed using \fBhash_size\fR module option.
-address. The default binding \fBTTL\fR is \fI10 minutes\fR and can be changed
+
-using the \fBdefault_ttl\fR module option. The default address hash size is 256
-and can be changed using the \fBhash_size\fR module option.
 .TP
 \fB\-\-prefix\fR \fIaddr\fR\fB/\fR\fImask\fR
-The network subnet to map to. If not specified, all existing prefixes are used.
+Network subnet to map to. If not specified, all existing prefixes are used.
 .TP
 \fB\-\-reuse\fR
-Reuse the entry for a given prenat address from any prefix even if the
+Reuse entry for given prenat-ip from any prefix despite bindings ttl < 0.
-binding's TTL is < 0.
 .TP
 \fB\-\-persistent\fR
-Set the prefix to be persistent. It will not be removed after deleting the last
+Set prefix persistent. It won't be removed after deleting last iptables rule.
-iptables rule. The option is effective only in the first rule for a given
+Option is effective only in the first rule for a given prefix. If you
-prefix. If you need to change persistency for an existing prefix, please use
+need to change persistency for existing prefix, please use proc interface
-the procfs interface described below.
+described below.
 .TP
 \fB\-\-static\fR
-Do not create dynamic mappings using this rule. Use static mappings only. Note
+Don't create dynamic mappings using this rule. Use static mappings only. Note
-that you need to create static mappings via the procfs interface for this rule
+that you need to create static mappings via proc interface for this rule with
-for this option to have any effect.
+this option to have any effect.
 .TP
 \fB\-\-ttl\fR \fIseconds\fR
-Reset the binding's TTL value to \fIseconds\fR. If a negative value is
+Regenerate bindings ttl value to \fIseconds\fR. If negative value is specified,
-specified, the binding's TTL is kept unchanged. If this option is not
+bindings ttl is kept unchanged. If not specified then default ttl value (600s)
-specified, then the default TTL value (600s) is used.
+is used.
 .PP
 \fB* /proc interface\fR
-.PP
+
-The module creates the following entries for each new specified subnet:
+Module creates following entries for each new specified subnet:
 .TP
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR
-Contains the binding table for the given \fIsubnet/mask\fP. Each line contains
+Contains binding table for subnet/mask. Each line contains \fBprenat-ip\fR,
-\fBprenat address\fR, \fBpostnat address\fR, \fBttl\fR (seconds until the entry
+\fBpostnat-ip\fR,\fBttl\fR (seconds till entry times out), \fBlasthit\fR (last
-times out), \fBlasthit\fR (last hit to the entry in seconds relative to system
+entry hit in seconds relative to system boot time). Please note that \fBttl\fR
-boot time). Please note that the \fBttl\fR and \fBlasthit\fR entries contain an
+and \fBlasthit\fR entries contain \fBS\fR in case of static binding.
-'\fBS\fR' in case of a static binding.
 .TP
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
-Contains statistics for a given \fIsubnet/mask\fP. The line contains four
+Contains statistics for given subnet/mask. Line contains contains four
-numerical values separated by spaces. The first one is the number of currently
+numerical values separated by spaces. First one is number of currently used
-used dynamic addresses (bindings with negative TTL excluded), the second one is
+dynamic addresses (bindings with negative ttl excluded), second one is number
-the number of static assignments, the third one is the number of all usable
+static assignments, third one is number of all usable addresses in subnet and
-addresses in the subnet, and the fourth one is the mean \fBTTL\fR value for all
+the fourth one is mean \fBttl\fR value for all active entries. If prefix has
-active entries. If the prefix has the persistent flag set, it will be noted as
+persistent flag set it'll be noted as fifth entry.
-fifth entry.
 .PP
-The following write operations are supported via the procfs interface:
+Following write operations are supported via proc interface:
 .TP
-echo "+\fIprenat-address\fR:\fIpostnat-address\fR" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "+\fIprenatIP\fR:\fIpostnatIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Adds a static binding between the prenat and postnap address. If
+Adds static binding between prenatIP nad postnatIP. If postnatIP is already
-postnat_address is already bound, any previous binding will be timed out
+bound, previous binding will be timedout immediatelly. Static binding is never
-immediately. A static binding is never timed out.
+timedout.
 .TP
-echo "\-\fIaddress\fR" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "-\fIIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Removes the binding with \fIaddress\fR as prenat or postnat address. If the
+Removes binding with \fIIP\fR as prenat or postnat address. If removed binding
-removed binding is currently static, it will make the entry available for
+is currently static, it'll make entry available for dynamic allocation.
-dynamic allocation.
 .TP
-echo "+persistent" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "+persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Sets the persistent flag for the prefix. It is useful if you do not want
+Sets persistent flag for prefix. It's usefull if you don't want bindings to get
-bindings to get flushed when the firewall is restarted. You can check if the
+flushed when firewall is restarted. You can check if prefix is persistent by
-prefix is persistent by printing the contents of
+printing \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
-\fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR.
+contents.
 .TP
-echo "\-persistent" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "-persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Unsets the persistent flag for the prefix. In this mode, the prefix will be
+Unsets persistent flag for prefix. In this mode prefix will be deleted if the
-deleted if the last iptables rule for that prefix is removed.
+last iptables rule for that prefix is removed.
 .TP
-echo "flush" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "flush" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Flushes all bindings for the specific prefix. All static entries are also
+Flushes all bindings for specific prefix. All static entries are also flushed
-flushed and become available for dynamic bindings.
+and are available for dynamic bindings.
 .PP
 Note! Entries are removed if the last iptables rule for a specific prefix is
-deleted unless the persistent flag is set.
+deleted unless there's persistent flag set.
 .PP
+
 \fB* Logging\fR
-.PP
+
-The module logs binding add/timeout events to klog. This behaviour can be
+Module logs binding add/timeout events to klog. This behaviour can be disabled
-disabled using the \fBdisable_log\fR module parameter.
+using \fBdisable_log\fR module parameter.
-.PP
+
 \fB* Examples\fR
-.PP
+
 \fB1.\fR Map subnet 192.168.0.0/24 to subnets 20.0.0.0/26. SNAT only:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-.PP
+
-Active hosts from the 192.168.0.0/24 subnet are mapped to 20.0.0.0/26. If the
+Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26. If packet
-packet from a not yet bound prenat address hits the rule and there are no free
+from not yet bound prenat-ip hits the rule and there are no free or timed-out
-or timed-out (TTL<0) entries in prefix 20.0.0.0/28, then a notice is logged to
+(ttl<0) entries in prefix 20.0.0.0/28, then notice is logged to klog and chain
-klog and chain traversal continues. If packet from an already-bound prenat
+traversal continues. If packet from already bound prenat-ip hits the rule,
-address hits the rule, the binding's TTL value is reset to default_ttl and SNAT
+bindings ttl value is regenerated to default_ttl and SNAT is performed.
-is performed.
+
-.PP
 \fB2.\fR Use of \fB\-\-reuse\fR and \fB\-\-ttl\fR switches, multiple rule
 interaction:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix
-20.0.0.0/26 \-\-reuse \-\-ttl 200
+20.0.0.0/26 --reuse --ttl 200
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 30.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 30.0.0.0/26
-.PP
+
-Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26 with TTL =
+Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26 with ttl =
-200 seconds. If there are no free addresses in first prefix, the next one
+200 seconds. If there are no free addresses in first prefix the next one
-(30.0.0.0/26) is used with the default TTL. It is important to note that the
+(30.0.0.0/26) is used with default ttl. It's important to note that the first
-first rule SNATs all flows whose source address is already actively bound
+rule SNATs all flows whose source IP is already actively (ttl>0) bound to ANY
-(TTL>0) to ANY prefix. The \fB\-\-reuse\fR parameter makes this functionality
+prefix. Parameter \fB\-\-reuse\fR makes this functionality work even for
-work even for inactive (TTL<0) entries.
+inactive (ttl<0) entries.
-.PP
+
-If both subnets are exhausted, then chain traversal continues.
+If both subnets are exhaused, then chain traversal continues.
-.PP
+
-\fB3.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 in a bidirectional way:
+\fB3.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 bidirectional way:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-.PP
+
-iptables \-t nat \-A PREROUTING \-j DNETMAP
+iptables -t nat -A PREROUTING -j DNETMAP
-.PP
+
-If the host 192.168.0.10 generates some traffic, it gets bound to first free
+If host 192.168.0.10 generates some traffic, it gets bound to first free IP in
-address in the subnet \(em 20.0.0.0. Now, any traffic directed to 20.0.0.0 gets
+subnet - 20.0.0.0. Now any traffic directed to 20.0.0.0 gets DNATed to
-DNATed to 192.168.0.10 as long as there is an active (TTL>0) binding. There is
+192.168.0.10 as long as there's an active (ttl>0) binding. There's no need to
-no need to specify \fB\-\-prefix\fR parameter in a PREROUTING rule, because
+specify \fB\-\-prefix\fR parameter in PREROUTING rule, because this way it DNATs
-this way, it DNATs traffic to all active prefixes. You could specify the prefix
+traffic to all active prefixes. You could specify prefix it you'd like to make
-you would like to make DNAT work for a specific prefix only.
+DNAT work for specific prefix only.
-.PP
+
-\fB4.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 with static assignments
+\fB4.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 with static assignments only:
-only:
+
-.PP
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+--static
-\-\-static
+
-.PP
+echo "+192.168.0.10:20.0.0.1" > /proc/net/xt_DNETMAP/20.0.0.0_26
-echo "+192.168.0.10:20.0.0.1" >/proc/net/xt_DNETMAP/20.0.0.0_26
 .br
-echo "+192.168.0.11:20.0.0.2" >/proc/net/xt_DNETMAP/20.0.0.0_26
+echo "+192.168.0.11:20.0.0.2" > /proc/net/xt_DNETMAP/20.0.0.0_26
 .br
-echo "+192.168.0.51:20.0.0.3" >/proc/net/xt_DNETMAP/20.0.0.0_26
+echo "+192.168.0.51:20.0.0.3" > /proc/net/xt_DNETMAP/20.0.0.0_26
-.PP
+
 This configuration will allow only preconfigured static bindings to work due to
-the \fBstatic\fR rule option. Without this flag, dynamic bindings would be
+\fBstatic\fR rule option. Without this flag dynamic bindings would be created
-created using non-static entries.
+using non-static entries.
-.PP
+
 \fB5.\fR Persistent prefix:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-\-\-persistent
+--persistent
 .br
 \fBor\fR
 .br
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
 .br
-echo "+persistent" >/proc/net/xt_DNETMAP/20.0.0.0_26
+echo "+persistent" > /proc/net/xt_DNETMAP/20.0.0.0_26
-.PP
+
-Now, we can check the persistent flag of the prefix:
+Now we can check persistent flag of the prefix:
 .br
 cat /proc/net/xt_DNETMAP/20.0.0.0_26
 .br
 0 0 64 0 \fBpersistent\fR
-.PP
+
-Flush the iptables nat table and see that prefix is still in existence:
+Flush iptables nat table and see that prefix is still in existence:
 .br
-iptables \-F \-t nat
+iptables -F -t nat
 .br
-ls \-l /proc/net/xt_DNETMAP
+ls -l /proc/net/xt_DNETMAP
 .br
-\-rw\-r\-\-r\-\- 1 root root 0 06\-10 09:01 20.0.0.0_26
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26
 .br
-\-rw\-r\-\-r\-\- 1 root root 0 06\-10 09:01 20.0.0.0_26_stat
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26_stat
 .

extensions/libxt_ECHO.man

@@ -1,4 +1,3 @@
-.PP
 The \fBECHO\fP target will send back all packets it received. It serves as an
 examples for an Xtables target.
 .PP

extensions/libxt_IPMARK.c

@@ -112,6 +112,25 @@ static void ipmark_tg_check(unsigned int flags)
 		           "IPMARK target: Parameter --addr is required");
 }
 
+static void
+ipmark_tg_print(const void *entry, const struct xt_entry_target *target,
+                int numeric)
+{
+	const struct xt_ipmark_tginfo *info = (const void *)target->data;
+
+	if (info->selector == XT_IPMARK_SRC)
+		printf(" IPMARK src ip ");
+	else
+		printf(" IPMARK dst ip ");
+
+	if (info->shift != 0)
+		printf(" shift %u ", (unsigned int)info->shift);
+	if (info->andmask != ~0U)
+		printf(" and 0x%x ", (unsigned int)info->andmask);
+	if (info->ormask != 0)
+		printf(" or 0x%x ", (unsigned int)info->ormask);
+}
+
 static void
 ipmark_tg_save(const void *entry, const struct xt_entry_target *target)
 {
@@ -130,14 +149,6 @@ ipmark_tg_save(const void *entry, const struct xt_entry_target *target)
 		printf(" --or-mask 0x%x ", (unsigned int)info->ormask);
 }
 
-static void
-ipmark_tg_print(const void *entry, const struct xt_entry_target *target,
-                int numeric)
-{
-	printf(" -j IPMARK");
-	ipmark_tg_save(entry, target);
-}
-
 static struct xtables_target ipmark_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "IPMARK",

extensions/libxt_IPMARK.man

@@ -1,8 +1,7 @@
-.PP
 Allows you to mark a received packet basing on its IP address. This
 can replace many mangle/mark entries with only one, if you use
 firewall based classifier.
-.PP
+
 This target is to be used inside the \fBmangle\fP table.
 .TP
 \fB\-\-addr\fP {\fBsrc\fP|\fBdst\fP}

extensions/libxt_LOGMARK.c

@@ -77,6 +77,15 @@ logmark_tg_parse(int c, char **argv, int invert, unsigned int *flags,
 	return false;
 }
 
+static void
+logmark_tg_print(const void *ip, const struct xt_entry_target *target,
+                 int numeric)
+{
+	const struct xt_logmark_tginfo *info = (void *)target->data;
+
+	printf(" LOGMARK level %u prefix \"%s\" ", info->level, info->prefix);
+}
+
 static void
 logmark_tg_save(const void *ip, const struct xt_entry_target *target)
 {
@@ -88,14 +97,6 @@ logmark_tg_save(const void *ip, const struct xt_entry_target *target)
 		printf(" --log-prefix \"%s\" ", info->prefix);
 }
 
-static void
-logmark_tg_print(const void *ip, const struct xt_entry_target *target,
-                 int numeric)
-{
-	printf(" -j LOGMARK");
-	logmark_tg_save(ip, target);
-}
-
 static struct xtables_target logmark_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "LOGMARK",

extensions/libxt_LOGMARK.man

@@ -1,4 +1,3 @@
-.PP
 The LOGMARK target will log packet and connection marks to syslog.
 .TP
 \fB\-\-log\-level\fR \fIlevel\fR

extensions/libxt_RAWDNAT.c

@@ -0,0 +1,189 @@
+/*
+ *	"RAWNAT" target extension for iptables
+ *	Copyright © Jan Engelhardt, 2008 - 2009
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
+ */
+#include <netinet/in.h>
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#include <xtables.h>
+#include <linux/netfilter.h>
+#include "xt_RAWNAT.h"
+#include "compat_user.h"
+
+enum {
+	FLAGS_TO = 1 << 0,
+};
+
+static const struct option rawdnat_tg_opts[] = {
+	{.name = "to-destination", .has_arg = true, .val = 't'},
+	{},
+};
+
+static void rawdnat_tg_help(void)
+{
+	printf(
+"RAWDNAT target options:\n"
+"    --to-destination addr[/mask]    Address or network to map to\n"
+);
+}
+
+static int
+rawdnat_tg4_parse(int c, char **argv, int invert, unsigned int *flags,
+                  const void *entry, struct xt_entry_target **target)
+{
+	struct xt_rawnat_tginfo *info = (void *)(*target)->data;
+	struct in_addr *a;
+	unsigned int mask;
+	char *end;
+
+	switch (c) {
+	case 't':
+		info->mask = 32;
+		end = strchr(optarg, '/');
+		if (end != NULL) {
+			*end++ = '\0';
+			if (!xtables_strtoui(end, NULL, &mask, 0, 32))
+				xtables_param_act(XTF_BAD_VALUE, "RAWDNAT",
+					"--to-destination", optarg);
+			info->mask = mask;
+		}
+		a = xtables_numeric_to_ipaddr(optarg);
+		if (a == NULL)
+			xtables_param_act(XTF_BAD_VALUE, "RAWDNAT",
+				"--to-destination", optarg);
+		memcpy(&info->addr.in, a, sizeof(*a));
+		*flags |= FLAGS_TO;
+		return true;
+	}
+	return false;
+}
+
+static int
+rawdnat_tg6_parse(int c, char **argv, int invert, unsigned int *flags,
+                  const void *entry, struct xt_entry_target **target)
+{
+	struct xt_rawnat_tginfo *info = (void *)(*target)->data;
+	struct in6_addr *a;
+	unsigned int mask;
+	char *end;
+
+	switch (c) {
+	case 't':
+		info->mask = 128;
+		end = strchr(optarg, '/');
+		if (end != NULL) {
+			*end++ = '\0';
+			if (!xtables_strtoui(end, NULL, &mask, 0, 128))
+				xtables_param_act(XTF_BAD_VALUE, "RAWDNAT",
+					"--to-destination", optarg);
+			info->mask = mask;
+		}
+		a = xtables_numeric_to_ip6addr(optarg);
+		if (a == NULL)
+			xtables_param_act(XTF_BAD_VALUE, "RAWDNAT",
+				"--to-destination", optarg);
+		memcpy(&info->addr.in6, a, sizeof(*a));
+		*flags |= FLAGS_TO;
+		return true;
+	}
+	return false;
+}
+
+static void rawdnat_tg_check(unsigned int flags)
+{
+	if (!(flags & FLAGS_TO))
+		xtables_error(PARAMETER_PROBLEM, "RAWDNAT: "
+			"\"--to-destination\" is required.");
+}
+
+static void
+rawdnat_tg4_print(const void *entry, const struct xt_entry_target *target,
+                  int numeric)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	if (!numeric && info->mask == 32)
+		printf(" to-destination %s ",
+		       xtables_ipaddr_to_anyname(&info->addr.in));
+	else
+		printf(" to-destination %s/%u ",
+		       xtables_ipaddr_to_numeric(&info->addr.in), info->mask);
+}
+
+static void
+rawdnat_tg6_print(const void *entry, const struct xt_entry_target *target,
+                  int numeric)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	if (!numeric && info->mask == 128)
+		printf(" to-destination %s ",
+		       xtables_ip6addr_to_anyname(&info->addr.in6));
+	else
+		printf(" to-destination %s/%u ",
+		       xtables_ip6addr_to_numeric(&info->addr.in6), info->mask);
+}
+
+static void
+rawdnat_tg4_save(const void *entry, const struct xt_entry_target *target)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	printf(" --to-destination %s/%u ",
+	       xtables_ipaddr_to_numeric(&info->addr.in),
+	       info->mask);
+}
+
+static void
+rawdnat_tg6_save(const void *entry, const struct xt_entry_target *target)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	printf(" --to-destination %s/%u ",
+	       xtables_ip6addr_to_numeric(&info->addr.in6),
+	       info->mask);
+}
+
+static struct xtables_target rawdnat_tg_reg[] = {
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWDNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV4,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawdnat_tg_help,
+		.parse         = rawdnat_tg4_parse,
+		.final_check   = rawdnat_tg_check,
+		.print         = rawdnat_tg4_print,
+		.save          = rawdnat_tg4_save,
+		.extra_opts    = rawdnat_tg_opts,
+	},
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWDNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV6,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawdnat_tg_help,
+		.parse         = rawdnat_tg6_parse,
+		.final_check   = rawdnat_tg_check,
+		.print         = rawdnat_tg6_print,
+		.save          = rawdnat_tg6_save,
+		.extra_opts    = rawdnat_tg_opts,
+	},
+};
+
+static void _init(void)
+{
+	xtables_register_targets(rawdnat_tg_reg,
+		sizeof(rawdnat_tg_reg) / sizeof(*rawdnat_tg_reg));
+}

extensions/libxt_RAWDNAT.man

@@ -0,0 +1,10 @@
+The \fBRAWDNAT\fR target will rewrite the destination address in the IP header,
+much like the \fBNETMAP\fR target.
+.TP
+\fB\-\-to\-destination\fR \fIaddr\fR[\fB/\fR\fImask\fR]
+Network address to map to. The resulting address will be constructed the
+following way: All 'one' bits in the \fImask\fR are filled in from the new
+\fIaddress\fR. All bits that are zero in the mask are filled in from the
+original address.
+.PP
+See the \fBRAWSNAT\fR help entry for examples and constraints.

extensions/libxt_RAWSNAT.c

@@ -0,0 +1,189 @@
+/*
+ *	"RAWNAT" target extension for iptables
+ *	Copyright © Jan Engelhardt, 2008 - 2009
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
+ */
+#include <netinet/in.h>
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <string.h>
+#include <xtables.h>
+#include <linux/netfilter.h>
+#include "xt_RAWNAT.h"
+#include "compat_user.h"
+
+enum {
+	FLAGS_TO = 1 << 0,
+};
+
+static const struct option rawsnat_tg_opts[] = {
+	{.name = "to-source", .has_arg = true, .val = 't'},
+	{},
+};
+
+static void rawsnat_tg_help(void)
+{
+	printf(
+"RAWSNAT target options:\n"
+"    --to-source addr[/mask]    Address or network to map to\n"
+);
+}
+
+static int
+rawsnat_tg4_parse(int c, char **argv, int invert, unsigned int *flags,
+                  const void *entry, struct xt_entry_target **target)
+{
+	struct xt_rawnat_tginfo *info = (void *)(*target)->data;
+	struct in_addr *a;
+	unsigned int mask;
+	char *end;
+
+	switch (c) {
+	case 't':
+		info->mask = 32;
+		end = strchr(optarg, '/');
+		if (end != NULL) {
+			*end++ = '\0';
+			if (!xtables_strtoui(end, NULL, &mask, 0, 32))
+				xtables_param_act(XTF_BAD_VALUE, "RAWSNAT",
+					"--to-source", optarg);
+			info->mask = mask;
+		}
+		a = xtables_numeric_to_ipaddr(optarg);
+		if (a == NULL)
+			xtables_param_act(XTF_BAD_VALUE, "RAWSNAT",
+				"--to-source", optarg);
+		memcpy(&info->addr.in, a, sizeof(*a));
+		*flags |= FLAGS_TO;
+		return true;
+	}
+	return false;
+}
+
+static int
+rawsnat_tg6_parse(int c, char **argv, int invert, unsigned int *flags,
+                  const void *entry, struct xt_entry_target **target)
+{
+	struct xt_rawnat_tginfo *info = (void *)(*target)->data;
+	struct in6_addr *a;
+	unsigned int mask;
+	char *end;
+
+	switch (c) {
+	case 't':
+		info->mask = 128;
+		end = strchr(optarg, '/');
+		if (end != NULL) {
+			*end++ = '\0';
+			if (!xtables_strtoui(end, NULL, &mask, 0, 128))
+				xtables_param_act(XTF_BAD_VALUE, "RAWSNAT",
+					"--to-source", optarg);
+			info->mask = mask;
+		}
+		a = xtables_numeric_to_ip6addr(optarg);
+		if (a == NULL)
+			xtables_param_act(XTF_BAD_VALUE, "RAWSNAT",
+				"--to-source", optarg);
+		memcpy(&info->addr.in6, a, sizeof(*a));
+		*flags |= FLAGS_TO;
+		return true;
+	}
+	return false;
+}
+
+static void rawsnat_tg_check(unsigned int flags)
+{
+	if (!(flags & FLAGS_TO))
+		xtables_error(PARAMETER_PROBLEM, "RAWSNAT: "
+			"\"--to-source\" is required.");
+}
+
+static void
+rawsnat_tg4_print(const void *entry, const struct xt_entry_target *target,
+                  int numeric)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	if (!numeric && info->mask == 32)
+		printf(" to-source %s ",
+		       xtables_ipaddr_to_anyname(&info->addr.in));
+	else
+		printf(" to-source %s/%u ",
+		       xtables_ipaddr_to_numeric(&info->addr.in), info->mask);
+}
+
+static void
+rawsnat_tg6_print(const void *entry, const struct xt_entry_target *target,
+                  int numeric)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	if (!numeric && info->mask == 128)
+		printf(" to-source %s ",
+		       xtables_ip6addr_to_anyname(&info->addr.in6));
+	else
+		printf(" to-source %s/%u ",
+		       xtables_ip6addr_to_numeric(&info->addr.in6), info->mask);
+}
+
+static void
+rawsnat_tg4_save(const void *entry, const struct xt_entry_target *target)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	printf(" --to-source %s/%u ",
+	       xtables_ipaddr_to_numeric(&info->addr.in),
+	       info->mask);
+}
+
+static void
+rawsnat_tg6_save(const void *entry, const struct xt_entry_target *target)
+{
+	const struct xt_rawnat_tginfo *info = (const void *)target->data;
+
+	printf(" --to-source %s/%u ",
+	       xtables_ip6addr_to_numeric(&info->addr.in6),
+	       info->mask);
+}
+
+static struct xtables_target rawsnat_tg_reg[] = {
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWSNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV4,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawsnat_tg_help,
+		.parse         = rawsnat_tg4_parse,
+		.final_check   = rawsnat_tg_check,
+		.print         = rawsnat_tg4_print,
+		.save          = rawsnat_tg4_save,
+		.extra_opts    = rawsnat_tg_opts,
+	},
+	{
+		.version       = XTABLES_VERSION,
+		.name          = "RAWSNAT",
+		.revision      = 0,
+		.family        = NFPROTO_IPV6,
+		.size          = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_rawnat_tginfo)),
+		.help          = rawsnat_tg_help,
+		.parse         = rawsnat_tg6_parse,
+		.final_check   = rawsnat_tg_check,
+		.print         = rawsnat_tg6_print,
+		.save          = rawsnat_tg6_save,
+		.extra_opts    = rawsnat_tg_opts,
+	},
+};
+
+static void _init(void)
+{
+	xtables_register_targets(rawsnat_tg_reg,
+		sizeof(rawsnat_tg_reg) / sizeof(*rawsnat_tg_reg));
+}

extensions/libxt_RAWSNAT.man

@@ -0,0 +1,38 @@
+The \fBRAWSNAT\fR and \fBRAWDNAT\fP targets provide stateless network address
+translation.
+.PP
+The \fBRAWSNAT\fR target will rewrite the source address in the IP header, much
+like the \fBNETMAP\fP target. \fBRAWSNAT\fP (and \fBRAWDNAT\fP) may only be
+used in the \fBraw\fP or \fBrawpost\fP tables, but can be used in all chains,
+which makes it possible to change the source address either when the packet
+enters the machine or when it leaves it. The reason for this table constraint
+is that RAWNAT must happen outside of connection tracking.
+.TP
+\fB\-\-to\-source\fR \fIaddr\fR[\fB/\fR\fImask\fR]
+Network address to map to. The resulting address will be constructed the
+following way: All 'one' bits in the \fImask\fR are filled in from the new
+\fIaddress\fR. All bits that are zero in the mask are filled in from the
+original address.
+.PP
+As an example, changing the destination for packets forwarded from an internal
+LAN to the internet:
+.IP
+\-t raw \-A PREROUTING \-i lan0 \-d 212.201.100.135 \-j RAWDNAT \-\-to\-destination 199.181.132.250;
+\-t rawpost \-A POSTROUTING \-o lan0 \-s 199.181.132.250 \-j RAWSNAT \-\-to\-source 212.201.100.135;
+.PP
+Note that changing addresses may influence the route selection! Specifically,
+it statically NATs packets, not connections, like the normal DNAT/SNAT targets
+would do. Also note that it can transform already-NATed connections \(em as
+said, it is completely external to Netfilter's connection tracking/NAT.
+.PP
+If the machine itself generates packets that are to be rawnat'ed, you need a
+rule in the OUTPUT chain instead, just like you would with the stateful NAT
+targets.
+.PP
+It may be necessary that in doing so, you also need an extra RAWSNAT rule, to
+override the automatic source address selection that the routing code does
+before passing packets to iptables. If the connecting socket has not been
+explicitly bound to an address, as is the common mode of operation, the address
+that will be chosen is the primary address of the device through which the
+packet would be routed with its initial destination address - the address as
+seen before any RAWNAT takes place.

extensions/libxt_STEAL.c

@@ -0,0 +1,32 @@
+#include <stdio.h>
+#include <xtables.h>
+#include "compat_user.h"
+
+static void steal_tg_help(void)
+{
+	printf("STEAL takes no options\n\n");
+}
+
+static int steal_tg_parse(int c, char **argv, int invert, unsigned int *flags,
+                          const void *entry, struct xt_entry_target **target)
+{
+	return 0;
+}
+
+static void steal_tg_check(unsigned int flags)
+{
+}
+
+static struct xtables_target steal_tg_reg = {
+	.version       = XTABLES_VERSION,
+	.name          = "STEAL",
+	.family        = NFPROTO_UNSPEC,
+	.help          = steal_tg_help,
+	.parse         = steal_tg_parse,
+	.final_check   = steal_tg_check,
+};
+
+static void _init(void)
+{
+	xtables_register_target(&steal_tg_reg);
+}

extensions/libxt_STEAL.man

@@ -0,0 +1,2 @@
+Like the DROP target, but does not throw an error like DROP when used in the
+\fBOUTPUT\fP chain.

extensions/libxt_SYSRQ.man

@@ -1,4 +1,3 @@
-.PP
 The SYSRQ target allows to remotely trigger sysrq on the local machine over the
 network. This can be useful when vital parts of the machine hang, for example
 an oops in a filesystem causing locks to be not released and processes to get

extensions/libxt_TARPIT.c

@@ -67,6 +67,24 @@ static void tarpit_tg_check(unsigned int flags)
 			"TARPIT: only one action can be used at a time");
 }
 
+static void tarpit_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_tarpit_tginfo *info = (void *)target->data;
+
+	switch (info->variant) {
+	case XTTARPIT_HONEYPOT:
+		printf(" honeypot mode ");
+		break;
+	case XTTARPIT_RESET:
+		printf(" reset mode ");
+		break;
+	default:
+		printf(" tarpit mode ");
+		break;
+	}
+}
+
 static void tarpit_tg_save(const void *ip,
     const struct xt_entry_target *target)
 {
@@ -85,13 +103,6 @@ static void tarpit_tg_save(const void *ip,
 	}
 }
 
-static void tarpit_tg_print(const void *ip,
-    const struct xt_entry_target *target, int numeric)
-{
-	printf(" -j TARPIT");
-	tarpit_tg_save(ip, target);
-}
-
 static struct xtables_target tarpit_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "TARPIT",

extensions/libxt_TARPIT.man

@@ -1,4 +1,3 @@
-.PP
 Captures and holds incoming TCP connections using no local per-connection
 resources.
 .PP

extensions/libxt_condition.c

@@ -62,6 +62,15 @@ static void condition_check(unsigned int flags)
 			   "Condition match: must specify --condition");
 }
 
+static void condition_print(const void *ip, const struct xt_entry_match *match,
+                            int numeric)
+{
+	const struct xt_condition_mtinfo *info = (const void *)match->data;
+
+	printf(" condition %s%s ", (info->invert) ? "!" : "", info->name);
+}
+
+
 static void condition_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_condition_mtinfo *info = (const void *)match->data;
@@ -69,13 +78,6 @@ static void condition_save(const void *ip, const struct xt_entry_match *match)
 	printf("%s --condition \"%s\" ", info->invert ? " !" : "", info->name);
 }
 
-static void condition_print(const void *ip, const struct xt_entry_match *match,
-                            int numeric)
-{
-	printf(" -m condition");
-	condition_save(ip, match);
-}
-
 static struct xtables_match condition_mt_reg = {
 	.name 		= "condition",
 	.revision	= 1,

extensions/libxt_condition.man

@@ -1,4 +1,3 @@
-.PP
 This matches if a specific condition variable is (un)set.
 .TP
 [\fB!\fP] \fB\-\-condition\fP \fIname\fP

extensions/libxt_dhcpmac.c

@@ -62,6 +62,15 @@ static void dhcpmac_mt_check(unsigned int flags)
 		           "--mac parameter required");
 }
 
+static void dhcpmac_mt_print(const void *ip,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct dhcpmac_info *info = (void *)match->data;
+
+	printf(" dhcpmac %s" DH_MAC_FMT "/%u ",
+	       info->invert ? "!" : "", DH_MAC_HEX(info->addr), info->mask);
+}
+
 static void dhcpmac_mt_save(const void *ip,
     const struct xt_entry_match *match)
 {
@@ -73,13 +82,6 @@ static void dhcpmac_mt_save(const void *ip,
 	       DH_MAC_HEX(info->addr), info->mask);
 }
 
-static void dhcpmac_mt_print(const void *ip,
-    const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m dhcpmac");
-	dhcpmac_mt_save(ip, match);
-}
-
 static struct xtables_match dhcpmac_mt_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "dhcpmac",

extensions/libxt_fuzzy.c

@@ -83,6 +83,15 @@ static void fuzzy_mt_check(unsigned int flags)
 {
 }
 
+static void fuzzy_mt_print(const void *ip, const struct xt_entry_match *match,
+                           int numeric)
+{
+	const struct xt_fuzzy_mtinfo *info = (const void *)match->data;
+
+	printf(" fuzzy: lower limit = %u pps - upper limit = %u pps ",
+	       info->minimum_rate, info->maximum_rate);
+}
+
 static void fuzzy_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_fuzzy_mtinfo *info = (const void *)match->data;
@@ -91,13 +100,6 @@ static void fuzzy_mt_save(const void *ip, const struct xt_entry_match *match)
 	printf(" --upper-limit %u ", info->maximum_rate);
 }
 
-static void fuzzy_mt_print(const void *ip, const struct xt_entry_match *match,
-                           int numeric)
-{
-	printf(" -m fuzzy");
-	fuzzy_mt_save(ip, match);
-}
-
 static struct xtables_match fuzzy_mt_reg = {
 	.name          = "fuzzy",
 	.revision      = 1,

extensions/libxt_fuzzy.man

@@ -1,4 +1,3 @@
-.PP
 This module matches a rate limit based on a fuzzy logic controller (FLC).
 .TP
 \fB\-\-lower\-limit\fP \fInumber\fP

extensions/libxt_geoip.c

@@ -251,6 +251,31 @@ geoip_final_check(unsigned int flags)
 			"geoip: missing arguments");
 }
 
+static void
+geoip_print(const void *ip, const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_geoip_match_info *info = (void*)match->data;
+
+	u_int8_t i;
+
+	if (info->flags & XT_GEOIP_SRC)
+		printf(" Source ");
+	else
+		printf(" Destination ");
+
+	if (info->count > 1)
+		printf("countries: ");
+	else
+		printf("country: ");
+
+	if (info->flags & XT_GEOIP_INV)
+		printf("! ");
+
+	for (i = 0; i < info->count; i++)
+		 printf("%s%c%c", i ? "," : "", COUNTRY(info->cc[i]));
+	printf(" ");
+}
+
 static void
 geoip_save(const void *ip, const struct xt_entry_match *match)
 {
@@ -270,13 +295,6 @@ geoip_save(const void *ip, const struct xt_entry_match *match)
 	printf(" ");
 }
 
-static void
-geoip_print(const void *ip, const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m geoip");
-	geoip_save(ip, match);
-}
-
 static struct xtables_match geoip_match[] = {
 	{
 		.family        = NFPROTO_IPV6,

extensions/libxt_geoip.man

@@ -1,4 +1,3 @@
-.PP
 Match a packet by its source or destination country.
 .TP
 [\fB!\fP] \fB\-\-src\-cc\fP, \fB\-\-source\-country\fP \fIcountry\fP[\fB,\fP\fIcountry\fP\fB...\fP]
@@ -16,8 +15,8 @@ with the source package, and which should be available in compiled packages in
 /usr/lib(exec)/xtables-addons/. The first command retrieves CSV files from
 MaxMind, while the other two build packed bisectable range files:
 .PP
-mkdir \-p /usr/share/xt_geoip; cd /tmp; $path/to/xt_geoip_dl;
+mkdir -p /usr/share/xt_geoip; cd /tmp; $path/to/xt_geoip_dl;
 .PP
-$path/to/xt_geoip_build \-D /usr/share/xt_geoip GeoIP*.csv;
+$path/to/xt_geoip_build -D /usr/share/xt_geoip GeoIP*.csv;
 .PP
 The shared library is hardcoded to look in these paths, so use them.

extensions/libxt_gradm.c

@@ -57,6 +57,17 @@ static void gradm_mt_check(unsigned int flags)
 {
 }
 
+static void gradm_mt_print(const void *ip, const struct xt_entry_match *match,
+                           int numeric)
+{
+	const struct xt_gradm_mtinfo *info = (const void *)match->data;
+
+	if (info->invflags)
+		printf("gradm: disabled");
+	else
+		printf("gradm: enabled");
+}
+
 static void gradm_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_gradm_mtinfo *info = (const void *)match->data;
@@ -67,13 +78,6 @@ static void gradm_mt_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --enabled ");
 }
 
-static void gradm_mt_print(const void *ip, const struct xt_entry_match *match,
-                           int numeric)
-{
-	printf(" -m gradm");
-	gradm_mt_save(ip, match);
-}
-
 static struct xtables_match gradm_mt_reg = {
 	.family        = NFPROTO_UNSPEC,
 	.name          = "gradm",

extensions/libxt_gradm.man

@@ -1,4 +1,3 @@
-.PP
 This module matches packets based on grsecurity RBAC status.
 .TP
 [\fB!\fP] \fB\-\-enabled\fP

extensions/libxt_iface.c

@@ -175,6 +175,33 @@ static void iface_mt_check(unsigned int flags)
 			"iface: You must specify at least one option");
 }
 
+static void iface_mt_print(const void *ip, const struct xt_entry_match *match,
+    int numeric)
+{
+	const struct xt_iface_mtinfo *info = (const void *)match->data;
+
+	printf(" iface: ");
+	if (info->flags & XT_IFACE_DEV_IN)
+		printf("(in)");
+	else if (info->flags & XT_IFACE_DEV_OUT)
+		printf("(out)");
+	else
+		printf("%s", info->ifname);
+	printf(" [state:");
+	iface_print_opt(info, XT_IFACE_UP,          "up");
+	iface_print_opt(info, XT_IFACE_BROADCAST,   "broadcast");
+	iface_print_opt(info, XT_IFACE_LOOPBACK,    "loopback");
+	iface_print_opt(info, XT_IFACE_POINTOPOINT, "pointopoint");
+	iface_print_opt(info, XT_IFACE_RUNNING,     "running");
+	iface_print_opt(info, XT_IFACE_NOARP,       "noarp");
+	iface_print_opt(info, XT_IFACE_PROMISC,     "promisc");
+	iface_print_opt(info, XT_IFACE_MULTICAST,   "multicast");
+	iface_print_opt(info, XT_IFACE_DYNAMIC,     "dynamic");
+	iface_print_opt(info, XT_IFACE_LOWER_UP,    "lower_up");
+	iface_print_opt(info, XT_IFACE_DORMANT,     "dormant");
+	printf("] ");
+}
+
 static void iface_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_iface_mtinfo *info = (const void *)match->data;
@@ -199,13 +226,6 @@ static void iface_mt_save(const void *ip, const struct xt_entry_match *match)
 	printf(" ");
 }
 
-static void iface_mt_print(const void *ip, const struct xt_entry_match *match,
-    int numeric)
-{
-	printf(" -m iface");
-	iface_mt_save(ip, match);
-}
-
 static struct xtables_match iface_mt_reg = {
 	.version	= XTABLES_VERSION,
 	.name		= "iface",

extensions/libxt_iface.man

@@ -1,4 +1,3 @@
-.PP
 Allows you to check interface states. First, an interface needs to be selected
 for comparison. Exactly one option of the following three must be specified:
 .TP

extensions/libxt_ipaddr.c

@@ -0,0 +1,254 @@
+/*
+ *	"ipaddr" demo match extension for iptables
+ *	written by Jan Engelhardt <jengelh [at] medozas de>, 2008 - 2009
+ *	released in the Public Domain
+ */
+#include <arpa/inet.h>
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <xtables.h>
+#include <linux/netfilter.h>
+#include "xt_ipaddr.h"
+
+static const struct option ipaddr_mt_opts[] = {
+	{.name = "ipsrc", .has_arg = true, .val = '1'},
+	{.name = "ipdst", .has_arg = true, .val = '2'},
+	{NULL},
+};
+
+static void ipaddr_mt_help(void)
+{
+	printf(
+"ipaddr match options:\n"
+"[!] --ipsrc addr    Match source address of packet\n"
+"[!] --ipdst addr    Match destination address of packet\n"
+);
+}
+
+static void ipaddr_mt_init(struct xt_entry_match *match)
+{
+	struct xt_ipaddr_mtinfo *info = (void *)match->data;
+
+	inet_pton(PF_INET, "192.0.2.137", &info->dst.in);
+}
+
+static int ipaddr_mt4_parse(int c, char **argv, int invert,
+    unsigned int *flags, const void *entry, struct xt_entry_match **match)
+{
+	struct xt_ipaddr_mtinfo *info = (void *)(*match)->data;
+	struct in_addr *addrs, mask;
+	unsigned int naddrs;
+
+	switch (c) {
+	case '1': /* --ipsrc */
+		if (*flags & XT_IPADDR_SRC)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Only use \"--ipsrc\" once!");
+		*flags |= XT_IPADDR_SRC;
+		info->flags |= XT_IPADDR_SRC;
+		if (invert)
+			info->flags |= XT_IPADDR_SRC_INV;
+		xtables_ipparse_any(optarg, &addrs, &mask, &naddrs);
+		if (naddrs != 1)
+			xtables_error(PARAMETER_PROBLEM,
+				"%s does not resolve to exactly "
+				"one address", optarg);
+		memcpy(&info->src.in, addrs, sizeof(*addrs));
+		return true;
+
+
+	case '2': /* --ipdst */
+		if (*flags & XT_IPADDR_DST)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Only use \"--ipdst\" once!");
+		*flags |= XT_IPADDR_DST;
+		info->flags |= XT_IPADDR_DST;
+		if (invert)
+			info->flags |= XT_IPADDR_DST_INV;
+		addrs = xtables_numeric_to_ipaddr(optarg);
+		if (addrs == NULL)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Parse error at %s\n", optarg);
+		memcpy(&info->dst.in, addrs, sizeof(*addrs));
+		return true;
+	}
+
+	return false;
+}
+
+static int ipaddr_mt6_parse(int c, char **argv, int invert,
+    unsigned int *flags, const void *entry, struct xt_entry_match **match)
+{
+	struct xt_ipaddr_mtinfo *info = (void *)(*match)->data;
+	struct in6_addr *addrs;
+
+	switch (c) {
+	case '1': /* --ipsrc */
+		if (*flags & XT_IPADDR_SRC)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Only use \"--ipsrc\" once!");
+		*flags |= XT_IPADDR_SRC;
+		info->flags |= XT_IPADDR_SRC;
+		if (invert)
+			info->flags |= XT_IPADDR_SRC_INV;
+		addrs = xtables_numeric_to_ip6addr(optarg);
+		if (addrs == NULL)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Parse error at %s", optarg);
+		memcpy(&info->src.in6, addrs, sizeof(*addrs));
+		return true;
+
+	case '2': /* --ipdst */
+		if (*flags & XT_IPADDR_DST)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Only use \"--ipdst\" once!");
+		*flags |= XT_IPADDR_DST;
+		info->flags |= XT_IPADDR_DST;
+		if (invert)
+			info->flags |= XT_IPADDR_DST_INV;
+		addrs = xtables_numeric_to_ip6addr(optarg);
+		if (addrs == NULL)
+			xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
+				"Parse error at %s", optarg);
+		memcpy(&info->dst.in6, addrs, sizeof(*addrs));
+		return true;
+	}
+
+	return false;
+}
+
+static void ipaddr_mt_check(unsigned int flags)
+{
+	if (flags == 0)
+		xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: You need to "
+			"specify at least \"--ipsrc\" or \"--ipdst\".");
+}
+
+static void ipaddr_mt4_print(const void *entry,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
+
+	if (info->flags & XT_IPADDR_SRC) {
+		printf("src IP ");
+		if (info->flags & XT_IPADDR_SRC_INV)
+			printf("! ");
+		printf("%s ", numeric ?
+		       xtables_ipaddr_to_numeric(&info->src.in) :
+		       xtables_ipaddr_to_anyname(&info->src.in));
+	}
+
+	if (info->flags & XT_IPADDR_DST) {
+		printf("dst IP ");
+		if (info->flags & XT_IPADDR_DST_INV)
+			printf("! ");
+		printf("%s ", numeric ?
+		       xtables_ipaddr_to_numeric(&info->dst.in) :
+		       xtables_ipaddr_to_anyname(&info->dst.in));
+	}
+}
+
+static void ipaddr_mt6_print(const void *entry,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
+
+	if (info->flags & XT_IPADDR_SRC) {
+		printf("src IP ");
+		if (info->flags & XT_IPADDR_SRC_INV)
+			printf("! ");
+		printf("%s ", numeric ?
+		       xtables_ip6addr_to_numeric(&info->src.in6) :
+		       xtables_ip6addr_to_anyname(&info->src.in6));
+	}
+
+	if (info->flags & XT_IPADDR_DST) {
+		printf("dst IP ");
+		if (info->flags & XT_IPADDR_DST_INV)
+			printf("! ");
+		printf("%s ", numeric ?
+		       xtables_ip6addr_to_numeric(&info->dst.in6) :
+		       xtables_ip6addr_to_anyname(&info->dst.in6));
+	}
+}
+
+static void ipaddr_mt4_save(const void *entry,
+    const struct xt_entry_match *match)
+{
+	const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
+
+	if (info->flags & XT_IPADDR_SRC) {
+		if (info->flags & XT_IPADDR_SRC_INV)
+			printf("! ");
+		printf("--ipsrc %s ",
+		       xtables_ipaddr_to_numeric(&info->src.in));
+	}
+
+	if (info->flags & XT_IPADDR_DST) {
+		if (info->flags & XT_IPADDR_DST_INV)
+			printf("! ");
+		printf("--ipdst %s ",
+		        xtables_ipaddr_to_numeric(&info->dst.in));
+	}
+}
+
+static void ipaddr_mt6_save(const void *entry,
+    const struct xt_entry_match *match)
+{
+	const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
+
+	if (info->flags & XT_IPADDR_SRC) {
+		if (info->flags & XT_IPADDR_SRC_INV)
+			printf("! ");
+		printf("--ipsrc %s ",
+		       xtables_ip6addr_to_numeric(&info->src.in6));
+	}
+
+	if (info->flags & XT_IPADDR_DST) {
+		if (info->flags & XT_IPADDR_DST_INV)
+			printf("! ");
+		printf("--ipdst %s ",
+		       xtables_ip6addr_to_numeric(&info->dst.in6));
+	}
+}
+
+static struct xtables_match ipaddr_mt_reg = {
+	.version       = XTABLES_VERSION,
+	.name          = "ipaddr",
+	.revision      = 0,
+	.family        = PF_INET,
+	.size          = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
+	.help          = ipaddr_mt_help,
+	.init          = ipaddr_mt_init,
+	.parse         = ipaddr_mt4_parse,
+	.final_check   = ipaddr_mt_check,
+	.print         = ipaddr_mt4_print,
+	.save          = ipaddr_mt4_save,
+	.extra_opts    = ipaddr_mt_opts,
+};
+
+static struct xtables_match ipaddr_mt6_reg = {
+	.version       = XTABLES_VERSION,
+	.name          = "ipaddr",
+	.revision      = 0,
+	.family        = PF_INET6,
+	.size          = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
+	.help          = ipaddr_mt_help,
+	.init          = ipaddr_mt_init,
+	.parse         = ipaddr_mt6_parse,
+	.final_check   = ipaddr_mt_check,
+	.print         = ipaddr_mt6_print,
+	.save          = ipaddr_mt6_save,
+	.extra_opts    = ipaddr_mt_opts,
+};
+
+static void _init(void)
+{
+	xtables_register_match(&ipaddr_mt_reg);
+	xtables_register_match(&ipaddr_mt6_reg);
+}

extensions/libxt_ipaddr.man

@@ -0,0 +1,9 @@
+.TP
+[\fB!\fP] \fB--ipsrc\fP \fIaddr\fP
+Match packets that have \fIaddr\fP as source address.
+.TP
+[\fB!\fP] \fB--ipdst\fP \fIaddr\fP
+Match packets that have \fIaddr\fP as destination address.
+.PP
+The ipaddr module serves only as a demonstration. It is equivalent to the
+iptables \fB-s\fP and \fB-d\fP options, but ipaddr does not support masks.

extensions/libxt_ipp2p.c

@@ -217,7 +217,7 @@ ipp2p_mt_print1(const void *entry, const struct xt_entry_match *match,
 static void ipp2p_mt_print(const void *entry,
     const struct xt_entry_match *match, int numeric)
 {
-	printf(" -m ipp2p ");
+	printf(" ipp2p ");
 	ipp2p_mt_print1(entry, match, true);
 }
 

extensions/libxt_ipp2p.man

@@ -1,4 +1,3 @@
-.PP
 This module matches certain packets in P2P flows. It is not
 designed to match all packets belonging to a P2P connection \(em
 use IPP2P together with CONNMARK for this purpose.

extensions/libxt_ipv4options.c

@@ -133,6 +133,17 @@ static void ipv4options_print_flags(const struct xt_ipv4options_mtinfo1 *info,
 		}
 }
 
+static void ipv4options_mt_print(const void *ip,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_ipv4options_mtinfo1 *info = (void *)match->data;
+
+	printf(" ipv4options %s ",
+	       (info->flags & XT_V4OPTS_ANY) ? "any-of" : "all-of");
+	ipv4options_print_flags(info, numeric);
+	printf(" ");
+}
+
 static void ipv4options_mt_save(const void *ip,
     const struct xt_entry_match *match)
 {
@@ -147,13 +158,6 @@ static void ipv4options_mt_save(const void *ip,
 	printf(" ");
 }
 
-static void ipv4options_mt_print(const void *ip,
-    const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m ipv4options");
-	ipv4options_mt_save(ip, match);
-}
-
 static struct xtables_match ipv4options_mt_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "ipv4options",

extensions/libxt_ipv4options.man

@@ -1,4 +1,3 @@
-.PP
 The "ipv4options" module allows to match against a set of IPv4 header options.
 .TP
 \fB\-\-flags\fP [\fB!\fP]\fIsymbol\fP[\fB,\fP[\fB!\fP]\fIsymbol...\fP]

extensions/libxt_length2.c

@@ -107,6 +107,29 @@ static void length_mt_check(unsigned int flags)
 		        "--layer3. Consider specifying it explicitly.\n");
 }
 
+static void length_mt_print(const void *ip, const struct xt_entry_match *match,
+                            int numeric)
+{
+	const struct xt_length_mtinfo2 *info = (const void *)match->data;
+
+	if (info->flags & XT_LENGTH_LAYER3)
+		printf(" layer3 ");
+	else if (info->flags & XT_LENGTH_LAYER4)
+		printf(" layer4 ");
+	else if (info->flags & XT_LENGTH_LAYER5)
+		printf(" layer5 ");
+	else if (info->flags & XT_LENGTH_LAYER7)
+		printf(" layer7 ");
+	printf(" length ");
+	if (info->flags & XT_LENGTH_INVERT)
+		printf("! ");
+	if (info->min == info->max)
+		printf("%u ", (unsigned int)info->min);
+	else
+		printf("%u-%u ", (unsigned int)info->min,
+		       (unsigned int)info->max);
+}
+
 static void length_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_length_mtinfo2 *info = (const void *)match->data;
@@ -129,13 +152,6 @@ static void length_mt_save(const void *ip, const struct xt_entry_match *match)
 		       (unsigned int)info->max);
 }
 
-static void length_mt_print(const void *ip, const struct xt_entry_match *match,
-                            int numeric)
-{
-	printf(" -m length2");
-	length_mt_save(ip, match);
-}
-
 static struct xtables_match length2_mt_reg = {
 	.version        = XTABLES_VERSION,
 	.name           = "length2",

extensions/libxt_length2.man

@@ -1,4 +1,3 @@
-.PP
 This module matches the length of a packet against a specific value or range of
 values.
 .TP

extensions/libxt_lscan.c

@@ -64,6 +64,30 @@ static void lscan_mt_check(unsigned int flags)
 {
 }
 
+static void lscan_mt_print(const void *ip,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_lscan_mtinfo *info = (const void *)(match->data);
+	const char *s = "";
+
+	printf(" lscan ");
+	if (info->match_stealth) {
+		printf("STEALTH");
+		s = ",";
+	}
+	if (info->match_syn) {
+		printf("%sSYNSCAN", s);
+		s = ",";
+	}
+	if (info->match_cn) {
+		printf("%sCNSCAN", s);
+		s = ",";
+	}
+	if (info->match_gr)
+		printf("%sGRSCAN", s);
+	printf(" ");
+}
+
 static void lscan_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_lscan_mtinfo *info = (const void *)(match->data);
@@ -78,13 +102,6 @@ static void lscan_mt_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --grscan ");
 }
 
-static void lscan_mt_print(const void *ip,
-    const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m lscan");
-	lscan_mt_save(ip, match);
-}
-
 static struct xtables_match lscan_mt_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "lscan",

extensions/libxt_lscan.man

@@ -1,5 +1,4 @@
-.PP
+Detects simple low-level scan attemps based upon the packet's contents.
-Detects simple low-level scan attempts based upon the packet's contents.
 (This is
 different from other implementations, which also try to match the rate of new
 connections.) Note that an attempt is only discovered after it has been carried

extensions/libxt_psd.c

@@ -117,6 +117,18 @@ static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags,
 /* Final check; nothing. */
 static void psd_mt_final_check(unsigned int flags) {}
 
+/* Prints out the targinfo. */
+static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
+	printf(" psd ");
+	printf("weight-threshold: %u ", psdinfo->weight_threshold);
+	printf("delay-threshold: %u ", psdinfo->delay_threshold);
+	printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight);
+	printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight);
+}
+
+/* Saves the union ipt_targinfo in parsable form to stdout. */
 static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
@@ -126,12 +138,6 @@ static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
 	printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight);
 }
 
-static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m psd");
-	psd_mt_save(ip, match);
-}
-
 static struct xtables_match psd_mt_reg = {
 	.name           = "psd",
 	.version        = XTABLES_VERSION,

extensions/libxt_psd.man

@@ -1,4 +1,3 @@
-.PP
 Attempt to detect TCP and UDP port scans. This match was derived from
 Solar Designer's scanlogd.
 .TP

extensions/libxt_quota2.c

@@ -98,6 +98,8 @@ quota_mt2_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_quota_mtinfo2 *q = (void *)match->data;
 
+	if (q->flags & XT_QUOTA_INVERT)
+		printf(" !");
 	if (q->flags & XT_QUOTA_GROW)
 		printf(" --grow ");
 	if (q->flags & XT_QUOTA_NO_CHANGE)
@@ -106,16 +108,29 @@ quota_mt2_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --packets ");
 	if (*q->name != '\0')
 		printf(" --name %s ", q->name);
-	if (q->flags & XT_QUOTA_INVERT)
-		printf(" !");
 	printf(" --quota %llu ", (unsigned long long)q->quota);
 }
 
 static void quota_mt2_print(const void *ip, const struct xt_entry_match *match,
                             int numeric)
 {
-	printf(" -m quota");
+	const struct xt_quota_mtinfo2 *q = (const void *)match->data;
-	quota_mt2_save(ip, match);
+
+	if (q->flags & XT_QUOTA_INVERT)
+		printf(" !");
+	if (q->flags & XT_QUOTA_GROW)
+		printf(" counter");
+	else
+		printf(" quota");
+	if (*q->name != '\0')
+		printf(" %s:", q->name);
+	printf(" %llu ", (unsigned long long)q->quota);
+	if (q->flags & XT_QUOTA_PACKET)
+		printf("packets ");
+	else
+		printf("bytes ");
+	if (q->flags & XT_QUOTA_NO_CHANGE)
+		printf("(no-change mode) ");
 }
 
 static struct xtables_match quota_mt2_reg = {

extensions/libxt_quota2.man

@@ -1,4 +1,3 @@
-.PP
 The "quota2" implements a named counter which can be increased or decreased
 on a per-match basis. Available modes are packet counting or byte counting.
 The value of the counter can be read and reset through procfs, thereby making

extensions/pknock/libxt_pknock.man

@@ -15,10 +15,10 @@ modprobe xt_pknock
 .PP
 Example 1 (TCP mode, manual closing of opened port not possible):
 .IP
-iptables \-P INPUT DROP
+iptables -P INPUT DROP
 .IP
-iptables \-A INPUT \-p tcp \-m pknock \-\-knockports 4002,4001,4004 \-\-strict
+iptables -A INPUT -p tcp -m pknock --knockports 4002,4001,4004 --strict
-\-\-name SSH \-\-time 10 \-\-autoclose 60 \-\-dport 22 \-j ACCEPT
+--name SSH --time 10 --autoclose 60 --dport 22 -j ACCEPT
 .PP
 The rule will allow tcp port 22 for the attempting IP address after the successful reception of TCP SYN packets
 to ports 4002, 4001 and 4004, in this order (a.k.a. port-knocking).
@@ -33,10 +33,10 @@ Example 2 (UDP mode \(em non-replayable and non-spoofable, manual closing
 of opened port possible, secure, also called "SPA" = Secure Port
 Authorization):
 .IP
-iptables \-A INPUT \-p udp \-m pknock \-\-knockports 4000 \-\-name FTP
+iptables -A INPUT -p udp -m pknock --knockports 4000 --name FTP
-\-\-opensecret foo \-\-closesecret bar \-\-autoclose 240 \-j DROP
+--opensecret foo --closesecret bar --autoclose 240 -j DROP
 .IP
-iptables \-A INPUT \-p tcp \-m pknock \-\-checkip \-\-name FTP \-\-dport 21 \-j ACCEPT
+iptables -A INPUT -p tcp -m pknock --checkip --name FTP --dport 21 -j ACCEPT
 .PP
 The first rule will create an "ALLOWED" record in /proc/net/xt_pknock/FTP after
 the successful reception of an UDP packet to port 4000. The packet payload must be

extensions/pknock/xt_pknock.c

@@ -190,7 +190,8 @@ status_itoa(enum status status)
 static void *
 pknock_seq_start(struct seq_file *s, loff_t *pos)
 {
-	const struct xt_pknock_rule *rule = s->private;
+	const struct proc_dir_entry *pde = s->private;
+	const struct xt_pknock_rule *rule = pde->data;
 
 	spin_lock_bh(&list_lock);
 
@@ -209,7 +210,8 @@ pknock_seq_start(struct seq_file *s, loff_t *pos)
 static void *
 pknock_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-	const struct xt_pknock_rule *rule = s->private;
+	const struct proc_dir_entry *pde = s->private;
+	const struct xt_pknock_rule *rule = pde->data;
 
 	++*pos;
 	if (*pos >= peer_hashsize)
@@ -241,7 +243,8 @@ pknock_seq_show(struct seq_file *s, void *v)
 	unsigned long time;
 	const struct list_head *peer_head = v;
 
-	const struct xt_pknock_rule *rule = s->private;
+	const struct proc_dir_entry *pde = s->private;
+	const struct xt_pknock_rule *rule = pde->data;
 
 	list_for_each_safe(pos, n, peer_head) {
 		peer = list_entry(pos, struct peer, head);
@@ -292,7 +295,7 @@ pknock_proc_open(struct inode *inode, struct file *file)
 	int ret = seq_open(file, &pknock_seq_ops);
 	if (ret == 0) {
 		struct seq_file *sf = file->private_data;
-		sf->private = PDE_DATA(inode);
+		sf->private = PDE(inode);
 	}
 	return ret;
 }
@@ -475,11 +478,13 @@ add_rule(struct xt_pknock_mtinfo *info)
 	rule->timer.function	= peer_gc;
 	rule->timer.data	= (unsigned long)rule;
 
-	rule->status_proc = proc_create_data(info->rule_name, 0, pde,
+	rule->status_proc = create_proc_entry(info->rule_name, 0, pde);
-	                    &pknock_proc_ops, rule);
 	if (rule->status_proc == NULL)
 		goto out;
 
+	rule->status_proc->proc_fops = &pknock_proc_ops;
+	rule->status_proc->data = rule;
+
 	list_add(&rule->head, &rule_hashtable[hash]);
 	pr_debug("(A) rule_name: %s - created.\n", rule->rule_name);
 	return true;

extensions/xt_CHAOS.c

@@ -85,7 +85,7 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
 }
 
 static unsigned int
-chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)
+chaos_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	/*
 	 * Equivalent to:
@@ -96,6 +96,7 @@ chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	 * -A chaos -j DROP;
 	 */
 	const struct xt_chaos_tginfo *info = par->targinfo;
+	struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 
 	if ((unsigned int)net_random() <= reject_percentage) {

extensions/xt_DELUDE.c

@@ -116,7 +116,7 @@ static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 	/* ip_route_me_harder expects skb->dst to be set */
 	skb_dst_set(nskb, dst_clone(skb_dst(oldskb)));
 
-	if (ip_route_me_harder(nskb, addr_type))
+	if (ip_route_me_harder(&nskb, addr_type))
 		goto free_nskb;
 	else
 		niph = ip_hdr(nskb);
@@ -138,14 +138,12 @@ static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 }
 
 static unsigned int
-delude_tg(struct sk_buff *skb, const struct xt_action_param *par)
+delude_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
-	/*
+	/* WARNING: This code causes reentry within iptables.
-	 * Sending the reset causes reentrancy within iptables - and should not pose
+	   This means that the iptables jump stack is now crap.  We
-	 * a problem, as that is supported since Linux 2.6.35. But since we do not
+	   must return an absolute verdict. --RR */
-	 * actually want to have a connection open, we are still going to drop it.
+	delude_send_reset(*pskb, par->hooknum);
-	 */
-	delude_send_reset(skb, par->hooknum);
 	return NF_DROP;
 }
 

extensions/xt_DHCPMAC.c

@@ -89,14 +89,15 @@ dhcpmac_mt(const struct sk_buff *skb, struct xt_action_param *par)
 }
 
 static unsigned int
-dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
+dhcpmac_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	const struct dhcpmac_info *info = par->targinfo;
 	struct dhcp_message dhcpbuf, *dh;
 	struct udphdr udpbuf, *udph;
+	struct sk_buff *skb = *pskb;
 	unsigned int i;
 
-	if (!skb_make_writable(skb, 0))
+	if (!skb_make_writable(pskb, 0))
 		return NF_DROP;
 
 	udph = skb_header_pointer(skb, ip_hdrlen(skb),

extensions/xt_DNETMAP.c

@@ -26,8 +26,6 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
-#include <linux/seq_file.h>
-#include <linux/uidgid.h>
 #include <linux/version.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -114,9 +112,13 @@ static DEFINE_SPINLOCK(dnetmap_lock);
 static DEFINE_MUTEX(dnetmap_mutex);
 
 #ifdef CONFIG_PROC_FS
-static const struct file_operations dnetmap_tg_fops, dnetmap_stat_proc_fops;
+static const struct file_operations dnetmap_tg_fops;
 #endif
 
+static int dnetmap_stat_proc_read(char __user *buffer, char **start,
+				  off_t offset, int length, int *eof,
+				  void *data);
+
 static inline unsigned int dnetmap_entry_hash(const __be32 addr)
 {
 	return ntohl(addr) & (hash_size - 1);
@@ -326,20 +328,21 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 		ret = -ENOMEM;
 		goto out;
 	}
-	proc_set_user(pde_data, make_kuid(&init_user_ns, proc_uid),
+	pde_data->uid = proc_uid;
-	              make_kgid(&init_user_ns, proc_gid));
+	pde_data->gid = proc_gid;
 
 	/* statistics */
-	pde_stat = proc_create_data(p->proc_str_stat, proc_perms,
+	pde_stat = create_proc_entry(p->proc_str_stat, proc_perms,
-		                    dnetmap_net->xt_dnetmap,
+				     dnetmap_net->xt_dnetmap);
-		                    &dnetmap_stat_proc_fops, p);
 	if (pde_stat == NULL) {
 		kfree(p);
 		ret = -ENOMEM;
 		goto out;
 	}
-	proc_set_user(pde_stat, make_kuid(&init_user_ns, proc_uid),
+	pde_stat->data = p;
-	              make_kgid(&init_user_ns, proc_gid));
+	pde_stat->read_proc = dnetmap_stat_proc_read;
+	pde_stat->uid = proc_uid;
+	pde_stat->gid = proc_gid;
 #endif
 
 	spin_lock_bh(&dnetmap_lock);
@@ -353,8 +356,9 @@ out:
 }
 
 static unsigned int
-dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
+dnetmap_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	struct sk_buff *skb = *pskb;
 	struct net *net = dev_net(par->in ? par->in : par->out);
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
 	struct nf_conn *ct;
@@ -589,24 +593,27 @@ static const struct seq_operations dnetmap_seq_ops = {
 
 static int dnetmap_seq_open(struct inode *inode, struct file *file)
 {
+	struct proc_dir_entry *pde = PDE(inode);
 	struct dnetmap_iter_state *st;
 
 	st = __seq_open_private(file, &dnetmap_seq_ops, sizeof(*st));
 	if (st == NULL)
 		return -ENOMEM;
 
-	st->p = PDE_DATA(inode);
+	st->p = pde->data;
 	return 0;
 }
 
 static ssize_t
 dnetmap_tg_proc_write(struct file *file, const char __user *input,size_t size, loff_t *loff)
 {
-	struct dnetmap_prefix *p = PDE_DATA(file_inode(file));
+	const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
+	struct dnetmap_prefix *p = pde->data;
 	struct dnetmap_entry *e;
 	char buf[sizeof("+192.168.100.100:200.200.200.200")];
 	const char *c = buf;
 	const char *c2;
+	//union nf_inet_addr addr = {};
 	__be32 addr1,addr2;
 	bool add;
 	char str[25];
@@ -776,9 +783,11 @@ static const struct file_operations dnetmap_tg_fops = {
 };
 
 /* for statistics */
-static int dnetmap_stat_proc_show(struct seq_file *m, void *data)
+static int dnetmap_stat_proc_read(char __user *buffer, char **start,
+				  off_t offset, int length, int *eof,
+				  void *data)
 {
-	const struct dnetmap_prefix *p = m->private;
+	const struct dnetmap_prefix *p = data;
 	struct dnetmap_entry *e;
 	unsigned int used, used_static, all;
 	long int ttl, sum_ttl;
@@ -804,25 +813,16 @@ static int dnetmap_stat_proc_show(struct seq_file *m, void *data)
 	}
 
 	sum_ttl = used > 0 ? sum_ttl / (used * HZ) : 0;
-	seq_printf(m, "%u %u %u %ld %s\n", used, used_static, all, sum_ttl,(p->flags & XT_DNETMAP_PERSISTENT ? "persistent" : ""));
+	sprintf(buffer, "%u %u %u %ld %s\n", used, used_static, all, sum_ttl,(p->flags & XT_DNETMAP_PERSISTENT ? "persistent" : ""));
+
+	if (length >= strlen(buffer))
+		*eof = true;
 
 	spin_unlock_bh(&dnetmap_lock);
 
-	return 0;
+	return strlen(buffer);
 }
 
-static int dnetmap_stat_proc_open(struct inode *inode, struct file *file)
-{
-	return single_open(file, dnetmap_stat_proc_show, PDE_DATA(inode));
-}
-
-static const struct file_operations dnetmap_stat_proc_fops = {
-	.open    = dnetmap_stat_proc_open,
-	.read    = seq_read,
-	.llseek  = seq_lseek,
-	.release = single_release,
-};
-
 static int __net_init dnetmap_proc_net_init(struct net *net)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
@@ -835,7 +835,7 @@ static int __net_init dnetmap_proc_net_init(struct net *net)
 
 static void __net_exit dnetmap_proc_net_exit(struct net *net)
 {
-	remove_proc_entry("xt_DNETMAP", net->proc_net);
+	proc_net_remove(net, "xt_DNETMAP");
 }
 
 #else

extensions/xt_ECHO.c

@@ -24,8 +24,9 @@
 #include "compat_xtables.h"
 
 static unsigned int
-echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
+echo_tg6(struct sk_buff **poldskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *oldskb = *poldskb;
 	const struct udphdr *oldudp;
 	const struct ipv6hdr *oldip;
 	struct udphdr *newudp, oldudp_buf;
@@ -38,7 +39,7 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
 
 	/* This allows us to do the copy operation in fewer lines of code. */
-	if (skb_linearize(oldskb) < 0)
+	if (skb_linearize(*poldskb) < 0)
 		return NF_DROP;
 
 	oldip  = ipv6_hdr(oldskb);
@@ -111,7 +112,7 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	if (newskb->len > dst_mtu(skb_dst(newskb)))
 		goto free_nskb;
 
-	nf_ct_attach(newskb, oldskb);
+	nf_ct_attach(newskb, *poldskb);
 	ip6_local_out(newskb);
 	return NF_DROP;
 
@@ -121,8 +122,9 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 }
 
 static unsigned int
-echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
+echo_tg4(struct sk_buff **poldskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *oldskb = *poldskb;
 	const struct udphdr *oldudp;
 	const struct iphdr *oldip;
 	struct udphdr *newudp, oldudp_buf;
@@ -132,7 +134,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	void *payload;
 
 	/* This allows us to do the copy operation in fewer lines of code. */
-	if (skb_linearize(oldskb) < 0)
+	if (skb_linearize(*poldskb) < 0)
 		return NF_DROP;
 
 	oldip  = ip_hdr(oldskb);
@@ -190,7 +192,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	/* ip_route_me_harder expects the skb's dst to be set */
 	skb_dst_set(newskb, dst_clone(skb_dst(oldskb)));
 
-	if (ip_route_me_harder(newskb, RTN_UNSPEC) != 0)
+	if (ip_route_me_harder(&newskb, RTN_UNSPEC) != 0)
 		goto free_nskb;
 
 	newip->ttl = ip4_dst_hoplimit(skb_dst(newskb));
@@ -200,7 +202,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	if (newskb->len > dst_mtu(skb_dst(newskb)))
 		goto free_nskb;
 
-	nf_ct_attach(newskb, oldskb);
+	nf_ct_attach(newskb, *poldskb);
 	ip_local_out(newskb);
 	return NF_DROP;
 

extensions/xt_IPMARK.c

@@ -25,9 +25,10 @@ MODULE_ALIAS("ipt_IPMARK");
 MODULE_ALIAS("ip6t_IPMARK");
 
 static unsigned int
-ipmark_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+ipmark_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	const struct xt_ipmark_tginfo *ipmarkinfo = par->targinfo;
+	const struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 	__u32 mark;
 
@@ -60,9 +61,10 @@ static __u32 ipmark_from_ip6(const struct in6_addr *a, unsigned int s)
 }
 
 static unsigned int
-ipmark_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+ipmark_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	const struct xt_ipmark_tginfo *info = par->targinfo;
+	const struct sk_buff *skb = *pskb;
 	const struct ipv6hdr *iph = ipv6_hdr(skb);
 	__u32 mark;
 

extensions/xt_LOGMARK.c

@@ -63,8 +63,9 @@ static void logmark_ct(const struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 }
 
 static unsigned int
-logmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
+logmark_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *skb = *pskb;
 	const struct xt_logmark_tginfo *info = par->targinfo;
 	const struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;

extensions/xt_RAWNAT.c

@@ -0,0 +1,354 @@
+/*
+ *	"RAWNAT" target extension for Xtables - untracked NAT
+ *	Copyright © Jan Engelhardt, 2008 - 2009
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
+ */
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/tcp.h>
+#include <linux/udp.h>
+#include <linux/version.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_conntrack_common.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
+#include "compat_xtables.h"
+#include "xt_RAWNAT.h"
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+#	define WITH_IPV6 1
+#endif
+
+static inline __be32
+remask(__be32 addr, __be32 repl, unsigned int shift)
+{
+	uint32_t mask = (shift == 32) ? 0 : (~(uint32_t)0 >> shift);
+	return htonl((ntohl(addr) & mask) | (ntohl(repl) & ~mask));
+}
+
+#ifdef WITH_IPV6
+static void
+rawnat_ipv6_mask(__be32 *addr, const __be32 *repl, unsigned int mask)
+{
+	switch (mask) {
+	case 0:
+		break;
+	case 1 ... 31:
+		addr[0] = remask(addr[0], repl[0], mask);
+		break;
+	case 32:
+		addr[0] = repl[0];
+		break;
+	case 33 ... 63:
+		addr[0] = repl[0];
+		addr[1] = remask(addr[1], repl[1], mask - 32);
+		break;
+	case 64:
+		addr[0] = repl[0];
+		addr[1] = repl[1];
+		break;
+	case 65 ... 95:
+		addr[0] = repl[0];
+		addr[1] = repl[1];
+		addr[2] = remask(addr[2], repl[2], mask - 64);
+	case 96:
+		addr[0] = repl[0];
+		addr[1] = repl[1];
+		addr[2] = repl[2];
+		break;
+	case 97 ... 127:
+		addr[0] = repl[0];
+		addr[1] = repl[1];
+		addr[2] = repl[2];
+		addr[3] = remask(addr[3], repl[3], mask - 96);
+		break;
+	case 128:
+		addr[0] = repl[0];
+		addr[1] = repl[1];
+		addr[2] = repl[2];
+		addr[3] = repl[3];
+		break;
+	}
+}
+#endif
+
+static void rawnat4_update_l4(struct sk_buff *skb, __be32 oldip, __be32 newip)
+{
+	struct iphdr *iph = ip_hdr(skb);
+	void *transport_hdr = (void *)iph + ip_hdrlen(skb);
+	struct tcphdr *tcph;
+	struct udphdr *udph;
+	bool cond;
+
+	switch (iph->protocol) {
+	case IPPROTO_TCP:
+		tcph = transport_hdr;
+		inet_proto_csum_replace4(&tcph->check, skb, oldip, newip, true);
+		break;
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		udph = transport_hdr;
+		cond = udph->check != 0;
+		cond |= skb->ip_summed == CHECKSUM_PARTIAL;
+		if (cond) {
+			inet_proto_csum_replace4(&udph->check, skb,
+				oldip, newip, true);
+			if (udph->check == 0)
+				udph->check = CSUM_MANGLED_0;
+		}
+		break;
+	}
+}
+
+static unsigned int rawnat4_writable_part(const struct iphdr *iph)
+{
+	unsigned int wlen = sizeof(*iph);
+
+	switch (iph->protocol) {
+	case IPPROTO_TCP:
+		wlen += sizeof(struct tcphdr);
+		break;
+	case IPPROTO_UDP:
+		wlen += sizeof(struct udphdr);
+		break;
+	}
+	return wlen;
+}
+
+static unsigned int
+rawsnat_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	const struct xt_rawnat_tginfo *info = par->targinfo;
+	struct iphdr *iph;
+	__be32 new_addr;
+
+	iph = ip_hdr(*pskb);
+	new_addr = remask(iph->saddr, info->addr.ip, info->mask);
+	if (iph->saddr == new_addr)
+		return XT_CONTINUE;
+
+	if (!skb_make_writable(pskb, rawnat4_writable_part(iph)))
+		return NF_DROP;
+
+	iph = ip_hdr(*pskb);
+	csum_replace4(&iph->check, iph->saddr, new_addr);
+	rawnat4_update_l4(*pskb, iph->saddr, new_addr);
+	iph->saddr = new_addr;
+	return XT_CONTINUE;
+}
+
+static unsigned int
+rawdnat_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	const struct xt_rawnat_tginfo *info = par->targinfo;
+	struct iphdr *iph;
+	__be32 new_addr;
+
+	iph = ip_hdr(*pskb);
+	new_addr = remask(iph->daddr, info->addr.ip, info->mask);
+	if (iph->daddr == new_addr)
+		return XT_CONTINUE;
+
+	if (!skb_make_writable(pskb, rawnat4_writable_part(iph)))
+		return NF_DROP;
+
+	iph = ip_hdr(*pskb);
+	csum_replace4(&iph->check, iph->daddr, new_addr);
+	rawnat4_update_l4(*pskb, iph->daddr, new_addr);
+	iph->daddr = new_addr;
+	return XT_CONTINUE;
+}
+
+#ifdef WITH_IPV6
+static bool rawnat6_prepare_l4(struct sk_buff **pskb, unsigned int *l4offset,
+    unsigned int *l4proto)
+{
+	static const unsigned int types[] =
+		{IPPROTO_TCP, IPPROTO_UDP, IPPROTO_UDPLITE};
+	unsigned int i;
+	int err;
+
+	*l4proto = NEXTHDR_MAX;
+
+	for (i = 0; i < ARRAY_SIZE(types); ++i) {
+		err = ipv6_find_hdr(*pskb, l4offset, types[i], NULL, NULL);
+		if (err >= 0) {
+			*l4proto = types[i];
+			break;
+		}
+		if (err != -ENOENT)
+			return false;
+	}
+
+	switch (*l4proto) {
+	case IPPROTO_TCP:
+		if (!skb_make_writable(pskb, *l4offset + sizeof(struct tcphdr)))
+			return false;
+		break;
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		if (!skb_make_writable(pskb, *l4offset + sizeof(struct udphdr)))
+			return false;
+		break;
+	}
+
+	return true;
+}
+
+static void rawnat6_update_l4(struct sk_buff *skb, unsigned int l4proto,
+    unsigned int l4offset, const struct in6_addr *oldip,
+    const struct in6_addr *newip)
+{
+	const struct ipv6hdr *iph = ipv6_hdr(skb);
+	struct tcphdr *tcph;
+	struct udphdr *udph;
+	unsigned int i;
+	bool cond;
+
+	switch (l4proto) {
+	case IPPROTO_TCP:
+		tcph = (void *)iph + l4offset;
+		for (i = 0; i < 4; ++i)
+			inet_proto_csum_replace4(&tcph->check, skb,
+				oldip->s6_addr32[i], newip->s6_addr32[i], true);
+		break;
+	case IPPROTO_UDP:
+	case IPPROTO_UDPLITE:
+		udph = (void *)iph + l4offset;
+		cond = udph->check;
+		cond |= skb->ip_summed == CHECKSUM_PARTIAL;
+		if (cond) {
+			for (i = 0; i < 4; ++i)
+				inet_proto_csum_replace4(&udph->check, skb,
+					oldip->s6_addr32[i],
+					newip->s6_addr32[i], true);
+			if (udph->check == 0)
+				udph->check = CSUM_MANGLED_0;
+		}
+		break;
+	}
+}
+
+static unsigned int
+rawsnat_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	const struct xt_rawnat_tginfo *info = par->targinfo;
+	unsigned int l4offset = 0, l4proto;
+	struct ipv6hdr *iph;
+	struct in6_addr new_addr;
+
+	iph = ipv6_hdr(*pskb);
+	memcpy(&new_addr, &iph->saddr, sizeof(new_addr));
+	rawnat_ipv6_mask(new_addr.s6_addr32, info->addr.ip6, info->mask);
+	if (ipv6_addr_cmp(&iph->saddr, &new_addr) == 0)
+		return XT_CONTINUE;
+	if (!rawnat6_prepare_l4(pskb, &l4offset, &l4proto))
+		return NF_DROP;
+	iph = ipv6_hdr(*pskb);
+	rawnat6_update_l4(*pskb, l4proto, l4offset, &iph->saddr, &new_addr);
+	memcpy(&iph->saddr, &new_addr, sizeof(new_addr));
+	return XT_CONTINUE;
+}
+
+static unsigned int
+rawdnat_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	const struct xt_rawnat_tginfo *info = par->targinfo;
+	unsigned int l4offset = 0, l4proto;
+	struct ipv6hdr *iph;
+	struct in6_addr new_addr;
+
+	iph = ipv6_hdr(*pskb);
+	memcpy(&new_addr, &iph->daddr, sizeof(new_addr));
+	rawnat_ipv6_mask(new_addr.s6_addr32, info->addr.ip6, info->mask);
+	if (ipv6_addr_cmp(&iph->daddr, &new_addr) == 0)
+		return XT_CONTINUE;
+	if (!rawnat6_prepare_l4(pskb, &l4offset, &l4proto))
+		return NF_DROP;
+	iph = ipv6_hdr(*pskb);
+	rawnat6_update_l4(*pskb, l4proto, l4offset, &iph->daddr, &new_addr);
+	memcpy(&iph->daddr, &new_addr, sizeof(new_addr));
+	return XT_CONTINUE;
+}
+#endif
+
+static int rawnat_tg_check(const struct xt_tgchk_param *par)
+{
+	if (strcmp(par->table, "raw") == 0 ||
+	    strcmp(par->table, "rawpost") == 0)
+		return 0;
+
+	printk(KERN_ERR KBUILD_MODNAME " may only be used in the \"raw\" or "
+	       "\"rawpost\" table.\n");
+	return -EINVAL;
+}
+
+static struct xt_target rawnat_tg_reg[] __read_mostly = {
+	{
+		.name       = "RAWSNAT",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.target     = rawsnat_tg4,
+		.targetsize = sizeof(struct xt_rawnat_tginfo),
+		.checkentry = rawnat_tg_check,
+		.me         = THIS_MODULE,
+	},
+#ifdef WITH_IPV6
+	{
+		.name       = "RAWSNAT",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.target     = rawsnat_tg6,
+		.targetsize = sizeof(struct xt_rawnat_tginfo),
+		.checkentry = rawnat_tg_check,
+		.me         = THIS_MODULE,
+	},
+#endif
+	{
+		.name       = "RAWDNAT",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.target     = rawdnat_tg4,
+		.targetsize = sizeof(struct xt_rawnat_tginfo),
+		.checkentry = rawnat_tg_check,
+		.me         = THIS_MODULE,
+	},
+#ifdef WITH_IPV6
+	{
+		.name       = "RAWDNAT",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.target     = rawdnat_tg6,
+		.targetsize = sizeof(struct xt_rawnat_tginfo),
+		.checkentry = rawnat_tg_check,
+		.me         = THIS_MODULE,
+	},
+#endif
+};
+
+static int __init rawnat_tg_init(void)
+{
+	return xt_register_targets(rawnat_tg_reg, ARRAY_SIZE(rawnat_tg_reg));
+}
+
+static void __exit rawnat_tg_exit(void)
+{
+	xt_unregister_targets(rawnat_tg_reg, ARRAY_SIZE(rawnat_tg_reg));
+}
+
+module_init(rawnat_tg_init);
+module_exit(rawnat_tg_exit);
+MODULE_AUTHOR("Jan Engelhardt ");
+MODULE_DESCRIPTION("Xtables: conntrack-less raw NAT");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_RAWSNAT");
+MODULE_ALIAS("ipt_RAWDNAT");
+MODULE_ALIAS("ip6t_RAWSNAT");
+MODULE_ALIAS("ip6t_RAWDNAT");

extensions/xt_RAWNAT.h

@@ -0,0 +1,9 @@
+#ifndef _LINUX_NETFILTER_XT_TARGET_RAWNAT
+#define _LINUX_NETFILTER_XT_TARGET_RAWNAT 1
+
+struct xt_rawnat_tginfo {
+	union nf_inet_addr addr;
+	__u8 mask;
+};
+
+#endif /* _LINUX_NETFILTER_XT_TARGET_RAWNAT */

extensions/xt_STEAL.c

@@ -0,0 +1,67 @@
+/*
+ *	"STEAL" demo target extension for Xtables
+ *	written by Jan Engelhardt, 2008 - 2009
+ *	placed in the Public Domain
+ */
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/skbuff.h>
+#include "compat_xtables.h"
+
+static unsigned int
+steal_tg(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	kfree_skb(*pskb);
+	return NF_STOLEN;
+}
+
+static struct xt_target steal_tg_reg[] __read_mostly = {
+	{
+		.name     = "STEAL",
+		.revision = 0,
+		.family   = NFPROTO_UNSPEC,
+		.target   = steal_tg,
+		.me       = THIS_MODULE,
+	},
+	{
+		.name     = "STEAL",
+		.revision = 0,
+		.family   = NFPROTO_IPV6,
+		.target   = steal_tg,
+		.me       = THIS_MODULE,
+	},
+	{
+		.name     = "STEAL",
+		.revision = 0,
+		.family   = NFPROTO_ARP,
+		.target   = steal_tg,
+		.me       = THIS_MODULE,
+	},
+	{
+		.name     = "STEAL",
+		.revision = 0,
+		.family   = NFPROTO_BRIDGE,
+		.target   = steal_tg,
+		.me       = THIS_MODULE,
+	},
+};
+
+static int __init steal_tg_init(void)
+{
+	return xt_register_targets(steal_tg_reg, ARRAY_SIZE(steal_tg_reg));
+}
+
+static void __exit steal_tg_exit(void)
+{
+	xt_unregister_targets(steal_tg_reg, ARRAY_SIZE(steal_tg_reg));
+}
+
+module_init(steal_tg_init);
+module_exit(steal_tg_exit);
+MODULE_AUTHOR("Jan Engelhardt ");
+MODULE_DESCRIPTION("Xtables: Silently DROP packets on output chain");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_STEAL");
+MODULE_ALIAS("ip6t_STEAL");
+MODULE_ALIAS("arpt_STEAL");
+MODULE_ALIAS("ebt_STEAL");

extensions/xt_SYSRQ.c

@@ -189,8 +189,9 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 #endif
 
 static unsigned int
-sysrq_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+sysrq_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	struct sk_buff *skb = *pskb;
 	const struct iphdr *iph;
 	const struct udphdr *udph;
 	uint16_t len;
@@ -219,8 +220,9 @@ sysrq_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 
 #ifdef WITH_IPV6
 static unsigned int
-sysrq_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+sysrq_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	struct sk_buff *skb = *pskb;
 	const struct ipv6hdr *iph;
 	const struct udphdr *udph;
 	unsigned short frag_off;

extensions/xt_TARPIT.c

@@ -79,7 +79,7 @@ static bool xttarpit_tarpit(struct tcphdr *tcph, const struct tcphdr *oth)
 #if 0
 	/* Rate-limit replies to !SYN,ACKs */
 	if (!oth->syn && oth->ack)
-		if (!xrlim_allow(&ort->dst, HZ))
+		if (!xrlim_allow(rt_dst(ort), HZ))
 			return false;
 #endif
 
@@ -256,7 +256,7 @@ static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
 #endif
 		addr_type = RTN_LOCAL;
 
-	if (ip_route_me_harder(nskb, addr_type))
+	if (ip_route_me_harder(&nskb, addr_type))
 		goto free_nskb;
 	else
 		niph = ip_hdr(nskb);
@@ -404,8 +404,9 @@ static void tarpit_tcp6(struct sk_buff *oldskb, unsigned int hook,
 #endif
 
 static unsigned int
-tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+tarpit_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 	const struct rtable *rt = skb_rtable(skb);
 	const struct xt_tarpit_tginfo *info = par->targinfo;
@@ -434,14 +435,15 @@ tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 	if (iph->frag_off & htons(IP_OFFSET))
 		return NF_DROP;
 
-	tarpit_tcp4(skb, par->hooknum, info->variant);
+	tarpit_tcp4(*pskb, par->hooknum, info->variant);
 	return NF_DROP;
 }
 
 #ifdef WITH_IPV6
 static unsigned int
-tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+tarpit_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *skb = *pskb;
 	const struct ipv6hdr *iph = ipv6_hdr(skb);
 	const struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
 	const struct xt_tarpit_tginfo *info = par->targinfo;
@@ -476,7 +478,7 @@ tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 		return NF_DROP;
 	}
 
-	tarpit_tcp6(skb, par->hooknum, info->variant);
+	tarpit_tcp6(*pskb, par->hooknum, info->variant);
 	return NF_DROP;
 }
 #endif

extensions/xt_condition.c

@@ -52,7 +52,6 @@ struct condition_variable {
 	struct proc_dir_entry *status_proc;
 	unsigned int refcount;
 	bool enabled;
-	char name[sizeof(((struct xt_condition_mtinfo *)NULL)->name)];
 };
 
 /* proc_lock is a user context only semaphore used for write access */
@@ -62,23 +61,22 @@ static DEFINE_MUTEX(proc_lock);
 static LIST_HEAD(conditions_list);
 static struct proc_dir_entry *proc_net_condition;
 
-static int condition_proc_show(struct seq_file *m, void *data)
+static int condition_proc_read(char __user *buffer, char **start, off_t offset,
+                               int length, int *eof, void *data)
 {
-	const struct condition_variable *var = m->private;
+	const struct condition_variable *var = data;
 
-	return seq_printf(m, var->enabled ? "1\n" : "0\n");
+	buffer[0] = var->enabled ? '1' : '0';
+	buffer[1] = '\n';
+	if (length >= 2)
+		*eof = true;
+	return 2;
 }
 
-static int condition_proc_open(struct inode *inode, struct file *file)
+static int condition_proc_write(struct file *file, const char __user *buffer,
+                                unsigned long length, void *data)
 {
-	return single_open(file, condition_proc_show, PDE_DATA(inode));
+	struct condition_variable *var = data;
-}
-
-static ssize_t
-condition_proc_write(struct file *file, const char __user *buffer,
-                     size_t length, loff_t *loff)
-{
-	struct condition_variable *var = PDE_DATA(file_inode(file));
 	char newval;
 
 	if (length > 0) {
@@ -97,14 +95,6 @@ condition_proc_write(struct file *file, const char __user *buffer,
 	return length;
 }
 
-static const struct file_operations condition_proc_fops = {
-	.open    = condition_proc_open,
-	.read    = seq_read,
-	.llseek  = seq_lseek,
-	.write   = condition_proc_write,
-	.release = single_release,
-};
-
 static bool
 condition_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
@@ -134,7 +124,7 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 	 */
 	mutex_lock(&proc_lock);
 	list_for_each_entry(var, &conditions_list, list) {
-		if (strcmp(info->name, var->name) == 0) {
+		if (strcmp(info->name, var->status_proc->name) == 0) {
 			var->refcount++;
 			mutex_unlock(&proc_lock);
 			info->condvar = var;
@@ -149,23 +139,24 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 		return -ENOMEM;
 	}
 
-	memcpy(var->name, info->name, sizeof(info->name));
 	/* Create the condition variable's proc file entry. */
-	var->status_proc = proc_create_data(info->name, condition_list_perms,
+	var->status_proc = create_proc_entry(info->name, condition_list_perms,
-	                   proc_net_condition, &condition_proc_fops, var);
+	                   proc_net_condition);
 	if (var->status_proc == NULL) {
 		kfree(var);
 		mutex_unlock(&proc_lock);
 		return -ENOMEM;
 	}
 
-	proc_set_user(var->status_proc,
-	              make_kuid(&init_user_ns, condition_uid_perms),
-	              make_kgid(&init_user_ns, condition_gid_perms));
 	var->refcount = 1;
 	var->enabled  = false;
+	var->status_proc->data  = var;
 	wmb();
+	var->status_proc->read_proc  = condition_proc_read;
+	var->status_proc->write_proc = condition_proc_write;
 	list_add(&var->list, &conditions_list);
+	var->status_proc->uid = condition_uid_perms;
+	var->status_proc->gid = condition_gid_perms;
 	mutex_unlock(&proc_lock);
 	info->condvar = var;
 	return 0;
@@ -179,7 +170,7 @@ static void condition_mt_destroy(const struct xt_mtdtor_param *par)
 	mutex_lock(&proc_lock);
 	if (--var->refcount == 0) {
 		list_del(&var->list);
-		proc_remove(var->status_proc);
+		remove_proc_entry(var->status_proc->name, proc_net_condition);
 		mutex_unlock(&proc_lock);
 		kfree(var);
 		return;

extensions/xt_geoip.c

@@ -83,18 +83,10 @@ geoip_add_node(const struct geoip_country_user __user *umem_ptr,
 	p->count   = umem.count;
 	p->cc      = umem.cc;
 	size = p->count * geoproto_size[proto];
-	if (size == 0) {
+	subnet = vmalloc(size);
-		/*
+	if (subnet == NULL) {
-		 * Believe it or not, vmalloc prints a warning to dmesg for
+		ret = -ENOMEM;
-		 * zero-sized allocations :-/
+		goto free_p;
-		 */
-		subnet = NULL;
-	} else {
-		subnet = vmalloc(size);
-		if (subnet == NULL) {
-			ret = -ENOMEM;
-			goto free_p;
-		}
 	}
 	if (copy_from_user(subnet,
 	    (const void __user *)(unsigned long)umem.subnets, size) != 0) {

extensions/xt_ipaddr.c

@@ -0,0 +1,141 @@
+/*
+ *	"ipaddr" demo match for Xtables
+ *	Copyright © Jan Engelhardt, 2008-2009
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the WTF Public License version 2 or
+ *      (at your option) any later version.
+ */
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/module.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include <net/ipv6.h>
+#include "compat_xtables.h"
+#include "xt_ipaddr.h"
+
+static bool ipaddr_mt4(const struct sk_buff *skb, struct xt_action_param *par)
+{
+	const struct xt_ipaddr_mtinfo *info = par->matchinfo;
+	const struct iphdr *iph = ip_hdr(skb);
+
+	printk(KERN_INFO
+	       "xt_ipaddr: IN=%s OUT=%s "
+	       "SRC=" NIPQUAD_FMT " DST=" NIPQUAD_FMT " "
+	       "IPSRC=" NIPQUAD_FMT " IPDST=" NIPQUAD_FMT "\n",
+	       (par->in != NULL) ? par->in->name : "",
+	       (par->out != NULL) ? par->out->name : "",
+	       NIPQUAD(iph->saddr), NIPQUAD(iph->daddr),
+	       NIPQUAD(info->src), NIPQUAD(info->dst));
+
+	if (info->flags & XT_IPADDR_SRC)
+		if ((iph->saddr != info->src.ip) ^
+		    !!(info->flags & XT_IPADDR_SRC_INV)) {
+			printk(KERN_NOTICE "src IP - no match\n");
+			return false;
+		}
+
+	if (info->flags & XT_IPADDR_DST)
+		if ((iph->daddr != info->dst.ip) ^
+		    !!(info->flags & XT_IPADDR_DST_INV)) {
+			printk(KERN_NOTICE "dst IP - no match\n");
+			return false;
+		}
+
+	return true;
+}
+
+static bool ipaddr_mt6(const struct sk_buff *skb, struct xt_action_param *par)
+{
+	const struct xt_ipaddr_mtinfo *info = par->matchinfo;
+	const struct ipv6hdr *iph = ipv6_hdr(skb);
+
+	printk(KERN_INFO
+	       "xt_ipaddr: IN=%s OUT=%s "
+	       "SRC=" NIP6_FMT " DST=" NIP6_FMT " "
+	       "IPSRC=" NIP6_FMT " IPDST=" NIP6_FMT "\n",
+	       (par->in != NULL) ? par->in->name : "",
+	       (par->out != NULL) ? par->out->name : "",
+	       NIP6(iph->saddr), NIP6(iph->daddr),
+	       NIP6(info->src.in6), NIP6(info->dst.in6));
+
+	if (info->flags & XT_IPADDR_SRC)
+		if ((ipv6_addr_cmp(&iph->saddr, &info->src.in6) != 0) ^
+		    !!(info->flags & XT_IPADDR_SRC_INV)) {
+			printk(KERN_NOTICE "src IP - no match\n");
+			return false;
+		}
+
+	if (info->flags & XT_IPADDR_DST)
+		if ((ipv6_addr_cmp(&iph->daddr, &info->dst.in6) != 0) ^
+		    !!(info->flags & XT_IPADDR_DST_INV)) {
+			printk(KERN_NOTICE "dst IP - no match\n");
+			return false;
+		}
+
+	return true;
+}
+
+static int ipaddr_mt_check(const struct xt_mtchk_param *par)
+{
+	const struct xt_ipaddr_mtinfo *info = par->matchinfo;
+
+	printk(KERN_INFO "xt_ipaddr: Added a rule with -m ipaddr in "
+	       "the %s table; this rule is reachable through hooks 0x%x\n",
+	       par->table, par->hook_mask);
+
+	if (par->match->family == NFPROTO_IPV4 &&
+	    ntohl(info->src.ip) == 0xDEADBEEF) {
+		printk(KERN_INFO "xt_ipaddr: I just thought I do not want "
+		       "to let you match on 222.173.190.239\n");
+		return -EPERM;
+	}
+
+	return 0;
+}
+
+static void ipaddr_mt_destroy(const struct xt_mtdtor_param *par)
+{
+	printk(KERN_INFO "One rule with ipaddr match got deleted\n");
+}
+
+static struct xt_match ipaddr_mt_reg[] __read_mostly = {
+	{
+		.name       = "ipaddr",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.match      = ipaddr_mt4,
+		.checkentry = ipaddr_mt_check,
+		.destroy    = ipaddr_mt_destroy,
+		.matchsize  = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
+		.me         = THIS_MODULE,
+	},
+	{
+		.name       = "ipaddr",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.match      = ipaddr_mt6,
+		.checkentry = ipaddr_mt_check,
+		.destroy    = ipaddr_mt_destroy,
+		.matchsize  = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
+		.me         = THIS_MODULE,
+	},
+};
+
+static int __init ipaddr_mt_init(void)
+{
+	return xt_register_matches(ipaddr_mt_reg, ARRAY_SIZE(ipaddr_mt_reg));
+}
+
+static void __exit ipaddr_mt_exit(void)
+{
+	xt_unregister_matches(ipaddr_mt_reg, ARRAY_SIZE(ipaddr_mt_reg));
+}
+
+module_init(ipaddr_mt_init);
+module_exit(ipaddr_mt_exit);
+MODULE_DESCRIPTION("Xtables: Match source/destination address");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_ipaddr");
+MODULE_ALIAS("ip6t_ipaddr");

extensions/xt_ipaddr.h

@@ -0,0 +1,16 @@
+#ifndef _LINUX_NETFILTER_XT_IPADDR_H
+#define _LINUX_NETFILTER_XT_IPADDR_H 1
+
+enum {
+	XT_IPADDR_SRC     = 1 << 0,
+	XT_IPADDR_DST     = 1 << 1,
+	XT_IPADDR_SRC_INV = 1 << 2,
+	XT_IPADDR_DST_INV = 1 << 3,
+};
+
+struct xt_ipaddr_mtinfo {
+	union nf_inet_addr src, dst;
+	__u8 flags;
+};
+
+#endif /* _LINUX_NETFILTER_XT_IPADDR_H */

extensions/xt_quota2.c

@@ -14,10 +14,8 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/proc_fs.h>
-#include <linux/seq_file.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
-#include <linux/uidgid.h>
 #include <linux/version.h>
 #include <asm/atomic.h>
 
@@ -48,27 +46,22 @@ module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
 module_param_named(uid, quota_list_uid, uint, S_IRUGO | S_IWUSR);
 module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);
 
-static int quota_proc_show(struct seq_file *m, void *data)
+static int quota_proc_read(char *page, char **start, off_t offset,
+                           int count, int *eof, void *data)
 {
-	struct xt_quota_counter *e = m->private;
+	struct xt_quota_counter *e = data;
 	int ret;
 
 	spin_lock_bh(&e->lock);
-	ret = seq_printf(m, "%llu\n", e->quota);
+	ret = snprintf(page, PAGE_SIZE, "%llu\n", e->quota);
 	spin_unlock_bh(&e->lock);
 	return ret;
 }
 
-static int quota_proc_open(struct inode *inode, struct file *file)
+static int quota_proc_write(struct file *file, const char __user *input,
+                            unsigned long size, void *data)
 {
-	return single_open(file, quota_proc_show, PDE_DATA(inode));
+	struct xt_quota_counter *e = data;
-}
-
-static ssize_t
-quota_proc_write(struct file *file, const char __user *input,
-                 size_t size, loff_t *loff)
-{
-	struct xt_quota_counter *e = PDE_DATA(file_inode(file));
 	char buf[sizeof("18446744073709551616")];
 
 	if (size > sizeof(buf))
@@ -76,8 +69,6 @@ quota_proc_write(struct file *file, const char __user *input,
 	if (copy_from_user(buf, input, size) != 0)
 		return -EFAULT;
 	buf[sizeof(buf)-1] = '\0';
-	if (size < sizeof(buf))
-		buf[size] = '\0';
 
 	spin_lock_bh(&e->lock);
 	e->quota = simple_strtoull(buf, NULL, 0);
@@ -85,14 +76,6 @@ quota_proc_write(struct file *file, const char __user *input,
 	return size;
 }
 
-static const struct file_operations quota_proc_fops = {
-	.open    = quota_proc_open,
-	.read    = seq_read,
-	.llseek  = seq_lseek,
-	.write   = quota_proc_write,
-	.release = single_release,
-};
-
 static struct xt_quota_counter *
 q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
 {
@@ -140,14 +123,16 @@ q2_get_counter(const struct xt_quota_mtinfo2 *q)
 	if (e == NULL)
 		goto out;
 
-	p = proc_create_data(e->name, quota_list_perms, proc_xt_quota,
+	p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
-	                     &quota_proc_fops, e);
+	                      proc_xt_quota);
 	if (p == NULL || IS_ERR(p))
 		goto out;
 
-	e->procfs_entry = p;
+	p->data         = e;
-	proc_set_user(p, make_kuid(&init_user_ns, quota_list_uid),
+	p->read_proc    = quota_proc_read;
-	              make_kgid(&init_user_ns, quota_list_gid));
+	p->write_proc   = quota_proc_write;
+	p->uid          = quota_list_uid;
+	p->gid          = quota_list_gid;
 	list_add_tail(&e->list, &counter_list);
 	spin_unlock_bh(&counter_list_lock);
 	return e;
@@ -221,14 +206,13 @@ quota_mt2(const struct sk_buff *skb, struct xt_action_param *par)
 		}
 		ret = true;
 	} else {
-		if (e->quota >= ((q->flags & XT_QUOTA_PACKET) ? 1 : skb->len)) {
+		if (e->quota >= skb->len) {
 			if (!(q->flags & XT_QUOTA_NO_CHANGE))
 				e->quota -= (q->flags & XT_QUOTA_PACKET) ? 1 : skb->len;
 			ret = !ret;
 		} else {
 			/* we do not allow even small packets from now on */
-			if (!(q->flags & XT_QUOTA_NO_CHANGE))
+			e->quota = 0;
-				e->quota = 0;
 		}
 		q->quota = e->quota;
 	}

geoip/xt_geoip_build.1

@@ -29,7 +29,7 @@ Specify a target directory into which the files are to be put.
 .PP
 Shell commands to build the databases and put them to where they are expected:
 .PP
-xt_geoip_build \-D /usr/share/xt_geoip
+xt_geoip_build -D /usr/share/xt_geoip
 .SH See also
 .PP
 xt_geoip_dl(1)

geoip/xt_geoip_dl

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-rm -f GeoIPv6.csv GeoIPv6.csv.gz GeoIPCountryCSV.zip GeoIPCountryWhois.csv;
+rm -f GeoIPv6.csv{,.gz} GeoIPCountryCSV.zip GeoIPCountryWhois.csv;
 wget \
 	http://geolite.maxmind.com/download/geoip/database/GeoIPv6.csv.gz \
 	http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip;

mconfig

@@ -8,6 +8,8 @@ build_DNETMAP=m
 build_ECHO=m
 build_IPMARK=m
 build_LOGMARK=m
+build_RAWNAT=m
+build_STEAL=m
 build_SYSRQ=m
 build_TARPIT=m
 build_condition=m
@@ -15,6 +17,7 @@ build_fuzzy=m
 build_geoip=m
 build_gradm=m
 build_iface=m
+build_ipaddr=m
 build_ipp2p=m
 build_ipv4options=m
 build_length2=m

xtables-addons.8.in

@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "US Hoarding All The Cold Edition" "" "v2.4 (2014-01-09)"
+.TH xtables-addons 8 "v2.1 (2012-11-27)" "" "v2.1 (2012-11-27)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets