Xtables-addons 3.6

shash_desc::flags was removed from the kernel in 5.1.

That assignment was actually superfluous anyway, because crypto.desc
is zero-initialized when crypto is initialized (xt_pknock.c, ll.
110ff.).

Signed-off-by: Jeremy Sowden <jeremy@azazel.net>

.gitignore

@@ -2,7 +2,9 @@
 *.la
 *.lo
 *.loT
+*.mod
 *.o
+.cache.mk
 .deps/
 .dirstamp
 .libs/

INSTALL

@@ -12,16 +12,17 @@ in combination with the kernel's Kbuild system.
 Supported configurations for this release
 =========================================
 
-	* iptables >= 1.4.5
+	* iptables >= 1.6.0
 
-	* kernel-devel >= 3.7
+	* kernel-devel >= 4.15
 	  with prepared build/output directory
 	  - CONFIG_NF_CONNTRACK
 	  - CONFIG_NF_CONNTRACK_MARK enabled =y or as module (=m)
 	  - CONFIG_CONNECTOR y/m if you wish to receive userspace
 	    notifications from pknock through netlink/connector
 
-(Use xtables-addons-1.x if you need support for Linux < 3.7.)
+(Use xtables-addons-1.x if you need support for Linux < 3.7.
+Use xtables-addons-2.x if you need support for Linux < 4.15.)
 
 
 Selecting extensions

README

@@ -1,57 +1,15 @@
 Xtables-addons
 ==============
 
-Xtables-addons is the proclaimed successor to patch-o-matic(-ng). It
-contains extensions that were not accepted in the main Xtables
-package.
+Xtables-addons is a set of extensions that were not accepted in the
+Linux kernel and/or main Xtables/iptables package.
 
-Xtables-addons is different from patch-o-matic in that you do not
-have to patch or recompile either kernel or Xtables(iptables). But
-please see the INSTALL file for the minimum requirements of this
-package.
-
-All code imported from patch-o-matic has been reviewed and all
-apparent bugs like binary stability across multiarches, missing
-sanity checks and incorrect endianess handling have been fixed,
-simplified, and sped up.
+It superseded the earlier patch-o-matic(-ng) package in that no
+patching and/or recompilation of either the kernel or
+Xtables/iptables is required. However, do see the INSTALL file for
+the minimum requirements of Xtables-addons.
 
 
 Included in this package
 ========================
 - xt_ACCOUNT 1.16, libxt_ACCOUNT 1.3
-
-
-Inclusion into a kernel tree
-============================
-
-
-
-
-External extensions
-===================
-
-The program "xa-download-more" can be used to download more
-extensions from 3rd parties into the source tree. The URLs are listed
-in the "sources" file. If the "sources" file contains an entry like
-
-	http://foobar.org/xa/
-
-xa-download-more will inspect http://foobar.org/xa/xa-index.txt for
-files to download. That file may contain
-
-	foobar.tar.bz2
-
-and xa-download-more will then retrieve and unpack
-http://foobar.org/xa/foobar.tar.bz2.
-
-Files that should be contained in the tarball are an mconfig and
-Kbuild files to control building the extension, libxt_foobar.c for
-the userspace extension and xt_foobar.c for the kernel extension.
-
-	mconfig.foobar
-	extensions/Kbuild.foobar
-	extensions/Mbuild.foobar
-	extensions/libxt_foobar.c
-	extensions/libxt_foobar.man
-	extensions/xt_foobar.c
-	extensions/xt_foobar.h

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([xtables-addons], [2.8])
+AC_INIT([xtables-addons], [3.6])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -26,7 +26,7 @@ fi
 
 AC_CHECK_HEADERS([linux/netfilter/x_tables.h], [],
 	[AC_MSG_ERROR([You need to have linux/netfilter/x_tables.h, see INSTALL file for details])])
-PKG_CHECK_MODULES([libxtables], [xtables >= 1.4.5])
+PKG_CHECK_MODULES([libxtables], [xtables >= 1.6.0])
 xtlibdir="$(pkg-config --variable=xtlibdir xtables)"
 
 AC_ARG_WITH([xtlibdir],
@@ -44,31 +44,25 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
 
 if test -n "$kbuilddir"; then
 	AC_MSG_CHECKING([kernel version that we will build against])
-	krel="$(make -sC "$kbuilddir" M=$PWD kernelrelease)";
-	kmajor="${krel%%[[^0-9]]*}";
-	kmajor="$(($kmajor+0))";
-	krel="${krel:${#kmajor}}";
-	krel="${krel#.}";
-	kminor="${krel%%[[^0-9]]*}";
-	kminor="$(($kminor+0))";
-	krel="${krel:${#kminor}}";
-	krel="${krel#.}";
-	kmicro="${krel%%[[^0-9]]*}";
-	kmicro="$(($kmicro+0))";
-	krel="${krel:${#kmicro}}";
-	krel="${krel#.}";
-	kstable="${krel%%[[^0-9]]*}";
-	kstable="$(($kstable+0))";
+	krel="$(make -sC "$kbuilddir" M=$PWD kernelrelease | $AWK -v 'FS=[[^0-9.]]' '{print $1; exit}')"
+	save_IFS="$IFS"
+	IFS='.'
+	set x $krel
+	IFS="$save_IFS"
+	kmajor="$(($2+0))"
+	kminor="$(($3+0))"
+	kmicro="$(($4+0))"
+	kstable="$(($5+0))"
 	if test -z "$kmajor" -o -z "$kminor" -o -z "$kmicro"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 4 -o "$kmajor" -eq 4 -a "$kminor" -gt 1; then
+		if test "$kmajor" -gt 5 -o "$kmajor" -eq 5 -a "$kminor" -gt 3; then
 			echo "WARNING: That kernel version is not officially supported yet. Continue at own luck.";
-		elif test "$kmajor" -eq 4 -a "$kminor" -le 1; then
-			:;
-		elif test "$kmajor" -eq 3 -a "$kminor" -ge 7; then
-			:;
+		elif test "$kmajor" -eq 5 -a "$kminor" -ge 0; then
+			:
+		elif test "$kmajor" -eq 4 -a "$kminor" -ge 18; then
+			:
 		else
 			echo "WARNING: That kernel version is not officially supported.";
 		fi;

doc/changelog.txt

@@ -3,6 +3,98 @@ HEAD
 ====
 
 
+v3.6 (2019-11-20)
+=================
+Enhancements:
+- support for up to Linux 5.4
+
+
+v3.5 (2019-09-10)
+=================
+Enhancements:
+- xt_DELUDE, xt_TARPIT: added additional code needed to work with
+  bridges from Linux 5.0 onwards.
+
+
+v3.4 (2019-09-06)
+=================
+Enhancements:
+- support for up to Linux 5.3
+- xt_PROTO module
+
+
+v3.3 (2019-03-07)
+=================
+Enhancements:
+- support for Linux 5.0
+
+
+v3.2 (2018-09-07)
+=================
+Changes:
+- rework xt_geoip_build to scan the immediate directory for .csv,
+  not to scan for GeoLite2-Country-CSV_\d+.
+
+
+v3.1 (2018-08-14)
+=================
+Enhancements:
+- support for Linux 4.17, 4.18
+
+
+v3.0 (2018-02-12)
+=================
+Enhancements:
+- support for Linux 4.15, 4.16
+Changes:
+- remove support for Linux 3.7--4.14
+
+
+v2.14 (2017-11-22)
+==================
+Enhancements:
+- support for Linux up to 4.14
+Fixes:
+- xt_DNETMAP: fix some reports from PVSStudio (a static checker)
+
+
+v2.13 (2017-06-29)
+==================
+Enhancements:
+- support for Linux up to 4.12
+- xt_condition: namespace support
+Fixes:
+- xt_geoip: check for allocation overflow
+- xt_DNETMAP: fix a buffer overflow
+
+
+v2.12 (2017-01-11)
+==================
+Enhancements:
+- support for Linux up to 4.10
+
+
+v2.11 (2016-05-20)
+==================
+Enhancements:
+- support for Linux 4.5, 4.6
+- xt_ECHO: tentatively support responding to fragments
+
+
+v2.10 (2015-11-20)
+==================
+Enhancements:
+- Support for Linux 4.4
+Fixes:
+- xt_ACCOUNT: call free_page with the right amount of pages
+
+
+v2.9 (2015-10-12)
+=================
+Enhancements:
+- Support for Linux 4.3
+
+
 v2.8 (2015-08-19)
 =================
 Enhancements:
@@ -82,5 +174,5 @@ Changes:
 Enhancements:
 - Support for Linux 3.7
 
-If you want to use Xtables-addons with kernels older than 3.7,
-use the addons 1.x series (maintained but without new features).
+If you want to use Xtables-addons with kernels older than 4.15,
+use the addons 2.x series.

extensions/ACCOUNT/xt_ACCOUNT.c

@@ -15,6 +15,7 @@
 //#define DEBUG 1
 #include <linux/module.h>
 #include <linux/version.h>
+#include <net/net_namespace.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <net/icmp.h>
@@ -29,6 +30,7 @@
 #include <linux/string.h>
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
+#include <net/netns/generic.h>
 
 #include <net/route.h>
 #include "xt_ACCOUNT.h"
@@ -38,6 +40,9 @@
 #error "ipt_ACCOUNT needs at least a PAGE_SIZE of 4096"
 #endif
 
+static unsigned int max_tables_limit = 128;
+module_param(max_tables_limit, uint, 0);
+
 /**
  * Internal table structure, generated by check_entry()
  * @name:	name of the table
@@ -100,14 +105,19 @@ struct ipt_acc_mask_8 {
 	struct ipt_acc_mask_16 *mask_16[256];
 };
 
-static struct ipt_acc_table *ipt_acc_tables;
-static struct ipt_acc_handle *ipt_acc_handles;
-static void *ipt_acc_tmpbuf;
+static int ipt_acc_net_id __read_mostly;
 
-/* Spinlock used for manipulating the current accounting tables/data */
-static DEFINE_SPINLOCK(ipt_acc_lock);
-/* Mutex (semaphore) used for manipulating userspace handles/snapshot data */
-static struct semaphore ipt_acc_userspace_mutex;
+struct ipt_acc_net {
+	/* Spinlock used for manipulating the current accounting tables/data */
+	spinlock_t ipt_acc_lock;
+
+	/* Mutex (semaphore) used for manipulating userspace handles/snapshot data */
+	struct semaphore ipt_acc_userspace_mutex;
+
+	struct ipt_acc_table *ipt_acc_tables;
+	struct ipt_acc_handle *ipt_acc_handles;
+	void *ipt_acc_tmpbuf;
+};
 
 /* Allocates a page pair and clears it */
 static void *ipt_acc_zalloc_page(void)
@@ -115,10 +125,8 @@ static void *ipt_acc_zalloc_page(void)
 	// Don't use get_zeroed_page until it's fixed in the kernel.
 	// get_zeroed_page(GFP_ATOMIC)
 	void *mem = (void *)__get_free_pages(GFP_ATOMIC, 2);
-	if (mem) {
+	if (mem != NULL)
 		memset(mem, 0,  2 *PAGE_SIZE);
-	}
-
 	return mem;
 }
 
@@ -139,11 +147,9 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 	if (depth == 1) {
 		struct ipt_acc_mask_16 *mask_16 = data;
 		unsigned int b;
-		for (b = 0; b <= 255; b++) {
-			if (mask_16->mask_24[b]) {
-				free_page((unsigned long)mask_16->mask_24[b]);
-			}
-		}
+		for (b = 0; b <= 255; ++b)
+			if (mask_16->mask_24[b])
+				free_pages((unsigned long)mask_16->mask_24[b], 2);
 		free_pages((unsigned long)data, 2);
 		return;
 	}
@@ -156,12 +162,10 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 				struct ipt_acc_mask_16 *mask_16 =
 					((struct ipt_acc_mask_8 *)data)->mask_16[a];
 
-				for (b = 0; b <= 255; b++) {
-					if (mask_16->mask_24[b]) {
-						free_page((unsigned long)mask_16->mask_24[b]);
-					}
-				}
-				free_page((unsigned long)mask_16);
+				for (b = 0; b <= 255; ++b)
+					if (mask_16->mask_24[b])
+						free_pages((unsigned long)mask_16->mask_24[b], 2);
+				free_pages((unsigned long)mask_16, 2);
 			}
 		}
 		free_pages((unsigned long)data, 2);
@@ -175,7 +179,8 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 
 /* Look for existing table / insert new one.
    Return internal ID or -1 on error */
-static int ipt_acc_table_insert(const char *name, __be32 ip, __be32 netmask)
+static int ipt_acc_table_insert(struct ipt_acc_table *ipt_acc_tables,
+				const char *name, __be32 ip, __be32 netmask)
 {
 	unsigned int i;
 
@@ -183,7 +188,7 @@ static int ipt_acc_table_insert(const char *name, __be32 ip, __be32 netmask)
 		name, NIPQUAD(ip), NIPQUAD(netmask));
 
 	/* Look for existing table */
-	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
+	for (i = 0; i < max_tables_limit; i++) {
 		if (strncmp(ipt_acc_tables[i].name, name,
 		    ACCOUNT_TABLE_NAME_LEN) == 0) {
 			pr_debug("ACCOUNT: Found existing slot: %d - "
@@ -207,7 +212,7 @@ static int ipt_acc_table_insert(const char *name, __be32 ip, __be32 netmask)
 	}
 
 	/* Insert new table */
-	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
+	for (i = 0; i < max_tables_limit; i++) {
 		/* Found free slot */
 		if (ipt_acc_tables[i].name[0] == 0) {
 			unsigned int netsize = 0;
@@ -256,19 +261,21 @@ static int ipt_acc_table_insert(const char *name, __be32 ip, __be32 netmask)
 
 	/* No free slot found */
 	printk("ACCOUNT: No free table slot found (max: %d). "
-		"Please increase ACCOUNT_MAX_TABLES.\n", ACCOUNT_MAX_TABLES);
+		"Please increase the \"max_tables_limit\" module parameter.\n", max_tables_limit);
 	return -1;
 }
 
 static int ipt_acc_checkentry(const struct xt_tgchk_param *par)
 {
+	struct ipt_acc_net *ian = net_generic(par->net, ipt_acc_net_id);
 	struct ipt_acc_info *info = par->targinfo;
 	int table_nr;
 
-	spin_lock_bh(&ipt_acc_lock);
-	table_nr = ipt_acc_table_insert(info->table_name, info->net_ip,
+	spin_lock_bh(&ian->ipt_acc_lock);
+	table_nr = ipt_acc_table_insert(ian->ipt_acc_tables,
+					info->table_name, info->net_ip,
 		info->net_mask);
-	spin_unlock_bh(&ipt_acc_lock);
+	spin_unlock_bh(&ian->ipt_acc_lock);
 
 	if (table_nr == -1) {
 		printk("ACCOUNT: Table insert problem. Aborting\n");
@@ -283,10 +290,11 @@ static int ipt_acc_checkentry(const struct xt_tgchk_param *par)
 
 static void ipt_acc_destroy(const struct xt_tgdtor_param *par)
 {
+	struct ipt_acc_net *ian = net_generic(par->net, ipt_acc_net_id);
 	unsigned int i;
 	struct ipt_acc_info *info = par->targinfo;
 
-	spin_lock_bh(&ipt_acc_lock);
+	spin_lock_bh(&ian->ipt_acc_lock);
 
 	pr_debug("ACCOUNT: ipt_acc_deleteentry called for table: %s (#%d)\n",
 		info->table_name, info->table_nr);
@@ -294,32 +302,32 @@ static void ipt_acc_destroy(const struct xt_tgdtor_param *par)
 	info->table_nr = -1;	/* Set back to original state */
 
 	/* Look for table */
-	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
-		if (strncmp(ipt_acc_tables[i].name, info->table_name,
+	for (i = 0; i < max_tables_limit; i++) {
+		if (strncmp(ian->ipt_acc_tables[i].name, info->table_name,
 		    ACCOUNT_TABLE_NAME_LEN) == 0) {
 			pr_debug("ACCOUNT: Found table at slot: %d\n", i);
 
-			ipt_acc_tables[i].refcount--;
+			ian->ipt_acc_tables[i].refcount--;
 			pr_debug("ACCOUNT: Refcount left: %d\n",
-				ipt_acc_tables[i].refcount);
+				ian->ipt_acc_tables[i].refcount);
 
 			/* Table not needed anymore? */
-			if (ipt_acc_tables[i].refcount == 0) {
+			if (ian->ipt_acc_tables[i].refcount == 0) {
 				pr_debug("ACCOUNT: Destroying table at slot: %d\n", i);
-				ipt_acc_data_free(ipt_acc_tables[i].data,
-					ipt_acc_tables[i].depth);
-				memset(&ipt_acc_tables[i], 0,
+				ipt_acc_data_free(ian->ipt_acc_tables[i].data,
+					ian->ipt_acc_tables[i].depth);
+				memset(&ian->ipt_acc_tables[i], 0,
 					sizeof(struct ipt_acc_table));
 			}
 
-			spin_unlock_bh(&ipt_acc_lock);
+			spin_unlock_bh(&ian->ipt_acc_lock);
 			return;
 		}
 	}
 
 	/* Table not found */
 	printk("ACCOUNT: Table %s not found for destroy\n", info->table_name);
-	spin_unlock_bh(&ipt_acc_lock);
+	spin_unlock_bh(&ian->ipt_acc_lock);
 }
 
 static void ipt_acc_depth0_insert(struct ipt_acc_mask_24 *mask_24,
@@ -477,6 +485,8 @@ static void ipt_acc_depth2_insert(struct ipt_acc_mask_8 *mask_8,
 static unsigned int
 ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
+	struct ipt_acc_net *ian = net_generic(par->state->net, ipt_acc_net_id);
+	struct ipt_acc_table *ipt_acc_tables = ian->ipt_acc_tables;
 	const struct ipt_acc_info *info =
 		par->targinfo;
 
@@ -484,13 +494,13 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 	__be32 dst_ip = ip_hdr(skb)->daddr;
 	uint32_t size = ntohs(ip_hdr(skb)->tot_len);
 
-	spin_lock_bh(&ipt_acc_lock);
+	spin_lock_bh(&ian->ipt_acc_lock);
 
 	if (ipt_acc_tables[info->table_nr].name[0] == 0) {
 		printk("ACCOUNT: ipt_acc_target: Invalid table id %u. "
 			"IPs %u.%u.%u.%u/%u.%u.%u.%u\n", info->table_nr,
 			NIPQUAD(src_ip), NIPQUAD(dst_ip));
-		spin_unlock_bh(&ipt_acc_lock);
+		spin_unlock_bh(&ian->ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -502,7 +512,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 			ipt_acc_tables[info->table_nr].ip,
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
-		spin_unlock_bh(&ipt_acc_lock);
+		spin_unlock_bh(&ian->ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -513,7 +523,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 			ipt_acc_tables[info->table_nr].ip,
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
-		spin_unlock_bh(&ipt_acc_lock);
+		spin_unlock_bh(&ian->ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -524,7 +534,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 			ipt_acc_tables[info->table_nr].ip,
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
-		spin_unlock_bh(&ipt_acc_lock);
+		spin_unlock_bh(&ian->ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -532,7 +542,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 		"Table id %u. IPs %u.%u.%u.%u/%u.%u.%u.%u\n",
 		info->table_nr, NIPQUAD(src_ip), NIPQUAD(dst_ip));
 
-	spin_unlock_bh(&ipt_acc_lock);
+	spin_unlock_bh(&ian->ipt_acc_lock);
 	return XT_CONTINUE;
 }
 
@@ -553,7 +563,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 	but there could be two or more applications accessing the data
 	at the same time.
 */
-static int ipt_acc_handle_find_slot(void)
+static int ipt_acc_handle_find_slot(struct ipt_acc_handle *ipt_acc_handles)
 {
 	unsigned int i;
 	/* Insert new table */
@@ -573,7 +583,8 @@ static int ipt_acc_handle_find_slot(void)
 	return -1;
 }
 
-static int ipt_acc_handle_free(unsigned int handle)
+static int ipt_acc_handle_free(struct ipt_acc_handle *ipt_acc_handles,
+			       unsigned int handle)
 {
 	if (handle >= ACCOUNT_MAX_HANDLES) {
 		printk("ACCOUNT: Invalid handle for ipt_acc_handle_free() specified:"
@@ -589,18 +600,19 @@ static int ipt_acc_handle_free(unsigned int handle)
 
 /* Prepare data for read without flush. Use only for debugging!
    Real applications should use read&flush as it's way more efficent */
-static int ipt_acc_handle_prepare_read(char *tablename,
+static int ipt_acc_handle_prepare_read(struct ipt_acc_table *ipt_acc_tables,
+				       char *tablename,
 		 struct ipt_acc_handle *dest, uint32_t *count)
 {
 	int table_nr = -1;
 	uint8_t depth;
 
-	for (table_nr = 0; table_nr < ACCOUNT_MAX_TABLES; table_nr++)
+	for (table_nr = 0; table_nr < max_tables_limit; table_nr++)
 		if (strncmp(ipt_acc_tables[table_nr].name, tablename,
 		    ACCOUNT_TABLE_NAME_LEN) == 0)
 			break;
 
-	if (table_nr == ACCOUNT_MAX_TABLES) {
+	if (table_nr == max_tables_limit) {
 		printk("ACCOUNT: ipt_acc_handle_prepare_read(): "
 			"Table %s not found\n", tablename);
 		return -1;
@@ -631,18 +643,18 @@ static int ipt_acc_handle_prepare_read(char *tablename,
 		unsigned int b;
 
 		for (b = 0; b <= 255; b++) {
-			if (src_16->mask_24[b]) {
-				if ((network_16->mask_24[b] =
-				    ipt_acc_zalloc_page()) == NULL) {
-					printk("ACCOUNT: out of memory during copy of 16 bit "
-						"network in ipt_acc_handle_prepare_read()\n");
-					ipt_acc_data_free(dest->data, depth);
-					return -1;
-				}
-
-				memcpy(network_16->mask_24[b], src_16->mask_24[b],
-					sizeof(struct ipt_acc_mask_24));
+			if (src_16->mask_24[b] == NULL)
+				continue;
+			if ((network_16->mask_24[b] =
+			    ipt_acc_zalloc_page()) == NULL) {
+				printk("ACCOUNT: out of memory during copy of 16 bit "
+					"network in ipt_acc_handle_prepare_read()\n");
+				ipt_acc_data_free(dest->data, depth);
+				return -1;
 			}
+
+			memcpy(network_16->mask_24[b], src_16->mask_24[b],
+				sizeof(struct ipt_acc_mask_24));
 		}
 	} else if (depth == 2) {
 		struct ipt_acc_mask_8 *src_8 =
@@ -652,35 +664,35 @@ static int ipt_acc_handle_prepare_read(char *tablename,
 		unsigned int a, b;
 
 		for (a = 0; a <= 255; a++) {
-			if (src_8->mask_16[a]) {
-				if ((network_8->mask_16[a] =
+			if (src_8->mask_16[a] == NULL)
+				continue;
+			if ((network_8->mask_16[a] =
+			    ipt_acc_zalloc_page()) == NULL) {
+				printk("ACCOUNT: out of memory during copy of 24 bit network"
+					" in ipt_acc_handle_prepare_read()\n");
+				ipt_acc_data_free(dest->data, depth);
+				return -1;
+			}
+
+			memcpy(network_8->mask_16[a], src_8->mask_16[a],
+				sizeof(struct ipt_acc_mask_16));
+
+			src_16 = src_8->mask_16[a];
+			network_16 = network_8->mask_16[a];
+
+			for (b = 0; b <= 255; b++) {
+				if (src_16->mask_24[b] == NULL)
+					continue;
+				if ((network_16->mask_24[b] =
 				    ipt_acc_zalloc_page()) == NULL) {
-					printk("ACCOUNT: out of memory during copy of 24 bit network"
-						" in ipt_acc_handle_prepare_read()\n");
+					printk("ACCOUNT: out of memory during copy of 16 bit"
+						" network in ipt_acc_handle_prepare_read()\n");
 					ipt_acc_data_free(dest->data, depth);
 					return -1;
 				}
 
-				memcpy(network_8->mask_16[a], src_8->mask_16[a],
-					sizeof(struct ipt_acc_mask_16));
-
-				src_16 = src_8->mask_16[a];
-				network_16 = network_8->mask_16[a];
-
-				for (b = 0; b <= 255; b++) {
-					if (src_16->mask_24[b]) {
-						if ((network_16->mask_24[b] =
-						    ipt_acc_zalloc_page()) == NULL) {
-							printk("ACCOUNT: out of memory during copy of 16 bit"
-								" network in ipt_acc_handle_prepare_read()\n");
-							ipt_acc_data_free(dest->data, depth);
-							return -1;
-						}
-
-						memcpy(network_16->mask_24[b], src_16->mask_24[b],
-							sizeof(struct ipt_acc_mask_24));
-					}
-				}
+				memcpy(network_16->mask_24[b], src_16->mask_24[b],
+					sizeof(struct ipt_acc_mask_24));
 			}
 		}
 	}
@@ -691,18 +703,19 @@ static int ipt_acc_handle_prepare_read(char *tablename,
 }
 
 /* Prepare data for read and flush it */
-static int ipt_acc_handle_prepare_read_flush(char *tablename,
+static int ipt_acc_handle_prepare_read_flush(struct ipt_acc_table *ipt_acc_tables,
+					     char *tablename,
 			   struct ipt_acc_handle *dest, uint32_t *count)
 {
 	int table_nr;
 	void *new_data_page;
 
-	for (table_nr = 0; table_nr < ACCOUNT_MAX_TABLES; table_nr++)
+	for (table_nr = 0; table_nr < max_tables_limit; table_nr++)
 		if (strncmp(ipt_acc_tables[table_nr].name, tablename,
 		    ACCOUNT_TABLE_NAME_LEN) == 0)
 			break;
 
-	if (table_nr == ACCOUNT_MAX_TABLES) {
+	if (table_nr == max_tables_limit) {
 		printk("ACCOUNT: ipt_acc_handle_prepare_read_flush(): "
 			"Table %s not found\n", tablename);
 		return -1;
@@ -732,7 +745,8 @@ static int ipt_acc_handle_prepare_read_flush(char *tablename,
 /* Copy 8 bit network data into a prepared buffer.
    We only copy entries != 0 to increase performance.
 */
-static int ipt_acc_handle_copy_data(void *to_user, unsigned long *to_user_pos,
+static int ipt_acc_handle_copy_data(struct ipt_acc_net *ian,
+				    void *to_user, unsigned long *to_user_pos,
 				unsigned long *tmpbuf_pos,
 				struct ipt_acc_mask_24 *data,
 				uint32_t net_ip, uint32_t net_OR_mask)
@@ -742,25 +756,26 @@ static int ipt_acc_handle_copy_data(void *to_user, unsigned long *to_user_pos,
 	unsigned int i;
 
 	for (i = 0; i <= 255; i++) {
-		if (data->ip[i].src_packets || data->ip[i].dst_packets) {
-			handle_ip.ip = net_ip | net_OR_mask | i;
+		if (data->ip[i].src_packets == 0 &&
+		    data->ip[i].dst_packets == 0)
+			continue;
 
-			handle_ip.src_packets = data->ip[i].src_packets;
-			handle_ip.src_bytes = data->ip[i].src_bytes;
-			handle_ip.dst_packets = data->ip[i].dst_packets;
-			handle_ip.dst_bytes = data->ip[i].dst_bytes;
+		handle_ip.ip = net_ip | net_OR_mask | i;
+		handle_ip.src_packets = data->ip[i].src_packets;
+		handle_ip.src_bytes = data->ip[i].src_bytes;
+		handle_ip.dst_packets = data->ip[i].dst_packets;
+		handle_ip.dst_bytes = data->ip[i].dst_bytes;
 
-			/* Temporary buffer full? Flush to userspace */
-			if (*tmpbuf_pos + handle_ip_size >= PAGE_SIZE) {
-				if (copy_to_user(to_user + *to_user_pos, ipt_acc_tmpbuf,
-				    *tmpbuf_pos))
-					return -EFAULT;
-				*to_user_pos = *to_user_pos + *tmpbuf_pos;
-				*tmpbuf_pos = 0;
-			}
-			memcpy(ipt_acc_tmpbuf + *tmpbuf_pos, &handle_ip, handle_ip_size);
-			*tmpbuf_pos += handle_ip_size;
+		/* Temporary buffer full? Flush to userspace */
+		if (*tmpbuf_pos + handle_ip_size >= PAGE_SIZE) {
+			if (copy_to_user(to_user + *to_user_pos, ian->ipt_acc_tmpbuf,
+			    *tmpbuf_pos))
+				return -EFAULT;
+			*to_user_pos = *to_user_pos + *tmpbuf_pos;
+			*tmpbuf_pos = 0;
 		}
+		memcpy(ian->ipt_acc_tmpbuf + *tmpbuf_pos, &handle_ip, handle_ip_size);
+		*tmpbuf_pos += handle_ip_size;
 	}
 
 	return 0;
@@ -770,7 +785,8 @@ static int ipt_acc_handle_copy_data(void *to_user, unsigned long *to_user_pos,
    We only copy entries != 0 to increase performance.
    Overwrites ipt_acc_tmpbuf.
 */
-static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
+static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
+				   uint32_t handle, void *to_user)
 {
 	unsigned long to_user_pos = 0, tmpbuf_pos = 0;
 	uint32_t net_ip;
@@ -782,25 +798,25 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 		return -1;
 	}
 
-	if (ipt_acc_handles[handle].data == NULL) {
+	if (ian->ipt_acc_handles[handle].data == NULL) {
 		printk("ACCOUNT: handle %u is BROKEN: Contains no data\n", handle);
 		return -1;
 	}
 
-	net_ip = ntohl(ipt_acc_handles[handle].ip);
-	depth = ipt_acc_handles[handle].depth;
+	net_ip = ntohl(ian->ipt_acc_handles[handle].ip);
+	depth = ian->ipt_acc_handles[handle].depth;
 
 	/* 8 bit network */
 	if (depth == 0) {
 		struct ipt_acc_mask_24 *network =
-			ipt_acc_handles[handle].data;
-		if (ipt_acc_handle_copy_data(to_user, &to_user_pos, &tmpbuf_pos,
+			ian->ipt_acc_handles[handle].data;
+		if (ipt_acc_handle_copy_data(ian, to_user, &to_user_pos, &tmpbuf_pos,
 		    network, net_ip, 0))
 			return -1;
 
 		/* Flush remaining data to userspace */
 		if (tmpbuf_pos)
-			if (copy_to_user(to_user + to_user_pos, ipt_acc_tmpbuf, tmpbuf_pos))
+			if (copy_to_user(to_user + to_user_pos, ian->ipt_acc_tmpbuf, tmpbuf_pos))
 				return -1;
 
 		return 0;
@@ -809,13 +825,13 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 	/* 16 bit network */
 	if (depth == 1) {
 		struct ipt_acc_mask_16 *network_16 =
-			ipt_acc_handles[handle].data;
+			ian->ipt_acc_handles[handle].data;
 		unsigned int b;
 		for (b = 0; b <= 255; b++) {
 			if (network_16->mask_24[b]) {
 				struct ipt_acc_mask_24 *network =
 					network_16->mask_24[b];
-				if (ipt_acc_handle_copy_data(to_user, &to_user_pos,
+				if (ipt_acc_handle_copy_data(ian, to_user, &to_user_pos,
 				    &tmpbuf_pos, network, net_ip, (b << 8)))
 					return -1;
 			}
@@ -823,7 +839,7 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 
 		/* Flush remaining data to userspace */
 		if (tmpbuf_pos)
-			if (copy_to_user(to_user + to_user_pos, ipt_acc_tmpbuf, tmpbuf_pos))
+			if (copy_to_user(to_user + to_user_pos, ian->ipt_acc_tmpbuf, tmpbuf_pos))
 				return -1;
 
 		return 0;
@@ -832,7 +848,7 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 	/* 24 bit network */
 	if (depth == 2) {
 		struct ipt_acc_mask_8 *network_8 =
-			ipt_acc_handles[handle].data;
+			ian->ipt_acc_handles[handle].data;
 		unsigned int a, b;
 		for (a = 0; a <= 255; a++) {
 			if (network_8->mask_16[a]) {
@@ -842,7 +858,7 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 					if (network_16->mask_24[b]) {
 						struct ipt_acc_mask_24 *network =
 							network_16->mask_24[b];
-						if (ipt_acc_handle_copy_data(to_user,
+						if (ipt_acc_handle_copy_data(ian, to_user,
 						    &to_user_pos, &tmpbuf_pos,
 						    network, net_ip, (a << 16) | (b << 8)))
 							return -1;
@@ -853,7 +869,7 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 
 		/* Flush remaining data to userspace */
 		if (tmpbuf_pos)
-			if (copy_to_user(to_user + to_user_pos, ipt_acc_tmpbuf, tmpbuf_pos))
+			if (copy_to_user(to_user + to_user_pos, ian->ipt_acc_tmpbuf, tmpbuf_pos))
 				return -1;
 
 		return 0;
@@ -865,6 +881,8 @@ static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
 static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 			void *user, unsigned int len)
 {
+	struct net *net = sock_net(sk);
+	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
 	struct ipt_acc_handle_sockopt handle;
 	int ret = -EINVAL;
 
@@ -886,16 +904,16 @@ static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 			break;
 		}
 
-		down(&ipt_acc_userspace_mutex);
-		ret = ipt_acc_handle_free(handle.handle_nr);
-		up(&ipt_acc_userspace_mutex);
+		down(&ian->ipt_acc_userspace_mutex);
+		ret = ipt_acc_handle_free(ian->ipt_acc_handles, handle.handle_nr);
+		up(&ian->ipt_acc_userspace_mutex);
 		break;
 	case IPT_SO_SET_ACCOUNT_HANDLE_FREE_ALL: {
 		unsigned int i;
-		down(&ipt_acc_userspace_mutex);
+		down(&ian->ipt_acc_userspace_mutex);
 		for (i = 0; i < ACCOUNT_MAX_HANDLES; i++)
-			ipt_acc_handle_free(i);
-		up(&ipt_acc_userspace_mutex);
+			ipt_acc_handle_free(ian->ipt_acc_handles, i);
+		up(&ian->ipt_acc_userspace_mutex);
 		ret = 0;
 		break;
 	}
@@ -908,6 +926,8 @@ static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 
 static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 {
+	struct net *net = sock_net(sk);
+	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
 	struct ipt_acc_handle_sockopt handle;
 	int ret = -EINVAL;
 
@@ -932,28 +952,28 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 			break;
 		}
 
-		spin_lock_bh(&ipt_acc_lock);
+		spin_lock_bh(&ian->ipt_acc_lock);
 		if (cmd == IPT_SO_GET_ACCOUNT_PREPARE_READ_FLUSH)
 			ret = ipt_acc_handle_prepare_read_flush(
-				handle.name, &dest, &handle.itemcount);
+				ian->ipt_acc_tables, handle.name, &dest, &handle.itemcount);
 		else
 			ret = ipt_acc_handle_prepare_read(
-				handle.name, &dest, &handle.itemcount);
-		spin_unlock_bh(&ipt_acc_lock);
+				ian->ipt_acc_tables, handle.name, &dest, &handle.itemcount);
+		spin_unlock_bh(&ian->ipt_acc_lock);
 		// Error occured during prepare_read?
 		if (ret == -1)
 			return -EINVAL;
 
 		/* Allocate a userspace handle */
-		down(&ipt_acc_userspace_mutex);
-		if ((handle.handle_nr = ipt_acc_handle_find_slot()) == -1) {
+		down(&ian->ipt_acc_userspace_mutex);
+		if ((handle.handle_nr = ipt_acc_handle_find_slot(ian->ipt_acc_handles)) == -1) {
 			ipt_acc_data_free(dest.data, dest.depth);
-			up(&ipt_acc_userspace_mutex);
+			up(&ian->ipt_acc_userspace_mutex);
 			return -EINVAL;
 		}
-		memcpy(&ipt_acc_handles[handle.handle_nr], &dest,
+		memcpy(&ian->ipt_acc_handles[handle.handle_nr], &dest,
 			sizeof(struct ipt_acc_handle));
-		up(&ipt_acc_userspace_mutex);
+		up(&ian->ipt_acc_userspace_mutex);
 
 		if (copy_to_user(user, &handle,
 		    sizeof(struct ipt_acc_handle_sockopt))) {
@@ -982,19 +1002,19 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 			break;
 		}
 
-		if (*len < ipt_acc_handles[handle.handle_nr].itemcount
+		if (*len < ian->ipt_acc_handles[handle.handle_nr].itemcount
 		    * sizeof(struct ipt_acc_handle_ip)) {
 			printk("ACCOUNT: ipt_acc_get_ctl: not enough space (%u < %zu)"
 				" to store data from IPT_SO_GET_ACCOUNT_GET_DATA\n",
-				*len, ipt_acc_handles[handle.handle_nr].itemcount
+				*len, ian->ipt_acc_handles[handle.handle_nr].itemcount
 				* sizeof(struct ipt_acc_handle_ip));
 			ret = -ENOMEM;
 			break;
 		}
 
-		down(&ipt_acc_userspace_mutex);
-		ret = ipt_acc_handle_get_data(handle.handle_nr, user);
-		up(&ipt_acc_userspace_mutex);
+		down(&ian->ipt_acc_userspace_mutex);
+		ret = ipt_acc_handle_get_data(ian, handle.handle_nr, user);
+		up(&ian->ipt_acc_userspace_mutex);
 		if (ret) {
 			printk("ACCOUNT: ipt_acc_get_ctl: ipt_acc_handle_get_data"
 				" failed for handle %u\n", handle.handle_nr);
@@ -1014,11 +1034,11 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 
 		/* Find out how many handles are in use */
 		handle.itemcount = 0;
-		down(&ipt_acc_userspace_mutex);
+		down(&ian->ipt_acc_userspace_mutex);
 		for (i = 0; i < ACCOUNT_MAX_HANDLES; i++)
-			if (ipt_acc_handles[i].data)
+			if (ian->ipt_acc_handles[i].data)
 				handle.itemcount++;
-		up(&ipt_acc_userspace_mutex);
+		up(&ian->ipt_acc_userspace_mutex);
 
 		if (copy_to_user(user, &handle,
 		    sizeof(struct ipt_acc_handle_sockopt))) {
@@ -1032,38 +1052,38 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 		uint32_t size = 0, i, name_len;
 		char *tnames;
 
-		spin_lock_bh(&ipt_acc_lock);
+		spin_lock_bh(&ian->ipt_acc_lock);
 
 		/* Determine size of table names */
-		for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
-			if (ipt_acc_tables[i].name[0] != 0)
-				size += strlen(ipt_acc_tables[i].name) + 1;
+		for (i = 0; i < max_tables_limit; i++) {
+			if (ian->ipt_acc_tables[i].name[0] != 0)
+				size += strlen(ian->ipt_acc_tables[i].name) + 1;
 		}
 		size += 1;	/* Terminating NULL character */
 
 		if (*len < size || size > PAGE_SIZE) {
-			spin_unlock_bh(&ipt_acc_lock);
+			spin_unlock_bh(&ian->ipt_acc_lock);
 			printk("ACCOUNT: ipt_acc_get_ctl: not enough space (%u < %u < %lu)"
 				" to store table names\n", *len, size, PAGE_SIZE);
 			ret = -ENOMEM;
 			break;
 		}
 		/* Copy table names to userspace */
-		tnames = ipt_acc_tmpbuf;
-		for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
-			if (ipt_acc_tables[i].name[0] != 0) {
-				name_len = strlen(ipt_acc_tables[i].name) + 1;
-				memcpy(tnames, ipt_acc_tables[i].name, name_len);
+		tnames = ian->ipt_acc_tmpbuf;
+		for (i = 0; i < max_tables_limit; i++) {
+			if (ian->ipt_acc_tables[i].name[0] != 0) {
+				name_len = strlen(ian->ipt_acc_tables[i].name) + 1;
+				memcpy(tnames, ian->ipt_acc_tables[i].name, name_len);
 				tnames += name_len;
 			}
 		}
-		spin_unlock_bh(&ipt_acc_lock);
+		spin_unlock_bh(&ian->ipt_acc_lock);
 
 		/* Terminating NULL character */
 		*tnames = 0;
 
 		/* Transfer to userspace */
-		if (copy_to_user(user, ipt_acc_tmpbuf, size))
+		if (copy_to_user(user, ian->ipt_acc_tmpbuf, size))
 			return -EFAULT;
 
 		ret = 0;
@@ -1076,6 +1096,59 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 	return ret;
 }
 
+static int __net_init ipt_acc_net_init(struct net *net)
+{
+	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
+
+	memset(ian, 0, sizeof(*ian));
+	sema_init(&ian->ipt_acc_userspace_mutex, 1);
+
+	ian->ipt_acc_tables = kcalloc(max_tables_limit,
+		sizeof(struct ipt_acc_table), GFP_KERNEL);
+	if (ian->ipt_acc_tables == NULL) {
+		printk("ACCOUNT: Out of memory allocating account_tables structure");
+		goto error_cleanup;
+	}
+	ian->ipt_acc_handles = kcalloc(ACCOUNT_MAX_HANDLES,
+		sizeof(struct ipt_acc_handle), GFP_KERNEL);
+	if (ian->ipt_acc_handles == NULL) {
+		printk("ACCOUNT: Out of memory allocating account_handles structure");
+		goto error_cleanup;
+	}
+
+	/* Allocate one page as temporary storage */
+	ian->ipt_acc_tmpbuf = (void *)__get_free_pages(GFP_KERNEL, 2);
+	if (ian->ipt_acc_tmpbuf == NULL) {
+		printk("ACCOUNT: Out of memory for temporary buffer page\n");
+		goto error_cleanup;
+	}
+
+	return 0;
+
+ error_cleanup:
+	kfree(ian->ipt_acc_tables);
+	kfree(ian->ipt_acc_handles);
+	free_pages((unsigned long)ian->ipt_acc_tmpbuf, 2);
+
+	return -ENOMEM;
+}
+
+static void __net_exit ipt_acc_net_exit(struct net *net)
+{
+	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
+
+	kfree(ian->ipt_acc_tables);
+	kfree(ian->ipt_acc_handles);
+	free_pages((unsigned long)ian->ipt_acc_tmpbuf, 2);
+}
+
+static struct pernet_operations ipt_acc_net_ops = {
+	.init = ipt_acc_net_init,
+	.exit = ipt_acc_net_exit,
+	.id   = &ipt_acc_net_id,
+	.size = sizeof(struct ipt_acc_net),
+};
+
 static struct xt_target xt_acc_reg __read_mostly = {
 	.name = "ACCOUNT",
 	.revision = 1,
@@ -1099,63 +1172,41 @@ static struct nf_sockopt_ops ipt_acc_sockopts = {
 
 static int __init account_tg_init(void)
 {
-	sema_init(&ipt_acc_userspace_mutex, 1);
+	int ret;
 
-	if ((ipt_acc_tables =
-	    kmalloc(ACCOUNT_MAX_TABLES *
-	    sizeof(struct ipt_acc_table), GFP_KERNEL)) == NULL) {
-		printk("ACCOUNT: Out of memory allocating account_tables structure");
-		goto error_cleanup;
-	}
-	memset(ipt_acc_tables, 0,
-		ACCOUNT_MAX_TABLES * sizeof(struct ipt_acc_table));
-
-	if ((ipt_acc_handles =
-	    kmalloc(ACCOUNT_MAX_HANDLES *
-	    sizeof(struct ipt_acc_handle), GFP_KERNEL)) == NULL) {
-		printk("ACCOUNT: Out of memory allocating account_handles structure");
-		goto error_cleanup;
-	}
-	memset(ipt_acc_handles, 0,
-		ACCOUNT_MAX_HANDLES * sizeof(struct ipt_acc_handle));
-
-	/* Allocate one page as temporary storage */
-	if ((ipt_acc_tmpbuf = (void *)__get_free_pages(GFP_KERNEL, 2)) == NULL) {
-		printk("ACCOUNT: Out of memory for temporary buffer page\n");
-		goto error_cleanup;
+	ret = register_pernet_subsys(&ipt_acc_net_ops);
+	if (ret < 0) {
+		pr_err("ACCOUNT: cannot register per net operations.\n");
+		goto error_out;
 	}
 
 	/* Register setsockopt */
-	if (nf_register_sockopt(&ipt_acc_sockopts) < 0) {
-		printk("ACCOUNT: Can't register sockopts. Aborting\n");
-		goto error_cleanup;
+	ret = nf_register_sockopt(&ipt_acc_sockopts);
+	if (ret < 0) {
+		pr_err("ACCOUNT: cannot register sockopts.\n");
+		goto unreg_pernet;
 	}
 
-	if (xt_register_target(&xt_acc_reg))
-		goto error_cleanup;
-
+	ret = xt_register_target(&xt_acc_reg);
+	if (ret < 0) {
+		pr_err("ACCOUNT: cannot register sockopts.\n");
+		goto unreg_sockopt;
+	}
 	return 0;
 
-error_cleanup:
-	if (ipt_acc_tables)
-		kfree(ipt_acc_tables);
-	if (ipt_acc_handles)
-		kfree(ipt_acc_handles);
-	if (ipt_acc_tmpbuf)
-		free_pages((unsigned long)ipt_acc_tmpbuf, 2);
-
-	return -EINVAL;
+ unreg_sockopt:
+	nf_unregister_sockopt(&ipt_acc_sockopts);
+ unreg_pernet:
+	unregister_pernet_subsys(&ipt_acc_net_ops);
+ error_out:
+        return ret;
 }
 
 static void __exit account_tg_exit(void)
 {
 	xt_unregister_target(&xt_acc_reg);
-
 	nf_unregister_sockopt(&ipt_acc_sockopts);
-
-	kfree(ipt_acc_tables);
-	kfree(ipt_acc_handles);
-	free_pages((unsigned long)ipt_acc_tmpbuf, 2);
+	unregister_pernet_subsys(&ipt_acc_net_ops);
 }
 
 module_init(account_tg_init);

extensions/ACCOUNT/xt_ACCOUNT.h

@@ -34,7 +34,6 @@
 #define IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES (SO_ACCOUNT_BASE_CTL + 8)
 #define IPT_SO_GET_ACCOUNT_MAX	  IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES
 
-#define ACCOUNT_MAX_TABLES 128
 #define ACCOUNT_TABLE_NAME_LEN 32
 #define ACCOUNT_MAX_HANDLES 10
 

extensions/Kbuild

@@ -13,6 +13,7 @@ obj-${build_DNETMAP}     += xt_DNETMAP.o
 obj-${build_ECHO}        += xt_ECHO.o
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
+obj-${build_PROTO}       += xt_PROTO.o
 obj-${build_SYSRQ}       += xt_SYSRQ.o
 obj-${build_TARPIT}      += xt_TARPIT.o
 obj-${build_condition}   += xt_condition.o

extensions/Mbuild

@@ -8,6 +8,7 @@ obj-${build_DNETMAP}     += libxt_DNETMAP.so
 obj-${build_ECHO}        += libxt_ECHO.so
 obj-${build_IPMARK}      += libxt_IPMARK.so
 obj-${build_LOGMARK}     += libxt_LOGMARK.so
+obj-${build_PROTO}       += libxt_PROTO.so
 obj-${build_SYSRQ}       += libxt_SYSRQ.so
 obj-${build_TARPIT}      += libxt_TARPIT.so
 obj-${build_condition}   += libxt_condition.so

extensions/compat_xtables.h

@@ -8,12 +8,8 @@
 
 #define DEBUGP Use__pr_debug__instead
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0)
-#	warning Kernels below 3.7 not supported.
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
-#	define prandom_u32() random32()
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+#	warning Kernels below 4.15 not supported.
 #endif
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
@@ -35,7 +31,7 @@
 		ntohs((addr).s6_addr16[5]), \
 		ntohs((addr).s6_addr16[6]), \
 		ntohs((addr).s6_addr16[7])
-#	define NIP6_FMT "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x"
+#	define NIP6_FMT "%04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx"
 #endif
 #if !defined(NIPQUAD) && !defined(NIPQUAD_FMT)
 #	define NIPQUAD(addr) \
@@ -43,34 +39,16 @@
 		((const unsigned char *)&addr)[1], \
 		((const unsigned char *)&addr)[2], \
 		((const unsigned char *)&addr)[3]
-#	define NIPQUAD_FMT "%u.%u.%u.%u"
+#	define NIPQUAD_FMT "%hhu.%hhu.%hhu.%hhu"
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
-static inline struct inode *file_inode(struct file *f)
+static inline struct net *par_net(const struct xt_action_param *par)
 {
-	return f->f_path.dentry->d_inode;
-}
-#endif
-
-#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
-static inline void proc_set_user(struct proc_dir_entry *de,
-    typeof(de->uid) uid, typeof(de->gid) gid)
-{
-	de->uid = uid;
-	de->gid = gid;
+	return par->state->net;
 }
 
-static inline void *PDE_DATA(struct inode *inode)
-{
-	return PDE(inode)->data;
-}
-
-static inline void proc_remove(struct proc_dir_entry *de)
-{
-	if (de != NULL)
-		remove_proc_entry(de->name, de->parent);
-}
+#ifndef NF_CT_ASSERT
+#	define NF_CT_ASSERT(x)	WARN_ON(!(x))
 #endif
 
 #endif /* _XTABLES_COMPAT_H */

extensions/libxt_PROTO.c

@@ -0,0 +1,105 @@
+/*
+ * PROTO Target module
+ * This program is distributed under the terms of GNU GPL
+ */
+#include <stdio.h>
+#include <xtables.h>
+#include "xt_PROTO.h"
+
+enum {
+	O_PROTO_SET = 0,
+	O_PROTO_STOP_AT_FRAG = 1,
+	O_PROTO_STOP_AT_AUTH = 2,
+	F_PROTO_SET = 1 << O_PROTO_SET,
+	F_PROTO_STOP_AT_FRAG = 1 << O_PROTO_STOP_AT_FRAG,
+	F_PROTO_STOP_AT_AUTH = 1 << O_PROTO_STOP_AT_AUTH,
+};
+
+#define s struct xt_PROTO_info
+static const struct xt_option_entry PROTO_opts[] = {
+	{.name = "proto-set", .type = XTTYPE_UINT8, .id = O_PROTO_SET,
+	 .flags = XTOPT_PUT | XTOPT_MAND, XTOPT_POINTER(s, proto)},
+	{.name = "stop-at-frag", .type = XTTYPE_NONE, .id = O_PROTO_STOP_AT_FRAG},
+	{.name = "stop-at-auth", .type = XTTYPE_NONE, .id = O_PROTO_STOP_AT_AUTH},
+	XTOPT_TABLEEND,
+};
+#undef s
+
+static void PROTO_help(void)
+{
+	printf(
+"PROTO target options\n"
+"  --proto-set value		Set protocol to <value 0-255>\n"
+	);
+}
+
+static void PROTO_parse(struct xt_option_call *cb)
+{
+	struct xt_PROTO_info *info = cb->data;
+
+	xtables_option_parse(cb);
+	switch (cb->entry->id) {
+	case O_PROTO_SET:
+		info->mode |= 1 << XT_PROTO_SET;
+		break;
+	case O_PROTO_STOP_AT_FRAG:
+		info->mode |= 1 << XT_PROTO_STOP_AT_FRAG;
+		break;
+	case O_PROTO_STOP_AT_AUTH:
+		info->mode |= 1 << XT_PROTO_STOP_AT_AUTH;
+		break;
+	}
+}
+
+static void PROTO_check(struct xt_fcheck_call *cb)
+{
+	if (!(cb->xflags & F_PROTO_SET))
+		xtables_error(PARAMETER_PROBLEM,
+				"PROTO: You must specify the proto to be set");
+}
+
+static void PROTO_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_PROTO_info *info = (void *)target->data;
+
+	if (info->mode & (1 << XT_PROTO_SET))
+		printf(" --proto-set %u", info->proto);
+	if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
+		printf(" --stop-at-frag");
+	if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
+		printf(" --stop-at-auth");
+}
+
+static void PROTO_print(const void *ip, const struct xt_entry_target *target,
+                     int numeric)
+{
+	const struct xt_PROTO_info *info = (void *)target->data;
+
+	printf(" PROTO ");
+	if (info->mode & (1 << XT_PROTO_SET))
+		printf("set to %u", info->proto);
+	if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
+		printf(" stop-at-frag");
+	if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
+		printf(" stop-at-auth");
+}
+
+static struct xtables_target proto_tg_reg = {
+	.name 		= "PROTO",
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_UNSPEC,
+	.size		= XT_ALIGN(sizeof(struct xt_PROTO_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_PROTO_info)),
+	.help		= PROTO_help,
+	.print		= PROTO_print,
+	.save		= PROTO_save,
+	.x6_parse	= PROTO_parse,
+	.x6_fcheck	= PROTO_check,
+	.x6_options	= PROTO_opts,
+};
+
+static __attribute__((constructor)) void _init(void)
+{
+	xtables_register_target(&proto_tg_reg);
+
+}

extensions/libxt_PROTO.man

@@ -0,0 +1,30 @@
+.PP
+The PROTO target modifies the protocol number in IP packet header.
+.TP
+\fB\-\-proto-set\fP \fIproto_num\fP
+This option is mandatory. \fIproto_num\fP is the protocol number to which you want to
+modify the packets.
+.TP
+\fB\-\-stop-at-frag\fP
+This option is only valid for IPv6 rules. When specifying this option, the
+fragment extension header will be seen as a non-extension header.
+.TP
+\fB\-\-stop-at-auth\fP
+This option is only valid for IPv6 rules. When specifying this option, the
+authentication extension header will be seen as a non-extension header.
+.PP
+For IPv4 packets, the \fBProtocol\fP field is modified and the checksum is
+re-calculated.
+.PP
+For IPv6 packets, the scenario can be more complex due to the introduction of
+the extension headers mechanism. By default, the PROTO target will scan the IPv6
+packet, finding the last extension header and modify its \fBNext-header\fP field.
+Normally, the following headers will be seen as an extension header:
+\fINEXTHDR_HOP\fP,
+\fINEXTHDR_ROUTING\fP,
+\fINEXTHDR_FRAGMENT\fP,
+\fINEXTHDR_AUTH\fP,
+\fINEXTHDR_DEST\fP.
+.PP
+For fragmented packets, only the first fragment is processed and other fragments
+are not touched.

extensions/libxt_geoip.c

@@ -49,6 +49,38 @@ static struct option geoip_opts[] = {
 	{NULL},
 };
 
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+static void geoip_swap_le16(uint16_t *buf)
+{
+	unsigned char *p = (void *)buf;
+	uint16_t n= p[0] + (p[1] << 8);
+	p[0] = (n >> 8) & 0xff;
+	p[1] = n & 0xff;
+}
+
+static void geoip_swap_in6(struct in6_addr *in6)
+{
+	geoip_swap_le16(&in6->s6_addr16[0]);
+	geoip_swap_le16(&in6->s6_addr16[1]);
+	geoip_swap_le16(&in6->s6_addr16[2]);
+	geoip_swap_le16(&in6->s6_addr16[3]);
+	geoip_swap_le16(&in6->s6_addr16[4]);
+	geoip_swap_le16(&in6->s6_addr16[5]);
+	geoip_swap_le16(&in6->s6_addr16[6]);
+	geoip_swap_le16(&in6->s6_addr16[7]);
+}
+
+static void geoip_swap_le32(uint32_t *buf)
+{
+	unsigned char *p = (void *)buf;
+	uint32_t n = p[0] + (p[1] << 8) + (p[2] << 16) + (p[3] << 24);
+	p[0] = (n >> 24) & 0xff;
+	p[1] = (n >> 16) & 0xff;
+	p[2] = (n >> 8) & 0xff;
+	p[3] = n & 0xff;
+}
+#endif
+
 static void *
 geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 {
@@ -56,21 +88,15 @@ geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 	struct stat sb;
 	char buf[256];
 	int fd;
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+	unsigned int n;
+#endif
 
 	/* Use simple integer vector files */
-	if (nfproto == NFPROTO_IPV6) {
-#if __BYTE_ORDER == _BIG_ENDIAN
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv6", code);
-#else
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv6", code);
-#endif
-	} else {
-#if __BYTE_ORDER == _BIG_ENDIAN
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv4", code);
-#else
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv4", code);
-#endif
-	}
+	if (nfproto == NFPROTO_IPV6)
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/%s.iv6", code);
+	else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/%s.iv4", code);
 
 	if ((fd = open(buf, O_RDONLY)) < 0) {
 		fprintf(stderr, "Could not open %s: %s\n", buf, strerror(errno));
@@ -98,6 +124,25 @@ geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 		xtables_error(OTHER_PROBLEM, "geoip: insufficient memory");
 	read(fd, subnets, sb.st_size);
 	close(fd);
+
+#if __BYTE_ORDER == __LITTLE_ENDIAN
+	for (n = 0; n < *count; ++n) {
+		switch (nfproto) {
+		case NFPROTO_IPV6: {
+			struct geoip_subnet6 *gs6 = &(((struct geoip_subnet6 *)subnets)[n]);
+			geoip_swap_in6(&gs6->begin);
+			geoip_swap_in6(&gs6->end);
+			break;
+		}
+		case NFPROTO_IPV4: {
+			struct geoip_subnet4 *gs4 = &(((struct geoip_subnet4 *)subnets)[n]);
+			geoip_swap_le32(&gs4->begin);
+			geoip_swap_le32(&gs4->end);
+			break;
+		}
+		}
+	}
+#endif
 	return subnets;
 }
 
@@ -135,7 +180,7 @@ check_geoip_cc(char *cc, u_int16_t cc_used[], u_int8_t count)
 			cc[i] = toupper(cc[i]);
 		else
 			xtables_error(PARAMETER_PROBLEM,
-				"geoip:  invalid country code '%s'", cc);
+				"geoip: invalid country code '%s'", cc);
 
 	/* Convert chars into a single 16 bit integer.
 	 * FIXME:	This assumes that a country code is

extensions/pknock/gen_hmac.py

@@ -0,0 +1,17 @@
+from Crypto.Hash import SHA256
+from Crypto.Hash import MD5
+import sys
+import hmac
+import struct
+import socket
+from time import time
+
+def gen_hmac(secret, ip):
+    epoch_mins = (long)(time()/60)
+    s = hmac.HMAC(secret, digestmod = SHA256)
+    s.update(socket.inet_aton(socket.gethostbyname(ip)))
+    s.update(struct.pack("i", epoch_mins)) # "i" is for integer
+    print s.hexdigest()
+
+if __name__ == '__main__':
+	gen_hmac(sys.argv[1], sys.argv[2])

extensions/pknock/knock.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+if [ "$#" -ne 4 ]; then
+    echo "usage: $0 <IP src> <IP dst> <PORT dst> <secret>"
+    exit 1
+fi
+python gen_hmac.py "$4" "$1" | socat - "udp-sendto:$2:$3,bind=$1"

extensions/pknock/libxt_pknock.man

@@ -62,8 +62,6 @@ Specifying \fB--autoclose 0\fP means that no automatic close will be performed a
 xt_pknock is capable of sending information about successful matches
 via a netlink socket to userspace, should you need to implement your own
 way of receiving and handling portknock notifications.
-Be sure to read the documentation in the doc/pknock/ directory,
-or visit the original site \(em http://portknocko.berlios.de/ .
 .PP
 \fBTCP mode\fP:
 .PP

extensions/pknock/xt_pknock.c

@@ -19,16 +19,14 @@
 #include <linux/spinlock.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
-#include <linux/crypto.h>
 #include <linux/proc_fs.h>
-#include <linux/scatterlist.h>
 #include <linux/spinlock.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
 #include <linux/seq_file.h>
 #include <linux/connector.h>
-
 #include <linux/netfilter/x_tables.h>
+#include <crypto/hash.h>
 #include "xt_pknock.h"
 #include "compat_xtables.h"
 
@@ -111,9 +109,9 @@ static DEFINE_SPINLOCK(list_lock);
 
 static struct {
 	const char *algo;
-	struct crypto_hash	*tfm;
+	struct crypto_shash *tfm;
 	unsigned int size;
-	struct hash_desc	desc;
+	struct shash_desc desc;
 } crypto = {
 	.algo	= "hmac(sha256)",
 	.tfm	= NULL,
@@ -359,11 +357,10 @@ has_logged_during_this_minute(const struct peer *peer)
  *
  * @r: rule
  */
-static void
-peer_gc(unsigned long r)
+static void peer_gc(struct timer_list *tl)
 {
 	unsigned int i;
-	struct xt_pknock_rule *rule = (struct xt_pknock_rule *)r;
+	struct xt_pknock_rule *rule = from_timer(rule, tl, timer);
 	struct peer *peer;
 	struct list_head *pos, *n;
 
@@ -470,11 +467,7 @@ add_rule(struct xt_pknock_mtinfo *info)
 	rule->peer_head      = alloc_hashtable(peer_hashsize);
 	if (rule->peer_head == NULL)
 		goto out;
-
-	init_timer(&rule->timer);
-	rule->timer.function	= peer_gc;
-	rule->timer.data	= (unsigned long)rule;
-
+	timer_setup(&rule->timer, peer_gc, 0);
 	rule->status_proc = proc_create_data(info->rule_name, 0, pde,
 	                    &pknock_proc_ops, rule);
 	if (rule->status_proc == NULL)
@@ -621,9 +614,10 @@ static void add_peer(struct peer *peer, struct xt_pknock_rule *rule)
  */
 static void remove_peer(struct peer *peer)
 {
+	if (peer == NULL)
+		return;
 	list_del(&peer->head);
-	if (peer != NULL)
-		kfree(peer);
+	kfree(peer);
 }
 
 /**
@@ -700,13 +694,7 @@ msg_to_userspace_nl(const struct xt_pknock_mtinfo *info,
 	scnprintf(msg.rule_name, info->rule_name_len + 1, info->rule_name);
 
 	memcpy(m + 1, &msg, m->len);
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
 	cn_netlink_send(m, 0, multicast_group, GFP_ATOMIC);
-#else
-	cn_netlink_send(m, multicast_group, GFP_ATOMIC);
-#endif
-
 	kfree(m);
 #endif
 	return true;
@@ -744,7 +732,6 @@ static bool
 has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
     const unsigned char *payload, unsigned int payload_len)
 {
-	struct scatterlist sg[2];
 	char result[64]; // 64 bytes * 8 = 512 bits
 	char *hexresult;
 	unsigned int hexa_size;
@@ -775,11 +762,7 @@ has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
 
 	epoch_min = get_seconds() / 60;
 
-	sg_init_table(sg, ARRAY_SIZE(sg));
-	sg_set_buf(&sg[0], &ipsrc, sizeof(ipsrc));
-	sg_set_buf(&sg[1], &epoch_min, sizeof(epoch_min));
-
-	ret = crypto_hash_setkey(crypto.tfm, secret, secret_len);
+	ret = crypto_shash_setkey(crypto.tfm, secret, secret_len);
 	if (ret != 0) {
 		printk("crypto_hash_setkey() failed ret=%d\n", ret);
 		goto out;
@@ -790,10 +773,10 @@ has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
 	 * 4 bytes IP (32 bits) +
 	 * 4 bytes int epoch_min (32 bits)
 	 */
-	ret = crypto_hash_digest(&crypto.desc, sg,
-	      sizeof(ipsrc) + sizeof(epoch_min), result);
-	if (ret != 0) {
-		printk("crypto_hash_digest() failed ret=%d\n", ret);
+	if ((ret = crypto_shash_update(&crypto.desc, (const void *)&ipsrc, sizeof(ipsrc))) != 0 ||
+	    (ret = crypto_shash_update(&crypto.desc, (const void *)&epoch_min, sizeof(epoch_min))) != 0 ||
+	    (ret = crypto_shash_final(&crypto.desc, result)) != 0) {
+		printk("crypto_shash_update/final() failed ret=%d\n", ret);
 		goto out;
 	}
 
@@ -1133,16 +1116,15 @@ static int __init xt_pknock_mt_init(void)
 		return -ENXIO;
 	}
 
-	crypto.tfm = crypto_alloc_hash(crypto.algo, 0, CRYPTO_ALG_ASYNC);
+	crypto.tfm = crypto_alloc_shash(crypto.algo, 0, 0);
 	if (IS_ERR(crypto.tfm)) {
 		printk(KERN_ERR PKNOCK "failed to load transform for %s\n",
 						crypto.algo);
 		return PTR_ERR(crypto.tfm);
 	}
 
-	crypto.size = crypto_hash_digestsize(crypto.tfm);
+	crypto.size = crypto_shash_digestsize(crypto.tfm);
 	crypto.desc.tfm = crypto.tfm;
-	crypto.desc.flags = 0;
 
 	pde = proc_mkdir("xt_pknock", init_net.proc_net);
 	if (pde == NULL) {
@@ -1158,7 +1140,7 @@ static void __exit xt_pknock_mt_exit(void)
 	xt_unregister_match(&xt_pknock_mt_reg);
 	kfree(rule_hashtable);
 	if (crypto.tfm != NULL)
-		crypto_free_hash(crypto.tfm);
+		crypto_free_shash(crypto.tfm);
 }
 
 module_init(xt_pknock_mt_init);

extensions/xt_CHAOS.c

@@ -58,8 +58,7 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
 
 	{
 		struct xt_action_param local_par;
-		local_par.in        = par->in,
-		local_par.out       = par->out,
+		local_par.state    = par->state;
 		local_par.match     = xm_tcp;
 		local_par.matchinfo = &tcp_params;
 		local_par.fragoff   = fragoff;
@@ -74,12 +73,9 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
 	destiny = (info->variant == XTCHAOS_TARPIT) ? xt_tarpit : xt_delude;
 	{
 		struct xt_action_param local_par;
-		local_par.in       = par->in;
-		local_par.out      = par->out;
-		local_par.hooknum  = par->hooknum;
+		local_par.state    = par->state;
 		local_par.target   = destiny;
 		local_par.targinfo = par->targinfo;
-		local_par.family   = par->family;
 		destiny->target(skb, &local_par);
 	}
 }
@@ -100,18 +96,15 @@ chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
 	if ((unsigned int)prandom_u32() <= reject_percentage) {
 		struct xt_action_param local_par;
-		local_par.in       = par->in;
-		local_par.out      = par->out;
-		local_par.hooknum  = par->hooknum;
+		local_par.state    = par->state;
 		local_par.target   = xt_reject;
 		local_par.targinfo = &reject_params;
 		return xt_reject->target(skb, &local_par);
 	}
 
 	/* TARPIT/DELUDE may not be called from the OUTPUT chain */
-	if (iph->protocol == IPPROTO_TCP &&
-	    info->variant != XTCHAOS_NORMAL &&
-	    par->hooknum != NF_INET_LOCAL_OUT)
+	if (iph->protocol == IPPROTO_TCP && info->variant != XTCHAOS_NORMAL &&
+	    par->state->hook != NF_INET_LOCAL_OUT)
 		xt_chaos_total(skb, par);
 
 	return NF_DROP;

extensions/xt_DELUDE.c

@@ -25,7 +25,8 @@
 #include "compat_xtables.h"
 #define PFX KBUILD_MODNAME ": "
 
-static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
+static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
+    unsigned int hook)
 {
 	struct tcphdr _otcph, *tcph;
 	const struct tcphdr *oth;
@@ -78,7 +79,7 @@ static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 	tcph->doff   = sizeof(struct tcphdr) / 4;
 
 	/* DELUDE essential part */
-	if (oth->syn && !oth->ack && !oth->rst && !oth->fin) {
+	if (oth->syn && !oth->ack && !oth->fin) {
 		tcph->syn     = true;
 		tcph->seq     = 0;
 		tcph->ack     = true;
@@ -106,12 +107,12 @@ static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 
 	addr_type = RTN_UNSPEC;
 #ifdef CONFIG_BRIDGE_NETFILTER
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
-	    nskb->nf_bridge->physoutdev))
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+	if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
+	    ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
 #else
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
-	    nskb->nf_bridge->mask & BRNF_BRIDGED))
+	    nskb->nf_bridge->physoutdev))
 #endif
 #else
 	if (hook != NF_INET_FORWARD)
@@ -121,7 +122,7 @@ static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 	/* ip_route_me_harder expects skb->dst to be set */
 	skb_dst_set(nskb, dst_clone(skb_dst(oldskb)));
 
-	if (ip_route_me_harder(nskb, addr_type))
+	if (ip_route_me_harder(net, nskb, addr_type))
 		goto free_nskb;
 	else
 		niph = ip_hdr(nskb);
@@ -135,7 +136,7 @@ static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
 
 	nf_ct_attach(nskb, oldskb);
 
-	ip_local_out(nskb);
+	ip_local_out(net, nskb->sk, nskb);
 	return;
 
  free_nskb:
@@ -150,7 +151,7 @@ delude_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	 * a problem, as that is supported since Linux 2.6.35. But since we do not
 	 * actually want to have a connection open, we are still going to drop it.
 	 */
-	delude_send_reset(skb, par->hooknum);
+	delude_send_reset(par_net(par), skb, par->state->hook);
 	return NF_DROP;
 }
 

extensions/xt_DHCPMAC.c

@@ -34,9 +34,9 @@ static void ether_set(unsigned char *addr, const unsigned char *op,
 	unsigned int i;
 
 	for (i = 0; i < ETH_ALEN && mask > 0; ++i) {
-		lo_mask = mask % 8;
+		lo_mask = (mask >= 8) ? 8 : mask;
 		/* FF << 4 >> 4 = 0F */
-		lo_mask = ~(uint8_t)0U << lo_mask >> lo_mask;
+		lo_mask = (uint8_t)(~0U << lo_mask) >> lo_mask;
 		addr[i] &= lo_mask;
 		addr[i] |= op[i] & ~lo_mask;
 		if (mask >= 8)
@@ -55,9 +55,9 @@ static bool ether_cmp(const unsigned char *lh, const unsigned char *rh,
 #define ZMACHEX(s) s[0], s[1], s[2], s[3], s[4], s[5]
 
 	for (i = 0; i < ETH_ALEN && mask > 0; ++i) {
-		lo_mask = mask % 8;
+		lo_mask = (mask >= 8) ? 8 : mask;
 		/* ~(0xFF << 4 >> 4) = ~0x0F = 0xF0 */
-		lo_mask = ~(~(uint8_t)0U << lo_mask >> lo_mask);
+		lo_mask = ~((uint8_t)(~0U << lo_mask) >> lo_mask);
 		if ((lh[i] ^ rh[i]) & lo_mask)
 			return false;
 		if (mask >= 8)
@@ -96,7 +96,8 @@ dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	struct udphdr udpbuf, *udph;
 	unsigned int i;
 
-	if (!skb_make_writable(skb, 0))
+	if (skb_ensure_writable(skb, ip_hdrlen(skb) + sizeof(udpbuf) +
+				     sizeof(dhcpbuf)))
 		return NF_DROP;
 
 	udph = skb_header_pointer(skb, ip_hdrlen(skb),
@@ -110,13 +111,12 @@ dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		return NF_DROP;
 
 	for (i = 0; i < sizeof(dh->chaddr); i += 2)
-		csum_replace2(&udph->check, *(const __be16 *)dh->chaddr, 0);
+		csum_replace2(&udph->check, *(const __be16 *)(dh->chaddr + i), 0);
 
-	memset(dh->chaddr, 0, sizeof(dh->chaddr));
 	ether_set(dh->chaddr, info->addr, info->mask);
 
 	for (i = 0; i < sizeof(dh->chaddr); i += 2)
-		csum_replace2(&udph->check, 0, *(const __be16 *)dh->chaddr);
+		csum_replace2(&udph->check, 0, *(const __be16 *)(dh->chaddr + i));
 
 	return XT_CONTINUE;
 }

extensions/xt_DNETMAP.c

@@ -81,7 +81,7 @@ struct dnetmap_entry {
 
 struct dnetmap_prefix {
 	struct nf_nat_range prefix;
-	char prefix_str[16];
+	char prefix_str[20];
 #ifdef CONFIG_PROC_FS
 	char proc_str_data[20];
 	char proc_str_stat[25];
@@ -356,27 +356,28 @@ out:
 static unsigned int
 dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
-	struct net *net = dev_net(par->in ? par->in : par->out);
+	struct net *net = dev_net(par->state->in ? par->state->in : par->state->out);
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	__be32 prenat_ip, postnat_ip, prenat_ip_prev;
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
 	const struct nf_nat_range *mr = &tginfo->prefix;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 18, 0)
+	struct nf_nat_range2 newrange;
+#else
 	struct nf_nat_range newrange;
+#endif
 	struct dnetmap_entry *e;
 	struct dnetmap_prefix *p;
 	__s32 jttl;
-
-	NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING ||
-		     par->hooknum == NF_INET_LOCAL_OUT ||
-		     par->hooknum == NF_INET_PRE_ROUTING);
+	unsigned int hooknum = par->state->hook;
 	ct = nf_ct_get(skb, &ctinfo);
 
 	jttl = tginfo->flags & XT_DNETMAP_TTL ? tginfo->ttl * HZ : jtimeout;
 
 	/* in prerouting we try to map postnat-ip to prenat-ip */
-	if (par->hooknum == NF_INET_PRE_ROUTING) {
+	if (hooknum == NF_INET_PRE_ROUTING) {
 		postnat_ip = ip_hdr(skb)->daddr;
 
 		spin_lock_bh(&dnetmap_lock);
@@ -389,7 +390,7 @@ dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		/* if prefix is specified, we check if
 		it matches lookedup entry */
 		if (tginfo->flags & XT_DNETMAP_PREFIX)
-			if (memcmp(mr, &e->prefix, sizeof(*mr)))
+			if (memcmp(mr, &e->prefix->prefix, sizeof(*mr)))
 				goto no_rev_map;
 		/* don't reset ttl if flag is set */
 		if (jttl >= 0 && (! (e->flags & XT_DNETMAP_STATIC) ) ) {
@@ -407,7 +408,7 @@ dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		newrange.min_proto = mr->min_proto;
 		newrange.max_proto = mr->max_proto;
 		return nf_nat_setup_info(ct, &newrange,
-					 HOOK2MANIP(par->hooknum));
+					 HOOK2MANIP(hooknum));
 	}
 
 	prenat_ip = ip_hdr(skb)->saddr;
@@ -495,8 +496,7 @@ bind_new_prefix:
 	newrange.max_addr.ip = postnat_ip;
 	newrange.min_proto = mr->min_proto;
 	newrange.max_proto = mr->max_proto;
-	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
-
+	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->state->hook));
 no_rev_map:
 no_free_ip:
 	spin_unlock_bh(&dnetmap_lock);

extensions/xt_ECHO.c

@@ -35,7 +35,7 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	void *payload;
 	struct flowi6 fl;
 	struct dst_entry *dst = NULL;
-	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
+	struct net *net = dev_net((par->state->in != NULL) ? par->state->in : par->state->out);
 
 	/* This allows us to do the copy operation in fewer lines of code. */
 	if (skb_linearize(oldskb) < 0)
@@ -76,6 +76,7 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	payload  = skb_header_pointer(oldskb, par->thoff +
 	           sizeof(*oldudp), data_len, NULL);
 	memcpy(skb_put(newskb, data_len), payload, data_len);
+	newip->payload_len = htons(newskb->len);
 
 #if 0
 	/*
@@ -112,7 +113,7 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 		goto free_nskb;
 
 	nf_ct_attach(newskb, oldskb);
-	ip6_local_out(newskb);
+	ip6_local_out(par_net(par), newskb->sk, newskb);
 	return NF_DROP;
 
  free_nskb:
@@ -156,8 +157,8 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	newip->version  = oldip->version;
 	newip->ihl      = sizeof(*newip) / 4;
 	newip->tos      = oldip->tos;
-	newip->id       = 0;
-	newip->frag_off = htons(IP_DF);
+	newip->id       = oldip->id;
+	newip->frag_off = 0;
 	newip->protocol = oldip->protocol;
 	newip->check    = 0;
 	newip->saddr    = oldip->daddr;
@@ -173,6 +174,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	payload  = skb_header_pointer(oldskb, par->thoff +
 	           sizeof(*oldudp), data_len, NULL);
 	memcpy(skb_put(newskb, data_len), payload, data_len);
+	newip->tot_len = htons(newskb->len);
 
 #if 0
 	/*
@@ -190,7 +192,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	/* ip_route_me_harder expects the skb's dst to be set */
 	skb_dst_set(newskb, dst_clone(skb_dst(oldskb)));
 
-	if (ip_route_me_harder(newskb, RTN_UNSPEC) != 0)
+	if (ip_route_me_harder(par_net(par), newskb, RTN_UNSPEC) != 0)
 		goto free_nskb;
 
 	newip->ttl = ip4_dst_hoplimit(skb_dst(newskb));
@@ -201,7 +203,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 		goto free_nskb;
 
 	nf_ct_attach(newskb, oldskb);
-	ip_local_out(newskb);
+	ip_local_out(par_net(par), newskb->sk, newskb);
 	return NF_DROP;
 
  free_nskb:

extensions/xt_LOGMARK.c

@@ -52,14 +52,19 @@ static void logmark_ct(const struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 		printk("EXPECTED");
 		prev = true;
 	}
-	if (ct->status & IPS_SEEN_REPLY)
-		printk("%s""SEEN_REPLY", prev++ ? "," : "");
-	if (ct->status & IPS_ASSURED)
-		printk("%s""ASSURED", prev++ ? "," : "");
-	if (ct->status & IPS_CONFIRMED)
-		printk("%s""CONFIRMED", prev++ ? "," : "");
-	printk(" lifetime=%lus",
-	       (jiffies - ct->timeout.expires) / HZ);
+	if (ct->status & IPS_SEEN_REPLY) {
+		printk("%s""SEEN_REPLY", prev ? "," : "");
+		prev = true;
+	}
+	if (ct->status & IPS_ASSURED) {
+		printk("%s""ASSURED", prev ? "," : "");
+		prev = true;
+	}
+	if (ct->status & IPS_CONFIRMED) {
+		printk("%s""CONFIRMED", prev ? "," : "");
+		prev = true;
+	}
+	printk(" lifetime=%lus", nf_ct_expires(ct) / HZ);
 }
 
 static unsigned int
@@ -72,15 +77,13 @@ logmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	printk("<%u>%.*s""iif=%d hook=%s nfmark=0x%x "
 	       "secmark=0x%x classify=0x%x",
 	       info->level, (unsigned int)sizeof(info->prefix), info->prefix,
-	       skb_ifindex(skb), hook_names[par->hooknum],
+	       skb_ifindex(skb), hook_names[par->state->hook],
 	       skb_nfmark(skb), skb_secmark(skb), skb->priority);
 
 	ct = nf_ct_get(skb, &ctinfo);
 	printk(" ctdir=%s", dir_names[ctinfo >= IP_CT_IS_REPLY]);
 	if (ct == NULL)
 		printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE");
-	else if (nf_ct_is_untracked(ct))
-		printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
 	else
 		logmark_ct(ct, ctinfo);
 

extensions/xt_PROTO.c

@@ -0,0 +1,156 @@
+/*
+ * Protocol modification target for IP tables
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <net/ipv6.h>
+#include <net/checksum.h>
+#include <linux/netfilter/x_tables.h>
+#include "xt_PROTO.h"
+
+MODULE_AUTHOR("Shanker Wang <i@innull.com>");
+MODULE_DESCRIPTION("Xtables: Protocol field modification target");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+proto_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	struct iphdr *iph;
+	const struct xt_PROTO_info *info = par->targinfo;
+	int new_proto;
+
+	if (skb_ensure_writable(skb, skb->len))
+		return NF_DROP;
+
+	iph = ip_hdr(skb);
+	new_proto = iph->protocol;
+	if (info->mode & (1 << XT_PROTO_SET))
+		new_proto = info->proto;
+	if (new_proto != iph->protocol) {
+		csum_replace2(&iph->check, htons(iph->protocol & 0xff),
+		              htons(new_proto & 0xff));
+		iph->protocol = new_proto;
+	}
+
+	return XT_CONTINUE;
+}
+
+static unsigned int
+proto_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	struct ipv6hdr *ip6h;
+	const struct xt_PROTO_info *info = par->targinfo;
+	u8 *nexthdr;
+	unsigned int hdr_offset;
+	__be16 *fp;
+
+	if (skb_ensure_writable(skb, skb->len))
+		return NF_DROP;
+
+	ip6h = ipv6_hdr(skb);
+	nexthdr = &ip6h->nexthdr;
+	hdr_offset = sizeof(struct ipv6hdr);
+
+	for (;;) {
+		struct ipv6_opt_hdr _opthdr, *opthp;
+		unsigned int hdrlen;
+		unsigned short _frag_off;
+		if (!ipv6_ext_hdr(*nexthdr) || *nexthdr == NEXTHDR_NONE)
+			break;
+		opthp = skb_header_pointer(skb, skb_network_offset(skb) + hdr_offset, sizeof(_opthdr), &_opthdr);
+		if (!opthp)
+			return NF_DROP;
+		if (*nexthdr == NEXTHDR_FRAGMENT) {
+			if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
+				break;
+			fp = skb_header_pointer(skb, skb_network_offset(skb) +
+			     hdr_offset + offsetof(struct frag_hdr, frag_off),
+			     sizeof(_frag_off), &_frag_off);
+			if (!fp)
+				return NF_DROP;
+			_frag_off = ntohs(*fp) & ~0x7;
+			if (_frag_off) { // if the packet is not the first fragment
+				if (!ipv6_ext_hdr(opthp->nexthdr) || opthp->nexthdr == NEXTHDR_NONE ||
+				    (info->mode & (1 << XT_PROTO_STOP_AT_AUTH) && opthp->nexthdr == NEXTHDR_AUTH)) {
+					nexthdr = &((struct ipv6_opt_hdr *)(skb_network_header(skb) + hdr_offset))->nexthdr;
+					break;
+				} else {
+					return XT_CONTINUE;
+				}
+			}
+			hdrlen = 8;
+		} else if(*nexthdr == NEXTHDR_AUTH) {
+			if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
+				break;
+			hdrlen = (opthp->hdrlen + 2) << 2;
+		} else {
+			hdrlen = ipv6_optlen(opthp);
+		}
+		nexthdr = &((struct ipv6_opt_hdr *)(skb_network_header(skb) + hdr_offset))->nexthdr;
+		hdr_offset += hdrlen;
+	}
+	
+	if (info->mode & (1 << XT_PROTO_SET))
+		*nexthdr = info->proto;
+	return XT_CONTINUE;
+}
+
+static int proto_tg_check(const struct xt_tgchk_param *par)
+{
+	const struct xt_PROTO_info *info = par->targinfo;
+
+	if ((info->mode & (1 << XT_PROTO_SET)) == 0) {
+		pr_info_ratelimited("Did not specify any proto to set\n");
+		return -EINVAL;
+	}
+	if (par->family != NFPROTO_IPV6 && (info->mode & ((1 << XT_PROTO_STOP_AT_FRAG) | (1 << XT_PROTO_STOP_AT_AUTH))) != 0) {
+		pr_info_ratelimited("Must not specify stop-at-frag and stop-at-auth on non-ipv6 targets\n");
+		return -EPROTOTYPE;
+	}
+	return 0;
+}
+
+static struct xt_target proto_tg_reg[] __read_mostly = {
+	{
+		.name       = "PROTO",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.target     = proto_tg,
+		.targetsize = sizeof(struct xt_PROTO_info),
+		.table      = "mangle",
+		.checkentry = proto_tg_check,
+		.me         = THIS_MODULE,
+	},
+	{
+		.name       = "PROTO",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.target     = proto_tg6,
+		.targetsize = sizeof(struct xt_PROTO_info),
+		.table      = "mangle",
+		.checkentry = proto_tg_check,
+		.me         = THIS_MODULE,
+	},
+};
+
+static int __init proto_tg_init(void)
+{
+	return xt_register_targets(proto_tg_reg, ARRAY_SIZE(proto_tg_reg));
+}
+
+static void __exit proto_tg_exit(void)
+{
+	xt_unregister_targets(proto_tg_reg, ARRAY_SIZE(proto_tg_reg));
+}
+
+module_init(proto_tg_init);
+module_exit(proto_tg_exit);
+MODULE_ALIAS("ipt_PROTO");
+MODULE_ALIAS("ip6t_PROTO");

extensions/xt_PROTO.h

@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* Protocol modification module for IP tables */
+
+#ifndef _XT_PROTO_H
+#define _XT_PROTO_H
+
+#include <linux/types.h>
+
+enum {
+	XT_PROTO_SET = 0,
+	XT_PROTO_STOP_AT_FRAG = 1,
+	XT_PROTO_STOP_AT_AUTH = 2
+};
+
+struct xt_PROTO_info {
+	__u8	mode;
+	__u8	proto;
+};
+
+#endif

extensions/xt_SYSRQ.c

@@ -1,6 +1,6 @@
 /*
  *	"SYSRQ" target extension for Xtables
- *	Copyright © Jan Engelhardt, 2008 - 2012
+ *	Copyright Jan Engelhardt, 2016
  *
  *	Based upon the ipt_SYSRQ idea by Marek Zalem <marek [at] terminus sk>
  *
@@ -21,8 +21,7 @@
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter/x_tables.h>
-#include <linux/crypto.h>
-#include <linux/scatterlist.h>
+#include <crypto/hash.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include "compat_xtables.h"
@@ -50,7 +49,7 @@ MODULE_PARM_DESC(seqno, "sequence number for remote sysrq");
 MODULE_PARM_DESC(debug, "debugging: 0=off, 1=on");
 
 #ifdef WITH_CRYPTO
-static struct crypto_hash *sysrq_tfm;
+static struct crypto_shash *sysrq_tfm;
 static int sysrq_digest_size;
 static unsigned char *sysrq_digest_password;
 static unsigned char *sysrq_digest;
@@ -75,8 +74,7 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 {
 	const char *data = pdata;
 	int i, n;
-	struct scatterlist sg[2];
-	struct hash_desc desc;
+	struct shash_desc desc;
 	int ret;
 	long new_seqno = 0;
 
@@ -116,16 +114,15 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 	}
 
 	desc.tfm   = sysrq_tfm;
-	desc.flags = 0;
-	ret = crypto_hash_init(&desc);
+	ret = crypto_shash_init(&desc);
 	if (ret != 0)
 		goto hash_fail;
-	sg_init_table(sg, 2);
-	sg_set_buf(&sg[0], data, n);
-	i = strlen(sysrq_digest_password);
-	sg_set_buf(&sg[1], sysrq_digest_password, i);
-	ret = crypto_hash_digest(&desc, sg, n + i, sysrq_digest);
-	if (ret != 0)
+	if (crypto_shash_update(&desc, data, n) != 0)
+		goto hash_fail;
+	if (crypto_shash_update(&desc, sysrq_digest_password,
+	    strlen(sysrq_digest_password)) != 0)
+		goto hash_fail;
+	if (crypto_shash_final(&desc, sysrq_digest) != 0)
 		goto hash_fail;
 
 	for (i = 0; i < sysrq_digest_size; ++i) {
@@ -303,7 +300,7 @@ static void sysrq_crypto_exit(void)
 {
 #ifdef WITH_CRYPTO
 	if (sysrq_tfm)
-		crypto_free_hash(sysrq_tfm);
+		crypto_free_shash(sysrq_tfm);
 	if (sysrq_digest)
 		kfree(sysrq_digest);
 	if (sysrq_hexdigest)
@@ -316,10 +313,10 @@ static void sysrq_crypto_exit(void)
 static int __init sysrq_crypto_init(void)
 {
 #if defined(WITH_CRYPTO)
-	struct timeval now;
+	struct timespec64 now;
 	int ret;
 
-	sysrq_tfm = crypto_alloc_hash(sysrq_hash, 0, CRYPTO_ALG_ASYNC);
+	sysrq_tfm = crypto_alloc_shash(sysrq_hash, 0, 0);
 	if (IS_ERR(sysrq_tfm)) {
 		printk(KERN_WARNING KBUILD_MODNAME
 			": Error: Could not find or load %s hash\n",
@@ -328,7 +325,7 @@ static int __init sysrq_crypto_init(void)
 		sysrq_tfm = NULL;
 		goto fail;
 	}
-	sysrq_digest_size = crypto_hash_digestsize(sysrq_tfm);
+	sysrq_digest_size = crypto_shash_digestsize(sysrq_tfm);
 	sysrq_digest = kmalloc(sysrq_digest_size, GFP_KERNEL);
 	ret = -ENOMEM;
 	if (sysrq_digest == NULL)
@@ -341,7 +338,7 @@ static int __init sysrq_crypto_init(void)
 		    sizeof(sysrq_password), GFP_KERNEL);
 	if (sysrq_digest_password == NULL)
 		goto fail;
-	do_gettimeofday(&now);
+	ktime_get_real_ts64(&now);
 	sysrq_seqno = now.tv_sec;
 	return 0;
 
@@ -371,7 +368,7 @@ static void __exit sysrq_tg_exit(void)
 module_init(sysrq_tg_init);
 module_exit(sysrq_tg_exit);
 MODULE_DESCRIPTION("Xtables: triggering SYSRQ remotely");
-MODULE_AUTHOR("Jan Engelhardt ");
+MODULE_AUTHOR("Jan Engelhardt");
 MODULE_AUTHOR("John Haxby <john.haxby@oracle.com");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_SYSRQ");

extensions/xt_TARPIT.c

@@ -170,8 +170,8 @@ static bool tarpit_generic(struct tcphdr *tcph, const struct tcphdr *oth,
 	return true;
 }
 
-static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
-    unsigned int mode)
+static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
+    unsigned int hook, unsigned int mode)
 {
 	struct tcphdr _otcph, *tcph;
 	const struct tcphdr *oth;
@@ -205,7 +205,11 @@ static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
 		return;
 
 	/* This packet will not be the same as the other: clear nf fields */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
+	nf_reset_ct(nskb);
+#else
 	nf_reset(nskb);
+#endif
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
 	skb_shinfo(nskb)->gso_size = 0;
@@ -249,19 +253,19 @@ static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
 		niph->id = ~oldhdr->id + 1;
 
 #ifdef CONFIG_BRIDGE_NETFILTER
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
-	    nskb->nf_bridge->physoutdev != NULL))
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+	if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
+	    ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
 #else
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
-	    nskb->nf_bridge->mask & BRNF_BRIDGED))
+	    nskb->nf_bridge->physoutdev != NULL))
 #endif
 #else
 	if (hook != NF_INET_FORWARD)
 #endif
 		addr_type = RTN_LOCAL;
 
-	if (ip_route_me_harder(nskb, addr_type))
+	if (ip_route_me_harder(net, nskb, addr_type))
 		goto free_nskb;
 	else
 		niph = ip_hdr(nskb);
@@ -283,14 +287,8 @@ static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
 		goto free_nskb;
 
 	nf_ct_attach(nskb, oldskb);
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, NULL, nskb, NULL,
-		skb_dst(nskb)->dev, dst_output_sk);
-#else
-	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, nskb, NULL,
+	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
 		skb_dst(nskb)->dev, dst_output);
-#endif
 	return;
 
  free_nskb:
@@ -298,8 +296,8 @@ static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
 }
 
 #ifdef WITH_IPV6
-static void tarpit_tcp6(struct sk_buff *oldskb, unsigned int hook,
-    unsigned int mode)
+static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
+    unsigned int hook, unsigned int mode)
 {
 	struct sk_buff *nskb;
 	struct tcphdr *tcph, oth;
@@ -352,7 +350,11 @@ static void tarpit_tcp6(struct sk_buff *oldskb, unsigned int hook,
 	}
 
 	/* This packet will not be the same as the other: clear nf fields */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
+	nf_reset_ct(nskb);
+#else
 	nf_reset(nskb);
+#endif
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
 	skb_shinfo(nskb)->gso_size = 0;
@@ -397,20 +399,14 @@ static void tarpit_tcp6(struct sk_buff *oldskb, unsigned int hook,
 	              IPPROTO_TCP,
 	              csum_partial(tcph, sizeof(struct tcphdr), 0));
 
-	if (ip6_route_me_harder(nskb))
+	if (ip6_route_me_harder(net, nskb))
 		goto free_nskb;
 
 	nskb->ip_summed = CHECKSUM_NONE;
 
 	nf_ct_attach(nskb, oldskb);
-
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
-	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, NULL, nskb, NULL,
-	        skb_dst(nskb)->dev, dst_output_sk);
-#else
-	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb, NULL,
+	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
 	        skb_dst(nskb)->dev, dst_output);
-#endif
 	return;
 
  free_nskb:
@@ -448,8 +444,7 @@ tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 	/* We are not interested in fragments */
 	if (iph->frag_off & htons(IP_OFFSET))
 		return NF_DROP;
-
-	tarpit_tcp4(skb, par->hooknum, info->variant);
+	tarpit_tcp4(par_net(par), skb, par->state->hook, info->variant);
 	return NF_DROP;
 }
 
@@ -490,8 +485,7 @@ tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 		pr_debug("addr is not unicast.\n");
 		return NF_DROP;
 	}
-
-	tarpit_tcp6(skb, par->hooknum, info->variant);
+	tarpit_tcp6(par_net(par), skb, par->state->hook, info->variant);
 	return NF_DROP;
 }
 #endif

extensions/xt_condition.c

@@ -7,6 +7,7 @@
  *	Authors:
  *	Stephane Ouellette <ouellettes [at] videotron ca>, 2002-10-22
  *	Massimiliano Hofer <max [at] nucleus it>, 2006-05-15
+ *	Grzegorz Kuczyński <grzegorz.kuczynski [at] koba pl>, 2017-02-27
  *
  *	This program is free software; you can redistribute it and/or modify it
  *	under the terms of the GNU General Public License; either version 2
@@ -21,6 +22,8 @@
 #include <linux/version.h>
 #include <linux/netfilter/x_tables.h>
 #include <asm/uaccess.h>
+#include <net/net_namespace.h>
+#include <net/netns/generic.h>
 #include "xt_condition.h"
 #include "compat_xtables.h"
 
@@ -59,14 +62,25 @@ struct condition_variable {
 /*           to the conditions' list.                               */
 static DEFINE_MUTEX(proc_lock);
 
-static LIST_HEAD(conditions_list);
-static struct proc_dir_entry *proc_net_condition;
+struct condition_net {
+	struct list_head conditions_list;
+	struct proc_dir_entry *proc_net_condition;
+	bool after_clear;
+};
+
+static int condition_net_id;
+
+static inline struct condition_net *condition_pernet(struct net *net)
+{
+	return net_generic(net, condition_net_id);
+}
 
 static int condition_proc_show(struct seq_file *m, void *data)
 {
 	const struct condition_variable *var = m->private;
 
-	return seq_printf(m, var->enabled ? "1\n" : "0\n");
+	seq_printf(m, var->enabled ? "1\n" : "0\n");
+	return 0;
 }
 
 static int condition_proc_open(struct inode *inode, struct file *file)
@@ -118,6 +132,7 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 {
 	struct xt_condition_mtinfo *info = par->matchinfo;
 	struct condition_variable *var;
+	struct condition_net *condition_net = condition_pernet(par->net);
 
 	/* Forbid certain names */
 	if (*info->name == '\0' || *info->name == '.' ||
@@ -133,7 +148,7 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 	 * or increase the reference counter.
 	 */
 	mutex_lock(&proc_lock);
-	list_for_each_entry(var, &conditions_list, list) {
+	list_for_each_entry(var, &condition_net->conditions_list, list) {
 		if (strcmp(info->name, var->name) == 0) {
 			var->refcount++;
 			mutex_unlock(&proc_lock);
@@ -152,7 +167,7 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 	memcpy(var->name, info->name, sizeof(info->name));
 	/* Create the condition variable's proc file entry. */
 	var->status_proc = proc_create_data(info->name, condition_list_perms,
-	                   proc_net_condition, &condition_proc_fops, var);
+	                   condition_net->proc_net_condition, &condition_proc_fops, var);
 	if (var->status_proc == NULL) {
 		kfree(var);
 		mutex_unlock(&proc_lock);
@@ -165,7 +180,7 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 	var->refcount = 1;
 	var->enabled  = false;
 	wmb();
-	list_add(&var->list, &conditions_list);
+	list_add(&var->list, &condition_net->conditions_list);
 	mutex_unlock(&proc_lock);
 	info->condvar = var;
 	return 0;
@@ -175,11 +190,15 @@ static void condition_mt_destroy(const struct xt_mtdtor_param *par)
 {
 	const struct xt_condition_mtinfo *info = par->matchinfo;
 	struct condition_variable *var = info->condvar;
+	struct condition_net *cnet = condition_pernet(par->net);
+
+	if (cnet->after_clear)
+		return;
 
 	mutex_lock(&proc_lock);
 	if (--var->refcount == 0) {
 		list_del(&var->list);
-		proc_remove(var->status_proc);
+		remove_proc_entry(var->name, cnet->proc_net_condition);
 		mutex_unlock(&proc_lock);
 		kfree(var);
 		return;
@@ -212,18 +231,54 @@ static struct xt_match condition_mt_reg[] __read_mostly = {
 
 static const char *const dir_name = "nf_condition";
 
+static int __net_init condition_net_init(struct net *net)
+{
+	struct condition_net *condition_net = condition_pernet(net);
+	INIT_LIST_HEAD(&condition_net->conditions_list);
+	condition_net->proc_net_condition = proc_mkdir(dir_name, net->proc_net);
+	if (condition_net->proc_net_condition == NULL)
+		return -EACCES;
+	condition_net->after_clear = 0;
+	return 0;
+}
+
+static void __net_exit condition_net_exit(struct net *net)
+{
+	struct condition_net *condition_net = condition_pernet(net);
+	struct list_head *pos, *q;
+	struct condition_variable *var = NULL;
+
+	remove_proc_subtree(dir_name, net->proc_net);
+	mutex_lock(&proc_lock);
+	list_for_each_safe(pos, q, &condition_net->conditions_list) {
+		var = list_entry(pos, struct condition_variable, list);
+		list_del(pos);
+		kfree(var);
+	}
+	mutex_unlock(&proc_lock);
+	condition_net->after_clear = true;
+}
+
+static struct pernet_operations condition_net_ops = {
+	.init   = condition_net_init,
+	.exit   = condition_net_exit,
+	.id     = &condition_net_id,
+	.size   = sizeof(struct condition_net),
+};
+
+
 static int __init condition_mt_init(void)
 {
 	int ret;
 
 	mutex_init(&proc_lock);
-	proc_net_condition = proc_mkdir(dir_name, init_net.proc_net);
-	if (proc_net_condition == NULL)
-		return -EACCES;
+	ret = register_pernet_subsys(&condition_net_ops);
+	if (ret != 0)
+		return ret;
 
 	ret = xt_register_matches(condition_mt_reg, ARRAY_SIZE(condition_mt_reg));
 	if (ret < 0) {
-		remove_proc_entry(dir_name, init_net.proc_net);
+		unregister_pernet_subsys(&condition_net_ops);
 		return ret;
 	}
 
@@ -233,7 +288,7 @@ static int __init condition_mt_init(void)
 static void __exit condition_mt_exit(void)
 {
 	xt_unregister_matches(condition_mt_reg, ARRAY_SIZE(condition_mt_reg));
-	remove_proc_entry(dir_name, init_net.proc_net);
+	unregister_pernet_subsys(&condition_net_ops);
 }
 
 module_init(condition_mt_init);

extensions/xt_geoip.c

@@ -75,7 +75,8 @@ geoip_add_node(const struct geoip_country_user __user *umem_ptr,
 
 	if (copy_from_user(&umem, umem_ptr, sizeof(umem)) != 0)
 		return ERR_PTR(-EFAULT);
-
+	if (umem.count > SIZE_MAX / geoproto_size[proto])
+		return ERR_PTR(-E2BIG);
 	p = kmalloc(sizeof(struct geoip_country_kernel), GFP_KERNEL);
 	if (p == NULL)
 		return ERR_PTR(-ENOMEM);

extensions/xt_iface.c

@@ -45,9 +45,9 @@ static const struct net_device *iface_get(const struct xt_iface_mtinfo *info,
     const struct xt_action_param *par, struct net_device **put)
 {
 	if (info->flags & XT_IFACE_DEV_IN)
-		return par->in;
+		return par->state->in;
 	else if (info->flags & XT_IFACE_DEV_OUT)
-		return par->out;
+		return par->state->out;
 	return *put = dev_get_by_name(&init_net, info->ifname);
 }
 

extensions/xt_ipp2p.c

@@ -511,7 +511,7 @@ search_bittorrent(const unsigned char *payload, const unsigned int plen)
 		 * but *must have* one (or more) of strings listed below (true for scrape and announce)
 		 */
 		if (memcmp(payload, "GET /", 5) == 0) {
-			if (HX_memmem(payload, plen, "info_hash=", 9) != NULL)
+			if (HX_memmem(payload, plen, "info_hash=", 10) != NULL)
 				return IPP2P_BIT * 100 + 1;
 			if (HX_memmem(payload, plen, "peer_id=", 8) != NULL)
 				return IPP2P_BIT * 100 + 2;

extensions/xt_lscan.c

@@ -204,7 +204,7 @@ lscan_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		unsigned int n;
 
 		n = lscan_mt_full(ctdata->mark & connmark_mask, ctstate,
-		    par->in == init_net.loopback_dev, tcph,
+		    par->state->in == init_net.loopback_dev, tcph,
 		    skb->len - par->thoff - 4 * tcph->doff);
 
 		ctdata->mark = (ctdata->mark & ~connmark_mask) | n;

extensions/xt_psd.c

@@ -45,12 +45,12 @@ MODULE_ALIAS("ip6t_psd");
 
 /*
  * Keep track of up to LIST_SIZE source addresses, using a hash table of
- * HASH_SIZE entries for faster lookups, but limiting hash collisions to
+ * PSD_HASH_SIZE entries for faster lookups, but limiting hash collisions to
  * HASH_MAX source addresses per the same hash value.
  */
 #define LIST_SIZE			0x100
 #define HASH_LOG			9
-#define HASH_SIZE			(1 << HASH_LOG)
+#define PSD_HASH_SIZE			(1 << HASH_LOG)
 #define HASH_MAX			0x10
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
@@ -108,7 +108,7 @@ struct host6 {
 static struct {
 	spinlock_t lock;
 	struct host4 list[LIST_SIZE];
-	struct host *hash[HASH_SIZE];
+	struct host *hash[PSD_HASH_SIZE];
 	int index;
 } state;
 
@@ -143,13 +143,12 @@ static bool state6_alloc_mem(void)
 	if (state6.list == NULL)
 		return false;
 	memset(state6.list, 0, LIST_SIZE * sizeof(struct host6));
-
-	state6.hash = vmalloc(HASH_SIZE * sizeof(struct host*));
+	state6.hash = vmalloc(PSD_HASH_SIZE * sizeof(struct host *));
 	if (state6.hash == NULL) {
 		vfree(state6.list);
 		return false;
 	}
-	memset(state6.hash, 0, HASH_SIZE * sizeof(struct host *));
+	memset(state6.hash, 0, PSD_HASH_SIZE * sizeof(struct host *));
 	return true;
 }
 #endif
@@ -167,8 +166,7 @@ static unsigned int hashfunc(__be32 addr)
 	do {
 		hash ^= value;
 	} while ((value >>= HASH_LOG) != 0);
-
-	return hash & (HASH_SIZE - 1);
+	return hash & (PSD_HASH_SIZE - 1);
 }
 
 static inline unsigned int hashfunc6(const struct in6_addr *addr)

extensions/xt_quota2.c

@@ -64,12 +64,11 @@ module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);
 static int quota_proc_show(struct seq_file *m, void *data)
 {
 	struct xt_quota_counter *e = m->private;
-	int ret;
 
 	spin_lock_bh(&e->lock);
-	ret = seq_printf(m, "%llu\n", e->quota);
+	seq_printf(m, "%llu\n", e->quota);
 	spin_unlock_bh(&e->lock);
-	return ret;
+	return 0;
 }
 
 static int quota_proc_open(struct inode *inode, struct file *file)
@@ -82,7 +81,7 @@ quota_proc_write(struct file *file, const char __user *input,
                  size_t size, loff_t *loff)
 {
 	struct xt_quota_counter *e = PDE_DATA(file_inode(file));
-	char buf[sizeof("18446744073709551616")];
+	char buf[sizeof("+-18446744073709551616")];
 
 	if (size > sizeof(buf))
 		size = sizeof(buf);
@@ -92,9 +91,29 @@ quota_proc_write(struct file *file, const char __user *input,
 	if (size < sizeof(buf))
 		buf[size] = '\0';
 
-	spin_lock_bh(&e->lock);
-	e->quota = simple_strtoull(buf, NULL, 0);
-	spin_unlock_bh(&e->lock);
+	if (*buf == '+') {
+		int64_t temp = simple_strtoll(buf + 1, NULL, 0);
+		spin_lock_bh(&e->lock);
+		/* Do not let quota become negative if @tmp is very negative */
+		if (temp > 0 || -temp < e->quota)
+			e->quota += temp;
+		else
+			e->quota = 0;
+		spin_unlock_bh(&e->lock);
+	} else if (*buf == '-') {
+		int64_t temp = simple_strtoll(buf + 1, NULL, 0);
+		spin_lock_bh(&e->lock);
+		/* Do not let quota become negative if @tmp is very big */
+		if (temp < 0 || temp < e->quota)
+			e->quota -= temp;
+		else
+			e->quota = 0;
+		spin_unlock_bh(&e->lock);
+	} else {
+		spin_lock_bh(&e->lock);
+		e->quota = simple_strtoull(buf, NULL, 0);
+		spin_unlock_bh(&e->lock);
+	}
 	return size;
 }
 

geoip/xt_geoip_build

@@ -1,10 +1,13 @@
 #!/usr/bin/perl
 #
-#	Converter for MaxMind CSV database to binary, for xt_geoip
-#	Copyright © Jan Engelhardt, 2008-2011
+#	Converter for MaxMind (GeoLite2) CSV database to binary, for xt_geoip
+#	Copyright Jan Engelhardt, 2008-2011
+#	Copyright Philip Prindeville, 2018
 #
 use Getopt::Long;
-use IO::Handle;
+use Net::CIDR::Lite;
+use Socket qw(AF_INET AF_INET6 inet_pton);
+use warnings;
 use Text::CSV_XS; # or trade for Text::CSV
 use strict;
 
@@ -13,52 +16,201 @@ my $csv = Text::CSV_XS->new({
 	binary => 1,
 	eol => $/,
 }); # or Text::CSV
+my $source_dir = ".";
 my $target_dir = ".";
 
 &Getopt::Long::Configure(qw(bundling));
 &GetOptions(
 	"D=s" => \$target_dir,
+	"S=s" => \$source_dir,
 );
 
-if (!-d $target_dir) {
-	print STDERR "Target directory $target_dir does not exist.\n";
+if (!-d $source_dir) {
+	print STDERR "Source directory \"$source_dir\" does not exist.\n";
 	exit 1;
 }
-foreach (qw(LE BE)) {
-	my $dir = "$target_dir/$_";
-	if (!-e $dir && !mkdir($dir)) {
-		print STDERR "Could not mkdir $dir: $!\n";
-		exit 1;
-	}
+if (!-d $target_dir) {
+	print STDERR "Target directory \"$target_dir\" does not exist.\n";
+	exit 1;
 }
 
+my %countryId;
+my %countryName;
+&loadCountries();
 &dump(&collect());
 
+sub loadCountries
+{
+	sub id; sub cc; sub long; sub ct; sub cn;
+
+	%countryId = ();
+	%countryName = ();
+
+	my $file = "$source_dir/GeoLite2-Country-Locations-en.csv";
+	open(my $fh, '<', $file) || die "Couldn't open list country names\n";
+
+	# first line is headers
+	my $row = $csv->getline($fh);
+
+	my %header = map { ($row->[$_], $_); } (0..$#{$row});
+
+	my %pairs = (
+		country_iso_code => 'ISO Country Code',
+		geoname_id => 'ID',
+		country_name => 'Country Name',
+		continent_code => 'Continent Code',
+		continent_name => 'Continent Name',
+	);
+
+	# verify that the columns we need are present
+	map { die "Table has no $pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
+
+	my %remapping = (
+		id => 'geoname_id',
+		cc => 'country_iso_code',
+		long => 'country_name',
+		ct => 'continent_code',
+		cn => 'continent_name',
+	);
+
+	# now create a function which returns the value of that column #
+	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
+
+	while (my $row = $csv->getline($fh)) {
+		if ($row->[cc] eq '' && $row->[long] eq '') {
+			$countryId{$row->[id]} = $row->[ct];
+			$countryName{$row->[ct]} = $row->[cn];
+		} else {
+			$countryId{$row->[id]} = $row->[cc];
+			$countryName{$row->[cc]} = $row->[long];
+		}
+	}
+
+	$countryName{A1} = 'Anonymous Proxy';
+	$countryName{A2} = 'Satellite Provider';
+	$countryName{O1} = 'Other Country';
+
+	close($fh);
+
+	# clean up the namespace
+	undef &id; undef &cc; undef &long; undef &ct; undef &cn;
+}
+
+sub lookupCountry
+{
+	my ($id, $rid, $proxy, $sat) = @_;
+
+	if ($proxy) {
+		return 'A1';
+	} elsif ($sat) {
+		return 'A2';
+	}
+	$id ||= $rid;
+	if ($id eq '') {
+		return 'O1';
+	}
+	die "Unknown id: $id line $.\n" unless (exists $countryId{$id});
+	return $countryId{$id};
+}
+
 sub collect
 {
-	my %country;
+	my ($file, $fh, $row);
+	my (%country, %header);
+
+	sub net; sub id; sub rid; sub proxy; sub sat;
+
+	my %pairs = (
+		network => 'Network',
+		registered_country_geoname_id => 'Registered Country ID',
+		geoname_id => 'Country ID',
+		is_anonymous_proxy => 'Anonymous Proxy',
+		is_satellite_provider => 'Satellite',
+	);
+
+	foreach (sort keys %countryName) {
+		$country{$_} = {
+			name => $countryName{$_},
+			pool_v4 => Net::CIDR::Lite->new(),
+			pool_v6 => Net::CIDR::Lite->new(),
+		};
+	}
+
+	$file = "$source_dir/GeoLite2-Country-Blocks-IPv4.csv";
+	open($fh, '<', $file) || die "Can't open IPv4 database\n";
+
+	# first line is headers
+	$row = $csv->getline($fh);
+
+	%header = map { ($row->[$_], $_); } (0..$#{$row});
+
+	# verify that the columns we need are present
+	map { die "Table has no %pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
+
+	my %remapping = (
+		net => 'network',
+		id => 'geoname_id',
+		rid => 'registered_country_geoname_id',
+		proxy => 'is_anonymous_proxy',
+		sat => 'is_satellite_provider',
+	);
+
+	# now create a function which returns the value of that column #
+	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
+
+	while ($row = $csv->getline($fh)) {
+		my ($cc, $cidr);
+
+		$cc = lookupCountry($row->[id], $row->[rid], $row->[proxy], $row->[sat]);
+		$cidr = $row->[net];
+		$country{$cc}->{pool_v4}->add($cidr);
 
-	while (my $row = $csv->getline(*ARGV)) {
-		if (!defined($country{$row->[4]})) {
-			$country{$row->[4]} = {
-				name => $row->[5],
-				pool_v4 => [],
-				pool_v6 => [],
-			};
-		}
-		my $c = $country{$row->[4]};
-		if ($row->[0] =~ /:/) {
-			push(@{$c->{pool_v6}},
-			     [&ip6_pack($row->[0]), &ip6_pack($row->[1])]);
-		} else {
-			push(@{$c->{pool_v4}}, [$row->[2], $row->[3]]);
-		}
 		if ($. % 4096 == 0) {
 			print STDERR "\r\e[2K$. entries";
 		}
 	}
 
 	print STDERR "\r\e[2K$. entries total\n";
+
+	close($fh);
+
+	# clean up the namespace
+	undef &net; undef &id; undef &rid; undef &proxy; undef &sat;
+
+	$file = "$source_dir/GeoLite2-Country-Blocks-IPv6.csv";
+	open($fh, '<', $file) || die "Can't open IPv6 database\n";
+
+	# first line is headers
+	$row = $csv->getline($fh);
+
+	%header = map { ($row->[$_], $_); } (0..$#{$row});
+
+	# verify that the columns we need are present
+	map { die "Table has no %pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
+
+	# unlikely the IPv6 table has different columns, but just to be sure
+	# create a function which returns the value of that column #
+	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
+
+	while ($row = $csv->getline($fh)) {
+		my ($cc, $cidr);
+
+		$cc = lookupCountry($row->[id], $row->[rid], $row->[proxy], $row->[sat]);
+		$cidr = $row->[net];
+		$country{$cc}->{pool_v6}->add($cidr);
+
+		if ($. % 4096 == 0) {
+			print STDERR "\r\e[2K$. entries";
+		}
+	}
+
+	print STDERR "\r\e[2K$. entries total\n";
+
+	close($fh);
+
+	# clean up the namespace
+	undef &net; undef &id; undef &rid; undef &proxy; undef &sat;
+
 	return \%country;
 }
 
@@ -66,7 +218,7 @@ sub dump
 {
 	my $country = shift @_;
 
-	foreach my $iso_code (sort keys %$country) {
+	foreach my $iso_code (sort keys %{$country}) {
 		&dump_one($iso_code, $country->{$iso_code});
 	}
 }
@@ -74,68 +226,40 @@ sub dump
 sub dump_one
 {
 	my($iso_code, $country) = @_;
-	my($file, $fh_le, $fh_be);
+	my @ranges;
 
-	printf "%5u IPv6 ranges for %s %s\n",
-		scalar(@{$country->{pool_v6}}),
-		$iso_code, $country->{name};
+	@ranges = $country->{pool_v4}->list_range();
 
-	$file = "$target_dir/LE/".uc($iso_code).".iv6";
-	if (!open($fh_le, "> $file")) {
-		print STDERR "Error opening $file: $!\n";
-		exit 1;
-	}
-	$file = "$target_dir/BE/".uc($iso_code).".iv6";
-	if (!open($fh_be, "> $file")) {
-		print STDERR "Error opening $file: $!\n";
-		exit 1;
-	}
-	foreach my $range (@{$country->{pool_v6}}) {
-		print $fh_be $range->[0], $range->[1];
-		print $fh_le &ip6_swap($range->[0]), &ip6_swap($range->[1]);
-	}
-	close $fh_le;
-	close $fh_be;
+	writeCountry($iso_code, $country->{name}, AF_INET, @ranges);
 
-	printf "%5u IPv4 ranges for %s %s\n",
-		scalar(@{$country->{pool_v4}}),
-		$iso_code, $country->{name};
+	@ranges = $country->{pool_v6}->list_range();
 
-	$file = "$target_dir/LE/".uc($iso_code).".iv4";
-	if (!open($fh_le, "> $file")) {
-		print STDERR "Error opening $file: $!\n";
-		exit 1;
-	}
-	$file = "$target_dir/BE/".uc($iso_code).".iv4";
-	if (!open($fh_be, "> $file")) {
-		print STDERR "Error opening $file: $!\n";
-		exit 1;
-	}
-	foreach my $range (@{$country->{pool_v4}}) {
-		print $fh_le pack("VV", $range->[0], $range->[1]);
-		print $fh_be pack("NN", $range->[0], $range->[1]);
-	}
-	close $fh_le;
-	close $fh_be;
+	writeCountry($iso_code, $country->{name}, AF_INET6, @ranges);
 }
 
-sub ip6_pack
+sub writeCountry
 {
-	my $addr = shift @_;
-	$addr =~ s{::}{:!:};
-	my @addr = split(/:/, $addr);
-	my @e = (0) x 8;
-	foreach (@addr) {
-		if ($_ eq "!") {
-			$_ = join(':', @e[0..(8-scalar(@addr))]);
-		}
-	}
-	@addr = split(/:/, join(':', @addr));
-	$_ = hex($_) foreach @addr;
-	return pack("n*", @addr);
-}
+	my ($iso_code, $name, $family, @ranges) = @_;
+	my $fh;
 
-sub ip6_swap
-{
-	return pack("V*", unpack("N*", shift @_));
+	printf "%5u IPv%s ranges for %s %s\n",
+		scalar(@ranges),
+		($family == AF_INET ? '4' : '6'),
+		$iso_code, $name;
+
+	my $file = "$target_dir/".uc($iso_code).".iv".($family == AF_INET ? '4' : '6');
+	if (!open($fh, '>', $file)) {
+		print STDERR "Error opening $file: $!\n";
+		exit 1;
+	}
+
+	binmode($fh);
+
+	foreach my $range (@ranges) {
+		my ($start, $end) = split('-', $range);
+		$start = inet_pton($family, $start);
+		$end = inet_pton($family, $end);
+		print $fh $start, $end;
+	}
+	close $fh;
 }

geoip/xt_geoip_build.1

@@ -5,7 +5,7 @@ xt_geoip_build \(em convert GeoIP.csv to packed format for xt_geoip
 .SH Syntax
 .PP
 \fI/usr/libexec/xt_geoip/\fP\fBxt_geoip_build\fP [\fB\-D\fP
-\fItarget_dir\fP] [\fIfile\fP...]
+\fItarget_dir\fP] [\fB\-S\fP \fIsource_dir\fP]
 .SH Description
 .PP
 xt_geoip_build is used to build packed raw representations of the range
@@ -16,15 +16,19 @@ required to be loaded into memory. The ranges in the packed database files are
 also ordered, as xt_geoip relies on this property for its bisection approach to
 work.
 .PP
-Input is processed from the listed files, or if none is given, from stdin.
-.PP
 Since the script is usually installed to the libexec directory of the
 xtables-addons package and this is outside $PATH (on purpose), invoking the
 script requires it to be called with a path.
 .PP Options
 .TP
 \fB\-D\fP \fItarget_dir\fP
-Specify a target directory into which the files are to be put.
+Specifies the target directory into which the files are to be put. Defaults to ".".
+.TP
+\fB\-S\fP \fIsource_dir\fP
+Specifies the source directory from which to read the three files by the name
+of \fBGeoLite2\-Country\-Blocks\-IPv4.csv\fP,
+\fBGeoLite2\-Country\-Blocks\-IPv6.csv\fP and
+\fBGeoLite2\-Country\-Locations\-en.csv\fP. Defaults to ".".
 .SH Application
 .PP
 Shell commands to build the databases and put them to where they are expected:

geoip/xt_geoip_dl

@@ -1,8 +1,7 @@
 #!/bin/sh
 
-rm -f GeoIPv6.csv GeoIPv6.csv.gz GeoIPCountryCSV.zip GeoIPCountryWhois.csv;
-wget \
-	http://geolite.maxmind.com/download/geoip/database/GeoIPv6.csv.gz \
-	http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip;
-gzip -d GeoIPv6.csv.gz;
-unzip GeoIPCountryCSV.zip;
+rm -rf GeoLite2-Country-CSV_*
+
+wget -q http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip
+unzip -q GeoLite2-Country-CSV.zip
+rm -f GeoLite2-Country-CSV.zip

geoip/xt_geoip_fetch

@@ -0,0 +1,93 @@
+#!/usr/bin/perl
+#
+#	Utility to query GeoIP database
+#	Copyright Philip Prindeville, 2018
+#
+use Getopt::Long;
+use Socket qw(AF_INET AF_INET6 inet_ntop);
+use warnings;
+use strict;
+
+sub AF_INET_SIZE() { 4 }
+sub AF_INET6_SIZE() { 16 }
+
+my $target_dir = ".";
+my $ipv4 = 0;
+my $ipv6 = 0;
+
+&Getopt::Long::Configure(qw(bundling));
+&GetOptions(
+	"D=s" => \$target_dir,
+	"4"   => \$ipv4,
+	"6"   => \$ipv6,
+);
+
+if (!-d $target_dir) {
+	print STDERR "Target directory $target_dir does not exit.\n";
+	exit 1;
+}
+
+# if neither specified, assume both
+if (! $ipv4 && ! $ipv6) {
+	$ipv4 = $ipv6 = 1;
+}
+
+foreach my $cc (@ARGV) {
+	if ($cc !~ m/^([a-z]{2}|a[12]|o1)$/i) {
+		print STDERR "Invalid country code '$cc'\n";
+		exit 1;
+	}
+
+	my $file = $target_dir . '/' . uc($cc) . '.iv4';
+
+	if (! -f $file) {
+		printf STDERR "Can't find data for country '$cc'\n";
+		exit 1;
+	}
+
+	my ($contents, $buffer, $bytes, $fh);
+
+	if ($ipv4) {
+		open($fh, '<', $file) || die "Couldn't open file for '$cc'\n";
+
+		binmode($fh);
+
+		while (($bytes = read($fh, $buffer, AF_INET_SIZE * 2)) == AF_INET_SIZE * 2) {
+			my $start = inet_ntop(AF_INET, substr($buffer, 0, AF_INET_SIZE));
+			my $end = inet_ntop(AF_INET, substr($buffer, AF_INET_SIZE));
+			print $start, '-', $end, "\n";
+		}
+		close($fh);
+		if (! defined $bytes) {
+			printf STDERR "Error reading file for '$cc'\n";
+			exit 1;
+		} elsif ($bytes != 0) {
+			printf STDERR "Short read on file for '$cc'\n";
+			exit 1;
+		}
+	}
+
+	substr($file, -1) = '6';
+
+	if ($ipv6) {
+		open($fh, '<', $file) || die "Couldn't open file for '$cc'\n";
+
+		binmode($fh);
+
+		while (($bytes = read($fh, $buffer, AF_INET6_SIZE * 2)) == AF_INET6_SIZE * 2) {
+			my $start = inet_ntop(AF_INET6, substr($buffer, 0, AF_INET6_SIZE));
+			my $end = inet_ntop(AF_INET6, substr($buffer, AF_INET6_SIZE));
+			print $start, '-', $end, "\n";
+		}
+		close($fh);
+		if (! defined $bytes) {
+			printf STDERR "Error reading file for '$cc'\n";
+			exit 1;
+		} elsif ($bytes != 0) {
+			printf STDERR "Short read on file for '$cc'\n";
+			exit 1;
+		}
+	}
+}
+
+exit 0;

mconfig

@@ -8,6 +8,7 @@ build_DNETMAP=m
 build_ECHO=m
 build_IPMARK=m
 build_LOGMARK=m
+build_PROTO=m
 build_SYSRQ=m
 build_TARPIT=m
 build_condition=m

sources

@@ -1,3 +0,0 @@
-#
-# Source URLs for external patchlets
-#

xa-download-more

@@ -1,83 +0,0 @@
-#!/usr/bin/perl -w
-
-use HTTP::Request;
-use LWP::UserAgent;
-use strict;
-
-&main(\@ARGV);
-
-sub main
-{
-	local *FH;
-
-	if (!-d "downloads") {
-		if (!mkdir("downloads")) {
-			die "Could not create downloads/ directory";
-		}
-	}
-
-	open(FH, "<sources");
-	while (defined($_ = <FH>)) {
-		chomp $_;
-		$_ =~ s/#.*//gs;
-		$_ =~ s/^\s+|\s+$//gs;
-		if (length($_) == 0) {
-			next;
-		}
-		&process_index($_);
-	}
-
-	close FH;
-}
-
-sub process_index
-{
-	my $top = shift @_;
-	my($agent, $res, $url);
-	local *FH;
-
-	$agent = LWP::UserAgent->new();
-	$agent->env_proxy();
-
-	$url = &slash_remove("$top/xa-index.txt");
-	print "  GET     $url\n";
-	$res = $agent->get($url);
-	if (!$res->is_success()) {
-		print STDERR "  `->     ", $res->status_line(), "\n";
-		return;
-	}
-
-	foreach my $ext (split(/\s+/, $res->content())) {
-		my($ex_url, $ex_res);
-
-		$ex_url = &slash_remove("$top/$ext");
-		print "  GET     $ex_url\n";
-
-		$ex_res = $agent->mirror($ex_url, "downloads/$ext");
-		if ($ex_res->code() == 304) {
-			# "Not modified" = up to date
-			next;
-		}
-		if (!$ex_res->is_success()) {
-			print STDERR "  `->     ", $ex_res->status_line(), "\n";
-			next;
-		}
-
-		print "  UNPACK  downloads/$ext\n";
-		system "tar", "-xjf", "downloads/$ext";
-	}
-}
-
-sub slash_remove
-{
-	my $s = shift @_;
-	$s =~ s{(\w+://)(.*)}{$1.&slash_remove2($2)}eg;
-	return $s;
-}
-
-sub slash_remove2
-{
-	my $s = shift @_;
-	$s =~ s{/+}{/}g;
-	return $s;
-}

xtables-addons.8.in

@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "" "" "v2.8 (2015-08-19)"
+.TH xtables-addons 8 "" "" "v3.6 (2019-11-20)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets