Xtables-addons 2.15

xt_lscan: add --mirai option
xt_lscan: extend info struct to support more flags (without size change)
2025-09-20 19:44:56 +02:00 · 2021-02-05 19:02:49 +01:00 · 2021-02-05 19:00:13 +01:00 · 2021-01-20 03:09:52 +01:00
45 changed files with 582 additions and 788 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -2,9 +2,7 @@
 *.la
 *.lo
 *.loT
-*.mod
 *.o
-.cache.mk
 .deps/
 .dirstamp
 .libs/
--- a/7
+++ b/7
@@ -12,17 +12,16 @@ in combination with the kernel's Kbuild system.
 Supported configurations for this release
 =========================================

-	* iptables >= 1.6.0
+	* iptables >= 1.4.5

-	* kernel-devel >= 4.15
+	* kernel-devel >= 3.7
 	  with prepared build/output directory
 	  - CONFIG_NF_CONNTRACK
 	  - CONFIG_NF_CONNTRACK_MARK enabled =y or as module (=m)
 	  - CONFIG_CONNECTOR y/m if you wish to receive userspace
 	    notifications from pknock through netlink/connector

-(Use xtables-addons-1.x if you need support for Linux < 3.7.
-Use xtables-addons-2.x if you need support for Linux < 4.15.)
+(Use xtables-addons-1.x if you need support for Linux < 3.7.)


 Selecting extensions
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,7 +1,7 @@
 # -*- Makefile -*-

 ACLOCAL_AMFLAGS  = -I m4
-SUBDIRS          = extensions extensions/ACCOUNT extensions/pknock geoip
+SUBDIRS          = extensions geoip

 man_MANS := xtables-addons.8

--- a/Makefile.mans.in
+++ b/Makefile.mans.in
@@ -40,4 +40,4 @@ targets.man: .manpages.lst ${wcman_targets}
 	$(call man_run,${wlist_targets})

 clean:
-	rm -f xtables-addons.8 matches.man targets.man .manpages.lst
+	rm -f xtables-addons.8 matches.man targets.man
--- a/54
+++ b/54
@@ -1,15 +1,57 @@
 Xtables-addons
 ==============

-Xtables-addons is a set of extensions that were not accepted in the
-Linux kernel and/or main Xtables/iptables package.
+Xtables-addons is the proclaimed successor to patch-o-matic(-ng). It
+contains extensions that were not accepted in the main Xtables
+package.

-It superseded the earlier patch-o-matic(-ng) package in that no
-patching and/or recompilation of either the kernel or
-Xtables/iptables is required. However, do see the INSTALL file for
-the minimum requirements of Xtables-addons.
+Xtables-addons is different from patch-o-matic in that you do not
+have to patch or recompile either kernel or Xtables(iptables). But
+please see the INSTALL file for the minimum requirements of this
+package.
+
+All code imported from patch-o-matic has been reviewed and all
+apparent bugs like binary stability across multiarches, missing
+sanity checks and incorrect endianess handling have been fixed,
+simplified, and sped up.


 Included in this package
 ========================
 - xt_ACCOUNT 1.16, libxt_ACCOUNT 1.3
+
+
+Inclusion into a kernel tree
+============================
+
+
+
+
+External extensions
+===================
+
+The program "xa-download-more" can be used to download more
+extensions from 3rd parties into the source tree. The URLs are listed
+in the "sources" file. If the "sources" file contains an entry like
+
+	http://foobar.org/xa/
+
+xa-download-more will inspect http://foobar.org/xa/xa-index.txt for
+files to download. That file may contain
+
+	foobar.tar.bz2
+
+and xa-download-more will then retrieve and unpack
+http://foobar.org/xa/foobar.tar.bz2.
+
+Files that should be contained in the tarball are an mconfig and
+Kbuild files to control building the extension, libxt_foobar.c for
+the userspace extension and xt_foobar.c for the kernel extension.
+
+	mconfig.foobar
+	extensions/Kbuild.foobar
+	extensions/Mbuild.foobar
+	extensions/libxt_foobar.c
+	extensions/libxt_foobar.man
+	extensions/xt_foobar.c
+	extensions/xt_foobar.h
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([xtables-addons], [3.11])
+AC_INIT([xtables-addons], [2.15])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -26,8 +26,8 @@ fi

 AC_CHECK_HEADERS([linux/netfilter/x_tables.h], [],
 	[AC_MSG_ERROR([You need to have linux/netfilter/x_tables.h, see INSTALL file for details])])
-PKG_CHECK_MODULES([libxtables], [xtables >= 1.6.0])
-xtlibdir="$($PKG_CONFIG --variable=xtlibdir xtables)"
+PKG_CHECK_MODULES([libxtables], [xtables >= 1.4.5])
+xtlibdir="$(pkg-config --variable=xtlibdir xtables)"

 AC_ARG_WITH([xtlibdir],
 	AS_HELP_STRING([--with-xtlibdir=PATH],
@@ -57,12 +57,12 @@ if test -n "$kbuilddir"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 5 -o "$kmajor" -eq 5 -a "$kminor" -gt 9; then
+		if test "$kmajor" -gt 4 -o "$kmajor" -eq 4 -a "$kminor" -gt 12; then
 			echo "WARNING: That kernel version is not officially supported yet. Continue at own luck.";
-		elif test "$kmajor" -eq 5 -a "$kminor" -ge 0; then
-			:
-		elif test "$kmajor" -eq 4 -a "$kminor" -ge 15; then
-			:
+		elif test "$kmajor" -eq 4 -a "$kminor" -le 10; then
+			:;
+		elif test "$kmajor" -eq 3 -a "$kminor" -ge 7; then
+			:;
 		else
 			echo "WARNING: That kernel version is not officially supported.";
 		fi;
--- a/doc/changelog.txt
+++ b/doc/changelog.txt
@@ -1,76 +1,9 @@
-v3.11 (2020-09-06)
+
+v2.15 (2021-02-05)
 ==================
- Support for up to Linux 5.9
-
-
-v3.10 (2020-07-28)
-==================
- Support for up to Linux 5.8
-
-
-v3.9 (2020-02-25)
-=================
- Support for Linux 5.6 procfs changes
-
-
-v3.8 (2020-02-03)
-=================
- Support for Linux 5.5
- xt_geoip_build now expects the DBIP format as input,
-  Maxmind is thrown out.
-
-
-v3.7 (2019-12-01)
-=================
-Fixes:
- xt_geoip: fix in6_addr little-endian byte swapping
-
-
-v3.6 (2019-11-20)
-=================
 Enhancements:
- support for up to Linux 5.4
-
-
-v3.5 (2019-09-10)
-=================
-Enhancements:
- xt_DELUDE, xt_TARPIT: added additional code needed to work with
-  bridges from Linux 5.0 onwards.
-
-
-v3.4 (2019-09-06)
-=================
-Enhancements:
- support for up to Linux 5.3
- xt_PROTO module
-
-
-v3.3 (2019-03-07)
-=================
-Enhancements:
- support for Linux 5.0
-
-
-v3.2 (2018-09-07)
-=================
-Changes:
- rework xt_geoip_build to scan the immediate directory for .csv,
-  not to scan for GeoLite2-Country-CSV_\d+.
-
-
-v3.1 (2018-08-14)
-=================
-Enhancements:
- support for Linux 4.17, 4.18
-
-
-v3.0 (2018-02-12)
-=================
-Enhancements:
- support for Linux 4.15, 4.16
-Changes:
- remove support for Linux 3.7--4.14
+- support for Linux up to 4.15
+- xt_lscan: add --mirai option


 v2.14 (2017-11-22)
@@ -197,5 +130,5 @@ Changes:
 Enhancements:
 - Support for Linux 3.7

-If you want to use Xtables-addons with kernels older than 4.15,
-use the addons 2.x series.
+If you want to use Xtables-addons with kernels older than 3.7,
+use the addons 1.x series (maintained but without new features).
--- a/extensions/ACCOUNT/xt_ACCOUNT.c
+++ b/extensions/ACCOUNT/xt_ACCOUNT.c
@@ -28,9 +28,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/string.h>
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 9, 0)
-#include <linux/sockptr.h>
-#endif
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
 #include <net/netns/generic.h>
@@ -43,9 +40,6 @@
 #error "ipt_ACCOUNT needs at least a PAGE_SIZE of 4096"
 #endif

-static unsigned int max_tables_limit = 128;
-module_param(max_tables_limit, uint, 0);
-
 /**
 * Internal table structure, generated by check_entry()
 * @name:	name of the table
@@ -191,7 +185,7 @@ static int ipt_acc_table_insert(struct ipt_acc_table *ipt_acc_tables,
 		name, NIPQUAD(ip), NIPQUAD(netmask));

 	/* Look for existing table */
-	for (i = 0; i < max_tables_limit; i++) {
+	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
 		if (strncmp(ipt_acc_tables[i].name, name,
 		    ACCOUNT_TABLE_NAME_LEN) == 0) {
 			pr_debug("ACCOUNT: Found existing slot: %d - "
@@ -215,7 +209,7 @@ static int ipt_acc_table_insert(struct ipt_acc_table *ipt_acc_tables,
 	}

 	/* Insert new table */
-	for (i = 0; i < max_tables_limit; i++) {
+	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
 		/* Found free slot */
 		if (ipt_acc_tables[i].name[0] == 0) {
 			unsigned int netsize = 0;
@@ -264,7 +258,7 @@ static int ipt_acc_table_insert(struct ipt_acc_table *ipt_acc_tables,

 	/* No free slot found */
 	printk("ACCOUNT: No free table slot found (max: %d). "
-		"Please increase the \"max_tables_limit\" module parameter.\n", max_tables_limit);
+		"Please increase ACCOUNT_MAX_TABLES.\n", ACCOUNT_MAX_TABLES);
 	return -1;
 }

@@ -305,7 +299,7 @@ static void ipt_acc_destroy(const struct xt_tgdtor_param *par)
 	info->table_nr = -1;	/* Set back to original state */

 	/* Look for table */
-	for (i = 0; i < max_tables_limit; i++) {
+	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
 		if (strncmp(ian->ipt_acc_tables[i].name, info->table_name,
 		    ACCOUNT_TABLE_NAME_LEN) == 0) {
 			pr_debug("ACCOUNT: Found table at slot: %d\n", i);
@@ -488,7 +482,16 @@ static void ipt_acc_depth2_insert(struct ipt_acc_mask_8 *mask_8,
 static unsigned int
 ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	struct ipt_acc_net *ian = net_generic(par->state->net, ipt_acc_net_id);
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0)
+	struct ipt_acc_net *ian = net_generic(par->net, ipt_acc_net_id);
+#else
+	struct net *net = dev_net(par->in ? par->in : par->out);
+	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
+#endif
+#endif
 	struct ipt_acc_table *ipt_acc_tables = ian->ipt_acc_tables;
 	const struct ipt_acc_info *info =
 		par->targinfo;
@@ -610,12 +613,12 @@ static int ipt_acc_handle_prepare_read(struct ipt_acc_table *ipt_acc_tables,
 	int table_nr = -1;
 	uint8_t depth;

-	for (table_nr = 0; table_nr < max_tables_limit; table_nr++)
+	for (table_nr = 0; table_nr < ACCOUNT_MAX_TABLES; table_nr++)
 		if (strncmp(ipt_acc_tables[table_nr].name, tablename,
 		    ACCOUNT_TABLE_NAME_LEN) == 0)
 			break;

-	if (table_nr == max_tables_limit) {
+	if (table_nr == ACCOUNT_MAX_TABLES) {
 		printk("ACCOUNT: ipt_acc_handle_prepare_read(): "
 			"Table %s not found\n", tablename);
 		return -1;
@@ -713,12 +716,12 @@ static int ipt_acc_handle_prepare_read_flush(struct ipt_acc_table *ipt_acc_table
 	int table_nr;
 	void *new_data_page;

-	for (table_nr = 0; table_nr < max_tables_limit; table_nr++)
+	for (table_nr = 0; table_nr < ACCOUNT_MAX_TABLES; table_nr++)
 		if (strncmp(ipt_acc_tables[table_nr].name, tablename,
 		    ACCOUNT_TABLE_NAME_LEN) == 0)
 			break;

-	if (table_nr == max_tables_limit) {
+	if (table_nr == ACCOUNT_MAX_TABLES) {
 		printk("ACCOUNT: ipt_acc_handle_prepare_read_flush(): "
 			"Table %s not found\n", tablename);
 		return -1;
@@ -882,12 +885,7 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 }

 static int ipt_acc_set_ctl(struct sock *sk, int cmd,
-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 9, 0)
-			   void *user,
-#else
-			   sockptr_t arg,
-#endif
-			   unsigned int len)
+			void *user, unsigned int len)
 {
 	struct net *net = sock_net(sk);
 	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
@@ -906,12 +904,7 @@ static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 			break;
 		}

-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 9, 0)
-		if (copy_from_user(&handle, user, len))
-#else
-		if (copy_from_sockptr(&handle, arg, len))
-#endif
-		{
+		if (copy_from_user(&handle, user, len)) {
 			printk("ACCOUNT: ipt_acc_set_ctl: copy_from_user failed for "
 				"IPT_SO_SET_HANDLE_FREE\n");
 			break;
@@ -1068,7 +1061,7 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 		spin_lock_bh(&ian->ipt_acc_lock);

 		/* Determine size of table names */
-		for (i = 0; i < max_tables_limit; i++) {
+		for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
 			if (ian->ipt_acc_tables[i].name[0] != 0)
 				size += strlen(ian->ipt_acc_tables[i].name) + 1;
 		}
@@ -1083,7 +1076,7 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 		}
 		/* Copy table names to userspace */
 		tnames = ian->ipt_acc_tmpbuf;
-		for (i = 0; i < max_tables_limit; i++) {
+		for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
 			if (ian->ipt_acc_tables[i].name[0] != 0) {
 				name_len = strlen(ian->ipt_acc_tables[i].name) + 1;
 				memcpy(tnames, ian->ipt_acc_tables[i].name, name_len);
@@ -1116,7 +1109,7 @@ static int __net_init ipt_acc_net_init(struct net *net)
 	memset(ian, 0, sizeof(*ian));
 	sema_init(&ian->ipt_acc_userspace_mutex, 1);

-	ian->ipt_acc_tables = kcalloc(max_tables_limit,
+	ian->ipt_acc_tables = kcalloc(ACCOUNT_MAX_TABLES,
 		sizeof(struct ipt_acc_table), GFP_KERNEL);
 	if (ian->ipt_acc_tables == NULL) {
 		printk("ACCOUNT: Out of memory allocating account_tables structure");
--- a/extensions/ACCOUNT/xt_ACCOUNT.h
+++ b/extensions/ACCOUNT/xt_ACCOUNT.h
@@ -34,6 +34,7 @@
 #define IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES (SO_ACCOUNT_BASE_CTL + 8)
 #define IPT_SO_GET_ACCOUNT_MAX	  IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES

+#define ACCOUNT_MAX_TABLES 128
 #define ACCOUNT_TABLE_NAME_LEN 32
 #define ACCOUNT_MAX_HANDLES 10

--- a/extensions/Kbuild
+++ b/extensions/Kbuild
@@ -13,7 +13,6 @@ obj-${build_DNETMAP}     += xt_DNETMAP.o
 obj-${build_ECHO}        += xt_ECHO.o
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
-obj-${build_PROTO}       += xt_PROTO.o
 obj-${build_SYSRQ}       += xt_SYSRQ.o
 obj-${build_TARPIT}      += xt_TARPIT.o
 obj-${build_condition}   += xt_condition.o
--- a/extensions/Mbuild
+++ b/extensions/Mbuild
@@ -8,7 +8,6 @@ obj-${build_DNETMAP}     += libxt_DNETMAP.so
 obj-${build_ECHO}        += libxt_ECHO.so
 obj-${build_IPMARK}      += libxt_IPMARK.so
 obj-${build_LOGMARK}     += libxt_LOGMARK.so
-obj-${build_PROTO}       += libxt_PROTO.so
 obj-${build_SYSRQ}       += libxt_SYSRQ.so
 obj-${build_TARPIT}      += libxt_TARPIT.so
 obj-${build_condition}   += libxt_condition.so
--- a/extensions/compat_xtables.h
+++ b/extensions/compat_xtables.h
@@ -8,8 +8,12 @@

 #define DEBUGP Use__pr_debug__instead

-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
-#	warning Kernels below 4.15 not supported.
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 7, 0)
+#	warning Kernels below 3.7 not supported.
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 8, 0)
+#	define prandom_u32() random32()
 #endif

 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
@@ -42,22 +46,55 @@
 #	define NIPQUAD_FMT "%hhu.%hhu.%hhu.%hhu"
 #endif

+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 9, 0)
+static inline struct inode *file_inode(struct file *f)
+{
+	return f->f_path.dentry->d_inode;
+}
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 10, 0)
+static inline void proc_set_user(struct proc_dir_entry *de,
+    typeof(de->uid) uid, typeof(de->gid) gid)
+{
+	de->uid = uid;
+	de->gid = gid;
+}
+
+static inline void *PDE_DATA(struct inode *inode)
+{
+	return PDE(inode)->data;
+}
+
+static inline void proc_remove(struct proc_dir_entry *de)
+{
+	if (de != NULL)
+		remove_proc_entry(de->name, de->parent);
+}
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 4, 0)
+#	define ip6_local_out(xnet, xsk, xskb) ip6_local_out(xskb)
+#	define ip6_route_me_harder(xnet, xskb) ip6_route_me_harder(xskb)
+#	define ip_local_out(xnet, xsk, xskb) ip_local_out(xskb)
+#	define ip_route_me_harder(xnet, xskb, xaddrtype) ip_route_me_harder((xskb), (xaddrtype))
+#endif
+
 static inline struct net *par_net(const struct xt_action_param *par)
 {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 10, 0)
 	return par->state->net;
+#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
+	return par->net;
+#else
+	return dev_net((par->in != NULL) ? par->in : par->out);
+#endif
+#endif
 }

 #ifndef NF_CT_ASSERT
 #	define NF_CT_ASSERT(x)	WARN_ON(!(x))
 #endif

-#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 6, 0)
-#	define proc_ops file_operations
-#	define proc_open open
-#	define proc_read read
-#	define proc_write write
-#	define proc_lseek llseek
-#	define proc_release release
-#endif
-
 #endif /* _XTABLES_COMPAT_H */
--- a/extensions/libxt_DNETMAP.man
+++ b/extensions/libxt_DNETMAP.man
@@ -46,7 +46,7 @@ Contains the binding table for the given \fIsubnet/mask\fP. Each line contains
 \fBprenat address\fR, \fBpostnat address\fR, \fBttl\fR (seconds until the entry
 times out), \fBlasthit\fR (last hit to the entry in seconds relative to system
 boot time). Please note that the \fBttl\fR and \fBlasthit\fR entries contain an
-\(oq\fBS\fR\(cq in case of a static binding.
+'\fBS\fR' in case of a static binding.
 .TP
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
 Contains statistics for a given \fIsubnet/mask\fP. The line contains four
--- a/extensions/libxt_PROTO.c
+++ b/extensions/libxt_PROTO.c
@@ -1,105 +0,0 @@
-/*
- * PROTO Target module
- * This program is distributed under the terms of GNU GPL
- */
-#include <stdio.h>
-#include <xtables.h>
-#include "xt_PROTO.h"
-
-enum {
-	O_PROTO_SET = 0,
-	O_PROTO_STOP_AT_FRAG = 1,
-	O_PROTO_STOP_AT_AUTH = 2,
-	F_PROTO_SET = 1 << O_PROTO_SET,
-	F_PROTO_STOP_AT_FRAG = 1 << O_PROTO_STOP_AT_FRAG,
-	F_PROTO_STOP_AT_AUTH = 1 << O_PROTO_STOP_AT_AUTH,
-};
-
-#define s struct xt_PROTO_info
-static const struct xt_option_entry PROTO_opts[] = {
-	{.name = "proto-set", .type = XTTYPE_UINT8, .id = O_PROTO_SET,
-	 .flags = XTOPT_PUT | XTOPT_MAND, XTOPT_POINTER(s, proto)},
-	{.name = "stop-at-frag", .type = XTTYPE_NONE, .id = O_PROTO_STOP_AT_FRAG},
-	{.name = "stop-at-auth", .type = XTTYPE_NONE, .id = O_PROTO_STOP_AT_AUTH},
-	XTOPT_TABLEEND,
-};
-#undef s
-
-static void PROTO_help(void)
-{
-	printf(
-"PROTO target options\n"
-"  --proto-set value		Set protocol to <value 0-255>\n"
-	);
-}
-
-static void PROTO_parse(struct xt_option_call *cb)
-{
-	struct xt_PROTO_info *info = cb->data;
-
-	xtables_option_parse(cb);
-	switch (cb->entry->id) {
-	case O_PROTO_SET:
-		info->mode |= 1 << XT_PROTO_SET;
-		break;
-	case O_PROTO_STOP_AT_FRAG:
-		info->mode |= 1 << XT_PROTO_STOP_AT_FRAG;
-		break;
-	case O_PROTO_STOP_AT_AUTH:
-		info->mode |= 1 << XT_PROTO_STOP_AT_AUTH;
-		break;
-	}
-}
-
-static void PROTO_check(struct xt_fcheck_call *cb)
-{
-	if (!(cb->xflags & F_PROTO_SET))
-		xtables_error(PARAMETER_PROBLEM,
-				"PROTO: You must specify the proto to be set");
-}
-
-static void PROTO_save(const void *ip, const struct xt_entry_target *target)
-{
-	const struct xt_PROTO_info *info = (void *)target->data;
-
-	if (info->mode & (1 << XT_PROTO_SET))
-		printf(" --proto-set %u", info->proto);
-	if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
-		printf(" --stop-at-frag");
-	if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
-		printf(" --stop-at-auth");
-}
-
-static void PROTO_print(const void *ip, const struct xt_entry_target *target,
-                     int numeric)
-{
-	const struct xt_PROTO_info *info = (void *)target->data;
-
-	printf(" PROTO ");
-	if (info->mode & (1 << XT_PROTO_SET))
-		printf("set to %u", info->proto);
-	if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
-		printf(" stop-at-frag");
-	if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
-		printf(" stop-at-auth");
-}
-
-static struct xtables_target proto_tg_reg = {
-	.name 		= "PROTO",
-	.version	= XTABLES_VERSION,
-	.family		= NFPROTO_UNSPEC,
-	.size		= XT_ALIGN(sizeof(struct xt_PROTO_info)),
-	.userspacesize	= XT_ALIGN(sizeof(struct xt_PROTO_info)),
-	.help		= PROTO_help,
-	.print		= PROTO_print,
-	.save		= PROTO_save,
-	.x6_parse	= PROTO_parse,
-	.x6_fcheck	= PROTO_check,
-	.x6_options	= PROTO_opts,
-};
-
-static __attribute__((constructor)) void _init(void)
-{
-	xtables_register_target(&proto_tg_reg);
-
-}
--- a/extensions/libxt_PROTO.man
+++ b/extensions/libxt_PROTO.man
@@ -1,30 +0,0 @@
-.PP
-The PROTO target modifies the protocol number in IP packet header.
-.TP
-\fB\-\-proto-set\fP \fIproto_num\fP
-This option is mandatory. \fIproto_num\fP is the protocol number to which you want to
-modify the packets.
-.TP
-\fB\-\-stop-at-frag\fP
-This option is only valid for IPv6 rules. When specifying this option, the
-fragment extension header will be seen as a non-extension header.
-.TP
-\fB\-\-stop-at-auth\fP
-This option is only valid for IPv6 rules. When specifying this option, the
-authentication extension header will be seen as a non-extension header.
-.PP
-For IPv4 packets, the \fBProtocol\fP field is modified and the checksum is
-re-calculated.
-.PP
-For IPv6 packets, the scenario can be more complex due to the introduction of
-the extension headers mechanism. By default, the PROTO target will scan the IPv6
-packet, finding the last extension header and modify its \fBNext-header\fP field.
-Normally, the following headers will be seen as an extension header:
-\fINEXTHDR_HOP\fP,
-\fINEXTHDR_ROUTING\fP,
-\fINEXTHDR_FRAGMENT\fP,
-\fINEXTHDR_AUTH\fP,
-\fINEXTHDR_DEST\fP.
-.PP
-For fragmented packets, only the first fragment is processed and other fragments
-are not touched.
--- a/extensions/libxt_geoip.c
+++ b/extensions/libxt_geoip.c
@@ -49,26 +49,6 @@ static struct option geoip_opts[] = {
 	{NULL},
 };

-#if __BYTE_ORDER == __LITTLE_ENDIAN
-static void geoip_swap_le32(uint32_t *buf)
-{
-	unsigned char *p = (void *)buf;
-	uint32_t n = p[0] + (p[1] << 8) + (p[2] << 16) + (p[3] << 24);
-	p[0] = (n >> 24) & 0xff;
-	p[1] = (n >> 16) & 0xff;
-	p[2] = (n >> 8) & 0xff;
-	p[3] = n & 0xff;
-}
-
-static void geoip_swap_in6(struct in6_addr *in6)
-{
-	geoip_swap_le32(&in6->s6_addr32[0]);
-	geoip_swap_le32(&in6->s6_addr32[1]);
-	geoip_swap_le32(&in6->s6_addr32[2]);
-	geoip_swap_le32(&in6->s6_addr32[3]);
-}
-#endif
-
 static void *
 geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 {
@@ -76,15 +56,21 @@ geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 	struct stat sb;
 	char buf[256];
 	int fd;
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-	unsigned int n;
-#endif

 	/* Use simple integer vector files */
-	if (nfproto == NFPROTO_IPV6)
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/%s.iv6", code);
-	else
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/%s.iv4", code);
+	if (nfproto == NFPROTO_IPV6) {
+#if __BYTE_ORDER == _BIG_ENDIAN
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv6", code);
+#else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv6", code);
+#endif
+	} else {
+#if __BYTE_ORDER == _BIG_ENDIAN
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv4", code);
+#else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv4", code);
+#endif
+	}

 	if ((fd = open(buf, O_RDONLY)) < 0) {
 		fprintf(stderr, "Could not open %s: %s\n", buf, strerror(errno));
@@ -112,25 +98,6 @@ geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 		xtables_error(OTHER_PROBLEM, "geoip: insufficient memory");
 	read(fd, subnets, sb.st_size);
 	close(fd);
-
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-	for (n = 0; n < *count; ++n) {
-		switch (nfproto) {
-		case NFPROTO_IPV6: {
-			struct geoip_subnet6 *gs6 = &(((struct geoip_subnet6 *)subnets)[n]);
-			geoip_swap_in6(&gs6->begin);
-			geoip_swap_in6(&gs6->end);
-			break;
-		}
-		case NFPROTO_IPV4: {
-			struct geoip_subnet4 *gs4 = &(((struct geoip_subnet4 *)subnets)[n]);
-			geoip_swap_le32(&gs4->begin);
-			geoip_swap_le32(&gs4->end);
-			break;
-		}
-		}
-	}
-#endif
 	return subnets;
 }

@@ -168,7 +135,7 @@ check_geoip_cc(char *cc, u_int16_t cc_used[], u_int8_t count)
 			cc[i] = toupper(cc[i]);
 		else
 			xtables_error(PARAMETER_PROBLEM,
-				"geoip: invalid country code '%s'", cc);
+				"geoip:  invalid country code '%s'", cc);

 	/* Convert chars into a single 16 bit integer.
 	 * FIXME:	This assumes that a country code is
--- a/extensions/libxt_lscan.c
+++ b/extensions/libxt_lscan.c
@@ -24,6 +24,7 @@ static const struct option lscan_mt_opts[] = {
 	{.name = "synscan", .has_arg = false, .val = 's'},
 	{.name = "cnscan",  .has_arg = false, .val = 'c'},
 	{.name = "grscan",  .has_arg = false, .val = 'g'},
+	{.name = "mirai",   .has_arg = false, .val = 'm'},
 	{NULL},
 };

@@ -35,7 +36,8 @@ static void lscan_mt_help(void)
 		"  --stealth    Match TCP Stealth packets\n"
 		"  --synscan    Match TCP SYN scans\n"
 		"  --cnscan     Match TCP Connect scans\n"
-		"  --grscan     Match Banner Grabbing scans\n");
+		"  --grscan     Match Banner Grabbing scans\n"
+		"  --mirai      Match TCP scan with ISN = dest. IP\n");
 }

 static int lscan_mt_parse(int c, char **argv, int invert,
@@ -45,16 +47,19 @@ static int lscan_mt_parse(int c, char **argv, int invert,

 	switch (c) {
 	case 'c':
-		info->match_cn = true;
+		info->match_fl3 |= LSCAN_FL3_CN;
 		return true;
 	case 'g':
-		info->match_gr = true;
+		info->match_fl4 |= LSCAN_FL4_GR;
+		return true;
+	case 'm':
+		info->match_fl1 |= LSCAN_FL1_MIRAI;
 		return true;
 	case 's':
-		info->match_syn = true;
+		info->match_fl2 |= LSCAN_FL2_SYN;
 		return true;
 	case 'x':
-		info->match_stealth = true;
+		info->match_fl1 |= LSCAN_FL1_STEALTH;
 		return true;
 	}
 	return false;
@@ -68,14 +73,16 @@ static void lscan_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_lscan_mtinfo *info = (const void *)(match->data);

-	if (info->match_stealth)
+	if (info->match_fl1 & LSCAN_FL1_STEALTH)
 		printf(" --stealth ");
-	if (info->match_syn)
+	if (info->match_fl2 & LSCAN_FL2_SYN)
 		printf(" --synscan ");
-	if (info->match_cn)
+	if (info->match_fl3 & LSCAN_FL3_CN)
 		printf(" --cnscan ");
-	if (info->match_gr)
+	if (info->match_fl4 & LSCAN_FL4_GR)
 		printf(" --grscan ");
+	if (info->match_fl1 & LSCAN_FL1_MIRAI)
+		printf(" --mirai ");
 }

 static void lscan_mt_print(const void *ip,
--- a/extensions/libxt_lscan.man
+++ b/extensions/libxt_lscan.man
@@ -27,6 +27,11 @@ warranted single-direction data flows, usually bulk data transfers such as
 FTP DATA connections or IRC DCC. Grab Scan Detection should only be used on
 ports where a protocol runs that is guaranteed to do a bidirectional exchange
 of bytes.
+.TP
+\fB\-\-mirai\fP
+Match if the TCP ISN is equal to the IPv4 destination address; this is used
+by the devices in the Mirai botnet as a form of TCP SYN scan, so you will
+have to explicitly specify --syn for the rule.
 .PP
 NOTE: Some clients (Windows XP for example) may do what looks like a SYN scan,
 so be advised to carefully use xt_lscan in conjunction with blocking rules,
--- a/extensions/pknock/Makefile.am
+++ b/extensions/pknock/Makefile.am
@@ -5,4 +5,4 @@ AM_CFLAGS   = ${regular_CFLAGS} ${libxtables_CFLAGS}

 include ../../Makefile.extra

-sbin_PROGRAMS = pknlusr
+noinst_PROGRAMS = pknlusr
--- a/extensions/pknock/xt_pknock.c
+++ b/extensions/pknock/xt_pknock.c
@@ -295,11 +295,12 @@ pknock_proc_open(struct inode *inode, struct file *file)
 	return ret;
 }

-static const struct proc_ops pknock_proc_ops = {
-	.proc_open    = pknock_proc_open,
-	.proc_read    = seq_read,
-	.proc_lseek   = seq_lseek,
-	.proc_release = seq_release,
+static const struct file_operations pknock_proc_ops = {
+	.owner = THIS_MODULE,
+	.open = pknock_proc_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = seq_release
 };

 /**
@@ -356,10 +357,18 @@ has_logged_during_this_minute(const struct peer *peer)
 *
 * @r: rule
 */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
 static void peer_gc(struct timer_list *tl)
+#else
+static void peer_gc(unsigned long r)
+#endif
 {
 	unsigned int i;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
 	struct xt_pknock_rule *rule = from_timer(rule, tl, timer);
+#else
+	struct xt_pknock_rule *rule = (struct xt_pknock_rule *)r;
+#endif
 	struct peer *peer;
 	struct list_head *pos, *n;

@@ -466,7 +475,15 @@ add_rule(struct xt_pknock_mtinfo *info)
 	rule->peer_head      = alloc_hashtable(peer_hashsize);
 	if (rule->peer_head == NULL)
 		goto out;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 15, 0)
 	timer_setup(&rule->timer, peer_gc, 0);
+#else
+	init_timer(&rule->timer);
+	rule->timer.function	= peer_gc;
+	rule->timer.data	= (unsigned long)rule;
+#endif
+
 	rule->status_proc = proc_create_data(info->rule_name, 0, pde,
 	                    &pknock_proc_ops, rule);
 	if (rule->status_proc == NULL)
@@ -693,7 +710,13 @@ msg_to_userspace_nl(const struct xt_pknock_mtinfo *info,
 	scnprintf(msg.rule_name, info->rule_name_len + 1, info->rule_name);

 	memcpy(m + 1, &msg, m->len);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 15, 0)
 	cn_netlink_send(m, 0, multicast_group, GFP_ATOMIC);
+#else
+	cn_netlink_send(m, multicast_group, GFP_ATOMIC);
+#endif
+
 	kfree(m);
 #endif
 	return true;
@@ -1124,6 +1147,7 @@ static int __init xt_pknock_mt_init(void)

 	crypto.size = crypto_shash_digestsize(crypto.tfm);
 	crypto.desc.tfm = crypto.tfm;
+	crypto.desc.flags = 0;

 	pde = proc_mkdir("xt_pknock", init_net.proc_net);
 	if (pde == NULL) {
--- a/extensions/xt_CHAOS.c
+++ b/extensions/xt_CHAOS.c
@@ -58,7 +58,12 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)

 	{
 		struct xt_action_param local_par;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 		local_par.state    = par->state;
+#else
+		local_par.in        = par->in,
+		local_par.out       = par->out,
+#endif
 		local_par.match     = xm_tcp;
 		local_par.matchinfo = &tcp_params;
 		local_par.fragoff   = fragoff;
@@ -73,7 +78,14 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
 	destiny = (info->variant == XTCHAOS_TARPIT) ? xt_tarpit : xt_delude;
 	{
 		struct xt_action_param local_par;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 		local_par.state    = par->state;
+#else
+		local_par.in       = par->in;
+		local_par.out      = par->out;
+		local_par.hooknum  = par->hooknum;
+		local_par.family   = par->family;
+#endif
 		local_par.target   = destiny;
 		local_par.targinfo = par->targinfo;
 		destiny->target(skb, &local_par);
@@ -96,15 +108,27 @@ chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)

 	if ((unsigned int)prandom_u32() <= reject_percentage) {
 		struct xt_action_param local_par;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 		local_par.state    = par->state;
+#else
+		local_par.in       = par->in;
+		local_par.out      = par->out;
+		local_par.hooknum  = par->hooknum;
+#endif
 		local_par.target   = xt_reject;
 		local_par.targinfo = &reject_params;
 		return xt_reject->target(skb, &local_par);
 	}

 	/* TARPIT/DELUDE may not be called from the OUTPUT chain */
-	if (iph->protocol == IPPROTO_TCP && info->variant != XTCHAOS_NORMAL &&
-	    par->state->hook != NF_INET_LOCAL_OUT)
+	if (iph->protocol == IPPROTO_TCP &&
+	    info->variant != XTCHAOS_NORMAL &&
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
+	    par->state->hook
+#else
+	    par->hooknum
+#endif
+	    != NF_INET_LOCAL_OUT)
 		xt_chaos_total(skb, par);

 	return NF_DROP;
--- a/extensions/xt_DELUDE.c
+++ b/extensions/xt_DELUDE.c
@@ -107,12 +107,12 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,

 	addr_type = RTN_UNSPEC;
 #ifdef CONFIG_BRIDGE_NETFILTER
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
-	if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
-	    ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
-#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
 	    nskb->nf_bridge->physoutdev))
+#else
+	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
+	    nskb->nf_bridge->mask & BRNF_BRIDGED))
 #endif
 #else
 	if (hook != NF_INET_FORWARD)
@@ -151,7 +151,13 @@ delude_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	 * a problem, as that is supported since Linux 2.6.35. But since we do not
 	 * actually want to have a connection open, we are still going to drop it.
 	 */
-	delude_send_reset(par_net(par), skb, par->state->hook);
+	delude_send_reset(par_net(par), skb,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
+	                  par->state->hook
+#else
+	                  par->hooknum
+#endif
+	                  );
 	return NF_DROP;
 }

--- a/extensions/xt_DHCPMAC.c
+++ b/extensions/xt_DHCPMAC.c
@@ -96,8 +96,7 @@ dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	struct udphdr udpbuf, *udph;
 	unsigned int i;

-	if (skb_ensure_writable(skb, ip_hdrlen(skb) + sizeof(udpbuf) +
-				     sizeof(dhcpbuf)))
+	if (!skb_make_writable(skb, 0))
 		return NF_DROP;

 	udph = skb_header_pointer(skb, ip_hdrlen(skb),
--- a/extensions/xt_DNETMAP.c
+++ b/extensions/xt_DNETMAP.c
@@ -115,7 +115,7 @@ static DEFINE_SPINLOCK(dnetmap_lock);
 static DEFINE_MUTEX(dnetmap_mutex);

 #ifdef CONFIG_PROC_FS
-static const struct proc_ops dnetmap_tg_fops, dnetmap_stat_proc_fops;
+static const struct file_operations dnetmap_tg_fops, dnetmap_stat_proc_fops;
 #endif

 static inline unsigned int dnetmap_entry_hash(const __be32 addr)
@@ -356,22 +356,26 @@ out:
 static unsigned int
 dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	struct net *net = dev_net(par->state->in ? par->state->in : par->state->out);
+#else
+	struct net *net = dev_net(par->in ? par->in : par->out);
+#endif
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	__be32 prenat_ip, postnat_ip, prenat_ip_prev;
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
 	const struct nf_nat_range *mr = &tginfo->prefix;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 18, 0)
-	struct nf_nat_range2 newrange;
-#else
 	struct nf_nat_range newrange;
-#endif
 	struct dnetmap_entry *e;
 	struct dnetmap_prefix *p;
 	__s32 jttl;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	unsigned int hooknum = par->state->hook;
+#else
+	unsigned int hooknum = par->hooknum;
+#endif
 	ct = nf_ct_get(skb, &ctinfo);

 	jttl = tginfo->flags & XT_DNETMAP_TTL ? tginfo->ttl * HZ : jtimeout;
@@ -496,7 +500,12 @@ bind_new_prefix:
 	newrange.max_addr.ip = postnat_ip;
 	newrange.min_proto = mr->min_proto;
 	newrange.max_proto = mr->max_proto;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->state->hook));
+#else
+	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
+#endif
+
 no_rev_map:
 no_free_ip:
 	spin_unlock_bh(&dnetmap_lock);
@@ -768,11 +777,12 @@ dnetmap_tg_proc_write(struct file *file, const char __user *input,size_t size, l
 }


-static const struct proc_ops dnetmap_tg_fops = {
-	.proc_open    = dnetmap_seq_open,
-	.proc_read    = seq_read,
-	.proc_write   = dnetmap_tg_proc_write,
-	.proc_release = seq_release_private,
+static const struct file_operations dnetmap_tg_fops = {
+	.open = dnetmap_seq_open,
+	.read = seq_read,
+	.write   = dnetmap_tg_proc_write,
+	.release = seq_release_private,
+	.owner = THIS_MODULE,
 };

 /* for statistics */
@@ -816,11 +826,11 @@ static int dnetmap_stat_proc_open(struct inode *inode, struct file *file)
 	return single_open(file, dnetmap_stat_proc_show, PDE_DATA(inode));
 }

-static const struct proc_ops dnetmap_stat_proc_fops = {
-	.proc_open    = dnetmap_stat_proc_open,
-	.proc_read    = seq_read,
-	.proc_lseek   = seq_lseek,
-	.proc_release = single_release,
+static const struct file_operations dnetmap_stat_proc_fops = {
+	.open    = dnetmap_stat_proc_open,
+	.read    = seq_read,
+	.llseek  = seq_lseek,
+	.release = single_release,
 };

 static int __net_init dnetmap_proc_net_init(struct net *net)
--- a/extensions/xt_ECHO.c
+++ b/extensions/xt_ECHO.c
@@ -35,7 +35,11 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	void *payload;
 	struct flowi6 fl;
 	struct dst_entry *dst = NULL;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	struct net *net = dev_net((par->state->in != NULL) ? par->state->in : par->state->out);
+#else
+	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
+#endif

 	/* This allows us to do the copy operation in fewer lines of code. */
 	if (skb_linearize(oldskb) < 0)
--- a/extensions/xt_LOGMARK.c
+++ b/extensions/xt_LOGMARK.c
@@ -64,7 +64,12 @@ static void logmark_ct(const struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 		printk("%s""CONFIRMED", prev ? "," : "");
 		prev = true;
 	}
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,9,0)
 	printk(" lifetime=%lus", nf_ct_expires(ct) / HZ);
+#else
+	printk(" lifetime=%lus",
+	       (jiffies - ct->timeout.expires) / HZ);
+#endif
 }

 static unsigned int
@@ -77,13 +82,21 @@ logmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	printk("<%u>%.*s""iif=%d hook=%s nfmark=0x%x "
 	       "secmark=0x%x classify=0x%x",
 	       info->level, (unsigned int)sizeof(info->prefix), info->prefix,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	       skb_ifindex(skb), hook_names[par->state->hook],
+#else
+	       skb_ifindex(skb), hook_names[par->hooknum],
+#endif
 	       skb_nfmark(skb), skb_secmark(skb), skb->priority);

 	ct = nf_ct_get(skb, &ctinfo);
 	printk(" ctdir=%s", dir_names[ctinfo >= IP_CT_IS_REPLY]);
 	if (ct == NULL)
 		printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE");
+#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 12, 0)
+	else if (nf_ct_is_untracked(ct))
+		printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
+#endif
 	else
 		logmark_ct(ct, ctinfo);

--- a/extensions/xt_PROTO.c
+++ b/extensions/xt_PROTO.c
@@ -1,156 +0,0 @@
-/*
- * Protocol modification target for IP tables
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <net/ipv6.h>
-#include <net/checksum.h>
-#include <linux/netfilter/x_tables.h>
-#include "xt_PROTO.h"
-
-MODULE_AUTHOR("Shanker Wang <i@innull.com>");
-MODULE_DESCRIPTION("Xtables: Protocol field modification target");
-MODULE_LICENSE("GPL");
-
-static unsigned int
-proto_tg(struct sk_buff *skb, const struct xt_action_param *par)
-{
-	struct iphdr *iph;
-	const struct xt_PROTO_info *info = par->targinfo;
-	int new_proto;
-
-	if (skb_ensure_writable(skb, skb->len))
-		return NF_DROP;
-
-	iph = ip_hdr(skb);
-	new_proto = iph->protocol;
-	if (info->mode & (1 << XT_PROTO_SET))
-		new_proto = info->proto;
-	if (new_proto != iph->protocol) {
-		csum_replace2(&iph->check, htons(iph->protocol & 0xff),
-		              htons(new_proto & 0xff));
-		iph->protocol = new_proto;
-	}
-
-	return XT_CONTINUE;
-}
-
-static unsigned int
-proto_tg6(struct sk_buff *skb, const struct xt_action_param *par)
-{
-	struct ipv6hdr *ip6h;
-	const struct xt_PROTO_info *info = par->targinfo;
-	u8 *nexthdr;
-	unsigned int hdr_offset;
-	__be16 *fp;
-
-	if (skb_ensure_writable(skb, skb->len))
-		return NF_DROP;
-
-	ip6h = ipv6_hdr(skb);
-	nexthdr = &ip6h->nexthdr;
-	hdr_offset = sizeof(struct ipv6hdr);
-
-	for (;;) {
-		struct ipv6_opt_hdr _opthdr, *opthp;
-		unsigned int hdrlen;
-		unsigned short _frag_off;
-		if (!ipv6_ext_hdr(*nexthdr) || *nexthdr == NEXTHDR_NONE)
-			break;
-		opthp = skb_header_pointer(skb, skb_network_offset(skb) + hdr_offset, sizeof(_opthdr), &_opthdr);
-		if (!opthp)
-			return NF_DROP;
-		if (*nexthdr == NEXTHDR_FRAGMENT) {
-			if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
-				break;
-			fp = skb_header_pointer(skb, skb_network_offset(skb) +
-			     hdr_offset + offsetof(struct frag_hdr, frag_off),
-			     sizeof(_frag_off), &_frag_off);
-			if (!fp)
-				return NF_DROP;
-			_frag_off = ntohs(*fp) & ~0x7;
-			if (_frag_off) { // if the packet is not the first fragment
-				if (!ipv6_ext_hdr(opthp->nexthdr) || opthp->nexthdr == NEXTHDR_NONE ||
-				    (info->mode & (1 << XT_PROTO_STOP_AT_AUTH) && opthp->nexthdr == NEXTHDR_AUTH)) {
-					nexthdr = &((struct ipv6_opt_hdr *)(skb_network_header(skb) + hdr_offset))->nexthdr;
-					break;
-				} else {
-					return XT_CONTINUE;
-				}
-			}
-			hdrlen = 8;
-		} else if(*nexthdr == NEXTHDR_AUTH) {
-			if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
-				break;
-			hdrlen = (opthp->hdrlen + 2) << 2;
-		} else {
-			hdrlen = ipv6_optlen(opthp);
-		}
-		nexthdr = &((struct ipv6_opt_hdr *)(skb_network_header(skb) + hdr_offset))->nexthdr;
-		hdr_offset += hdrlen;
-	}
-	
-	if (info->mode & (1 << XT_PROTO_SET))
-		*nexthdr = info->proto;
-	return XT_CONTINUE;
-}
-
-static int proto_tg_check(const struct xt_tgchk_param *par)
-{
-	const struct xt_PROTO_info *info = par->targinfo;
-
-	if ((info->mode & (1 << XT_PROTO_SET)) == 0) {
-		pr_info_ratelimited("Did not specify any proto to set\n");
-		return -EINVAL;
-	}
-	if (par->family != NFPROTO_IPV6 && (info->mode & ((1 << XT_PROTO_STOP_AT_FRAG) | (1 << XT_PROTO_STOP_AT_AUTH))) != 0) {
-		pr_info_ratelimited("Must not specify stop-at-frag and stop-at-auth on non-ipv6 targets\n");
-		return -EPROTOTYPE;
-	}
-	return 0;
-}
-
-static struct xt_target proto_tg_reg[] __read_mostly = {
-	{
-		.name       = "PROTO",
-		.revision   = 0,
-		.family     = NFPROTO_IPV4,
-		.target     = proto_tg,
-		.targetsize = sizeof(struct xt_PROTO_info),
-		.table      = "mangle",
-		.checkentry = proto_tg_check,
-		.me         = THIS_MODULE,
-	},
-	{
-		.name       = "PROTO",
-		.revision   = 0,
-		.family     = NFPROTO_IPV6,
-		.target     = proto_tg6,
-		.targetsize = sizeof(struct xt_PROTO_info),
-		.table      = "mangle",
-		.checkentry = proto_tg_check,
-		.me         = THIS_MODULE,
-	},
-};
-
-static int __init proto_tg_init(void)
-{
-	return xt_register_targets(proto_tg_reg, ARRAY_SIZE(proto_tg_reg));
-}
-
-static void __exit proto_tg_exit(void)
-{
-	xt_unregister_targets(proto_tg_reg, ARRAY_SIZE(proto_tg_reg));
-}
-
-module_init(proto_tg_init);
-module_exit(proto_tg_exit);
-MODULE_ALIAS("ipt_PROTO");
-MODULE_ALIAS("ip6t_PROTO");
--- a/extensions/xt_PROTO.h
+++ b/extensions/xt_PROTO.h
@@ -1,20 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
-/* Protocol modification module for IP tables */
-
-#ifndef _XT_PROTO_H
-#define _XT_PROTO_H
-
-#include <linux/types.h>
-
-enum {
-	XT_PROTO_SET = 0,
-	XT_PROTO_STOP_AT_FRAG = 1,
-	XT_PROTO_STOP_AT_AUTH = 2
-};
-
-struct xt_PROTO_info {
-	__u8	mode;
-	__u8	proto;
-};
-
-#endif
--- a/extensions/xt_SYSRQ.c
+++ b/extensions/xt_SYSRQ.c
@@ -114,6 +114,7 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 	}

 	desc.tfm   = sysrq_tfm;
+	desc.flags = 0;
 	ret = crypto_shash_init(&desc);
 	if (ret != 0)
 		goto hash_fail;
@@ -313,7 +314,7 @@ static void sysrq_crypto_exit(void)
 static int __init sysrq_crypto_init(void)
 {
 #if defined(WITH_CRYPTO)
-	struct timespec64 now;
+	struct timeval now;
 	int ret;

 	sysrq_tfm = crypto_alloc_shash(sysrq_hash, 0, 0);
@@ -338,7 +339,7 @@ static int __init sysrq_crypto_init(void)
 		    sizeof(sysrq_password), GFP_KERNEL);
 	if (sysrq_digest_password == NULL)
 		goto fail;
-	ktime_get_real_ts64(&now);
+	do_gettimeofday(&now);
 	sysrq_seqno = now.tv_sec;
 	return 0;

--- a/extensions/xt_TARPIT.c
+++ b/extensions/xt_TARPIT.c
@@ -205,11 +205,7 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 		return;

 	/* This packet will not be the same as the other: clear nf fields */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
-	nf_reset_ct(nskb);
-#else
 	nf_reset(nskb);
-#endif
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
 	skb_shinfo(nskb)->gso_size = 0;
@@ -253,12 +249,12 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 		niph->id = ~oldhdr->id + 1;

 #ifdef CONFIG_BRIDGE_NETFILTER
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
-	if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
-	    ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
-#else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
 	    nskb->nf_bridge->physoutdev != NULL))
+#else
+	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
+	    nskb->nf_bridge->mask & BRNF_BRIDGED))
 #endif
 #else
 	if (hook != NF_INET_FORWARD)
@@ -287,8 +283,17 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 		goto free_nskb;

 	nf_ct_attach(nskb, oldskb);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
 	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
 		skb_dst(nskb)->dev, dst_output);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, nskb->sk, nskb, NULL,
+		skb_dst(nskb)->dev, dst_output_sk);
+#else
+	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, nskb, NULL,
+		skb_dst(nskb)->dev, dst_output);
+#endif
 	return;

 free_nskb:
@@ -350,11 +355,7 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 	}

 	/* This packet will not be the same as the other: clear nf fields */
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
-	nf_reset_ct(nskb);
-#else
 	nf_reset(nskb);
-#endif
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
 	skb_shinfo(nskb)->gso_size = 0;
@@ -405,8 +406,17 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 	nskb->ip_summed = CHECKSUM_NONE;

 	nf_ct_attach(nskb, oldskb);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
 	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
 	        skb_dst(nskb)->dev, dst_output);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
+	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb->sk, nskb, NULL,
+	        skb_dst(nskb)->dev, dst_output_sk);
+#else
+	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb, NULL,
+	        skb_dst(nskb)->dev, dst_output);
+#endif
 	return;

 free_nskb:
@@ -444,7 +454,12 @@ tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 	/* We are not interested in fragments */
 	if (iph->frag_off & htons(IP_OFFSET))
 		return NF_DROP;
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	tarpit_tcp4(par_net(par), skb, par->state->hook, info->variant);
+#else
+	tarpit_tcp4(par_net(par), skb, par->hooknum, info->variant);
+#endif
 	return NF_DROP;
 }

@@ -485,7 +500,12 @@ tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 		pr_debug("addr is not unicast.\n");
 		return NF_DROP;
 	}
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 	tarpit_tcp6(par_net(par), skb, par->state->hook, info->variant);
+#else
+	tarpit_tcp6(par_net(par), skb, par->hooknum, info->variant);
+#endif
 	return NF_DROP;
 }
 #endif
--- a/extensions/xt_condition.c
+++ b/extensions/xt_condition.c
@@ -111,12 +111,12 @@ condition_proc_write(struct file *file, const char __user *buffer,
 	return length;
 }

-static const struct proc_ops condition_proc_fops = {
-	.proc_open    = condition_proc_open,
-	.proc_read    = seq_read,
-	.proc_write   = condition_proc_write,
-	.proc_lseek   = seq_lseek,
-	.proc_release = single_release,
+static const struct file_operations condition_proc_fops = {
+	.open    = condition_proc_open,
+	.read    = seq_read,
+	.llseek  = seq_lseek,
+	.write   = condition_proc_write,
+	.release = single_release,
 };

 static bool
--- a/extensions/xt_iface.c
+++ b/extensions/xt_iface.c
@@ -45,9 +45,17 @@ static const struct net_device *iface_get(const struct xt_iface_mtinfo *info,
    const struct xt_action_param *par, struct net_device **put)
 {
 	if (info->flags & XT_IFACE_DEV_IN)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 		return par->state->in;
+#else
+		return par->in;
+#endif
 	else if (info->flags & XT_IFACE_DEV_OUT)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 		return par->state->out;
+#else
+		return par->out;
+#endif
 	return *put = dev_get_by_name(&init_net, info->ifname);
 }

--- a/extensions/xt_lscan.c
+++ b/extensions/xt_lscan.c
@@ -175,6 +175,7 @@ lscan_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
 	const struct xt_lscan_mtinfo *info = par->matchinfo;
 	enum ip_conntrack_info ctstate;
+	const struct iphdr *iph = ip_hdr(skb);
 	const struct tcphdr *tcph;
 	struct nf_conn *ctdata;
 	struct tcphdr tcph_buf;
@@ -182,10 +183,13 @@ lscan_mt(const struct sk_buff *skb, struct xt_action_param *par)
 	tcph = skb_header_pointer(skb, par->thoff, sizeof(tcph_buf), &tcph_buf);
 	if (tcph == NULL)
 		return false;
+	if (info->match_fl1 & LSCAN_FL1_MIRAI && iph != NULL &&
+	    iph->version == 4 && iph->daddr == tcph->seq)
+		return true;

 	/* Check for invalid packets: -m conntrack --ctstate INVALID */
 	if ((ctdata = nf_ct_get(skb, &ctstate)) == NULL) {
-		if (info->match_stealth)
+		if (info->match_fl1 & LSCAN_FL1_STEALTH)
 			return lscan_mt_stealth(tcph);
 		/*
 		 * If @ctdata is NULL, we cannot match the other scan
@@ -204,24 +208,30 @@ lscan_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		unsigned int n;

 		n = lscan_mt_full(ctdata->mark & connmark_mask, ctstate,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,10,0)
 		    par->state->in == init_net.loopback_dev, tcph,
+#else
+		    par->in == init_net.loopback_dev, tcph,
+#endif
 		    skb->len - par->thoff - 4 * tcph->doff);

 		ctdata->mark = (ctdata->mark & ~connmark_mask) | n;
 		skb_nfmark(skb) = (skb_nfmark(skb) & ~packet_mask) ^ mark_seen;
 	}

-	return (info->match_syn && ctdata->mark == mark_synscan) ||
-	       (info->match_cn && ctdata->mark == mark_cnscan) ||
-	       (info->match_gr && ctdata->mark == mark_grscan);
+	return (info->match_fl1 & LSCAN_FL1_STEALTH && ctdata->mark == mark_synscan) ||
+	       (info->match_fl3 & LSCAN_FL3_CN && ctdata->mark == mark_cnscan) ||
+	       (info->match_fl4 & LSCAN_FL4_GR && ctdata->mark == mark_grscan);
 }

 static int lscan_mt_check(const struct xt_mtchk_param *par)
 {
 	const struct xt_lscan_mtinfo *info = par->matchinfo;

-	if ((info->match_stealth & ~1) || (info->match_syn & ~1) ||
-	    (info->match_cn & ~1) || (info->match_gr & ~1)) {
+	if ((info->match_fl1 & ~(LSCAN_FL1_STEALTH | LSCAN_FL1_MIRAI)) ||
+	    (info->match_fl2 & ~LSCAN_FL2_SYN) ||
+	    (info->match_fl3 & ~LSCAN_FL3_CN) ||
+	    (info->match_fl4 & ~LSCAN_FL4_GR)) {
 		printk(KERN_WARNING PFX "Invalid flags\n");
 		return -EINVAL;
 	}
--- a/extensions/xt_lscan.h
+++ b/extensions/xt_lscan.h
@@ -1,8 +1,16 @@
 #ifndef _LINUX_NETFILTER_XT_LSCAN_H
 #define _LINUX_NETFILTER_XT_LSCAN_H 1

+enum {
+	LSCAN_FL1_STEALTH = 1 << 0,
+	LSCAN_FL1_MIRAI   = 1 << 1,
+	LSCAN_FL2_SYN     = 1 << 0,
+	LSCAN_FL3_CN      = 1 << 0,
+	LSCAN_FL4_GR      = 1 << 0,
+};
+
 struct xt_lscan_mtinfo {
-	uint8_t match_stealth, match_syn, match_cn, match_gr;
+	uint8_t match_fl1, match_fl2, match_fl3, match_fl4;
 };

 #endif /* _LINUX_NETFILTER_XT_LSCAN_H */
--- a/extensions/xt_quota2.c
+++ b/extensions/xt_quota2.c
@@ -117,12 +117,12 @@ quota_proc_write(struct file *file, const char __user *input,
 	return size;
 }

-static const struct proc_ops quota_proc_fops = {
-	.proc_open    = quota_proc_open,
-	.proc_read    = seq_read,
-	.proc_write   = quota_proc_write,
-	.proc_lseek   = seq_lseek,
-	.proc_release = single_release,
+static const struct file_operations quota_proc_fops = {
+	.open    = quota_proc_open,
+	.read    = seq_read,
+	.llseek  = seq_lseek,
+	.write   = quota_proc_write,
+	.release = single_release,
 };

 static struct xt_quota_counter *
--- a/geoip/Makefile.am
+++ b/geoip/Makefile.am
@@ -1,7 +1,5 @@
 # -*- Makefile -*-

-bin_SCRIPTS = xt_geoip_fetch
-
 pkglibexec_SCRIPTS = xt_geoip_build xt_geoip_dl

-man1_MANS = xt_geoip_build.1 xt_geoip_dl.1 xt_geoip_fetch.1
+man1_MANS = xt_geoip_build.1 xt_geoip_dl.1
--- a/geoip/xt_geoip_build
+++ b/geoip/xt_geoip_build
@@ -1,78 +1,86 @@
 #!/usr/bin/perl
 #
-#	Converter for DBIP (Country Lite) CSV database to binary, for xt_geoip
-#	Copyright Jan Engelhardt, 2008-2011
-#	Copyright Philip Prindeville, 2018
-#	Copyright Arjen de Korte, 2020
+#	Converter for MaxMind CSV database to binary, for xt_geoip
+#	Copyright © Jan Engelhardt, 2008-2011
 #
 use Getopt::Long;
-use Net::CIDR::Lite;
-use Socket qw(AF_INET AF_INET6 inet_pton);
-use warnings;
+use IO::Handle;
 use Text::CSV_XS; # or trade for Text::CSV
 use strict;

+my $le32 = pack("V", 0x10000000);
+my $be32 = pack("N", 0x10000000);
+my $u32 = undef;
+
+sub wantBE { return !$u32 || $u32 eq $be32; }
+sub wantLE { return !$u32 || $u32 eq $le32; }
+
 my $csv = Text::CSV_XS->new({
 	allow_whitespace => 1,
 	binary => 1,
 	eol => $/,
 }); # or Text::CSV
-my $quiet = 0;
-my $input_file = "dbip-country-lite.csv";
 my $target_dir = ".";
+my $native_only = 0;

 &Getopt::Long::Configure(qw(bundling));
 &GetOptions(
 	"D=s" => \$target_dir,
-	"i=s" => \$input_file,
-	"q" => \$quiet,
-	"s" => sub { $target_dir = "/usr/share/xt_geoip"; },
+	"n"   => \$native_only,
 );

 if (!-d $target_dir) {
-	print STDERR "Target directory \"$target_dir\" does not exist.\n";
+	print STDERR "Target directory $target_dir does not exist.\n";
 	exit 1;
 }
+my @dbs = qw(LE BE);
+if ($native_only) {
+	$u32 = pack("L", 0x10000000);
+	if ($u32 eq $le32) {
+		@dbs = qw(LE);
+	} elsif ($u32 eq $be32) {
+		@dbs = qw(BE);
+	} else {
+		print STDERRR "Cannot determine endianness.\n";
+		exit 1;
+	}
+}
+
+foreach (@dbs) {
+	my $dir = "$target_dir/$_";
+	if (!-e $dir && !mkdir($dir)) {
+		print STDERR "Could not mkdir $dir: $!\n";
+		exit 1;
+	}
+}

 &dump(&collect());

 sub collect
 {
-	my ($file, $fh, $row);
-	my (%country);
-	if ($input_file eq "-") {
-		open($fh, "<&STDIN");
-	} else {
-		open($fh, "<", $input_file) || die "Cannot open $input_file: $!\n";
-	}
+	my %country;

-	while ($row = $csv->getline($fh)) {
-		my ($cc, $range);
-
-		$cc = $row->[2];
-		$range = $row->[0] . "-" . $row->[1];
-
-		if (!exists($country{$cc})) {
-			$country{$cc} = { pool_v4 => Net::CIDR::Lite->new(), pool_v6 => Net::CIDR::Lite->new() };
+	while (my $row = $csv->getline(*ARGV)) {
+		if (!defined($country{$row->[4]})) {
+			$country{$row->[4]} = {
+				name => $row->[5],
+				pool_v4 => [],
+				pool_v6 => [],
+			};
 		}
-
-		if (index($range, '.') > 0) {
-			$country{$cc}->{pool_v4}->add_range($range);
+		my $c = $country{$row->[4]};
+		if ($row->[0] =~ /:/) {
+			push(@{$c->{pool_v6}},
+			     [&ip6_pack($row->[0]), &ip6_pack($row->[1])]);
+		} else {
+			push(@{$c->{pool_v4}}, [$row->[2], $row->[3]]);
 		}
-
-		if (index($range, ':') > 0) {
-			$country{$cc}->{pool_v6}->add_range($range);
-		}
-
-		if (!$quiet && $. % 4096 == 0) {
+		if ($. % 4096 == 0) {
 			print STDERR "\r\e[2K$. entries";
 		}
 	}

-	print STDERR "\r\e[2K$. entries total\n" unless ($quiet);
-
-	close($fh);
-
+	print STDERR "\r\e[2K$. entries total\n";
 	return \%country;
 }

@@ -80,7 +88,7 @@ sub dump
 {
 	my $country = shift @_;

-	foreach my $iso_code (sort keys %{$country}) {
+	foreach my $iso_code (sort keys %$country) {
 		&dump_one($iso_code, $country->{$iso_code});
 	}
 }
@@ -88,40 +96,80 @@ sub dump
 sub dump_one
 {
 	my($iso_code, $country) = @_;
-	my @ranges;
+	my($file, $fh_le, $fh_be);

-	@ranges = $country->{pool_v4}->list_range();
+	printf "%5u IPv6 ranges for %s %s\n",
+		scalar(@{$country->{pool_v6}}),
+		$iso_code, $country->{name};

-	writeCountry($iso_code, AF_INET, @ranges);
+	if (wantLE) {
+		$file = "$target_dir/LE/".uc($iso_code).".iv6";
+		if (!open($fh_le, "> $file")) {
+			print STDERR "Error opening $file: $!\n";
+			exit 1;
+		}
+		foreach my $range (@{$country->{pool_v6}}) {
+			print $fh_le &ip6_swap($range->[0]), &ip6_swap($range->[1]);
+		}
+		close $fh_le;
+	}
+	if (wantBE) {
+		$file = "$target_dir/BE/".uc($iso_code).".iv6";
+		if (!open($fh_be, "> $file")) {
+			print STDERR "Error opening $file: $!\n";
+			exit 1;
+		}
+		foreach my $range (@{$country->{pool_v6}}) {
+			print $fh_be $range->[0], $range->[1];
+		}
+		close $fh_be;
+	}

-	@ranges = $country->{pool_v6}->list_range();
+	printf "%5u IPv4 ranges for %s %s\n",
+		scalar(@{$country->{pool_v4}}),
+		$iso_code, $country->{name};

-	writeCountry($iso_code, AF_INET6, @ranges);
+	if (wantLE) {
+		$file = "$target_dir/LE/".uc($iso_code).".iv4";
+		if (!open($fh_le, "> $file")) {
+			print STDERR "Error opening $file: $!\n";
+			exit 1;
+		}
+		foreach my $range (@{$country->{pool_v4}}) {
+			print $fh_le pack("VV", $range->[0], $range->[1]);
+		}
+		close $fh_le;
+	}
+	if (wantBE) {
+		$file = "$target_dir/BE/".uc($iso_code).".iv4";
+		if (!open($fh_be, "> $file")) {
+			print STDERR "Error opening $file: $!\n";
+			exit 1;
+		}
+		foreach my $range (@{$country->{pool_v4}}) {
+			print $fh_be pack("NN", $range->[0], $range->[1]);
+		}
+		close $fh_be;
+	}
 }

-sub writeCountry
+sub ip6_pack
 {
-	my ($iso_code, $family, @ranges) = @_;
-	my $fh;
-
-	printf "%5u IPv%s ranges for %s\n",
-		scalar(@ranges),
-		($family == AF_INET ? '4' : '6'),
-		$iso_code unless ($quiet);
-
-	my $file = "$target_dir/".uc($iso_code).".iv".($family == AF_INET ? '4' : '6');
-	if (!open($fh, '>', $file)) {
-		print STDERR "Error opening $file: $!\n";
-		exit 1;
+	my $addr = shift @_;
+	$addr =~ s{::}{:!:};
+	my @addr = split(/:/, $addr);
+	my @e = (0) x 8;
+	foreach (@addr) {
+		if ($_ eq "!") {
+			$_ = join(':', @e[0..(8-scalar(@addr))]);
+		}
 	}
-
-	binmode($fh);
-
-	foreach my $range (@ranges) {
-		my ($start, $end) = split('-', $range);
-		$start = inet_pton($family, $start);
-		$end = inet_pton($family, $end);
-		print $fh $start, $end;
-	}
-	close $fh;
+	@addr = split(/:/, join(':', @addr));
+	$_ = hex($_) foreach @addr;
+	return pack("n*", @addr);
+}
+
+sub ip6_swap
+{
+	return pack("V*", unpack("N*", shift @_));
 }
--- a/geoip/xt_geoip_build.1
+++ b/geoip/xt_geoip_build.1
@@ -5,7 +5,7 @@ xt_geoip_build \(em convert GeoIP.csv to packed format for xt_geoip
 .SH Syntax
 .PP
 \fI/usr/libexec/xt_geoip/\fP\fBxt_geoip_build\fP [\fB\-D\fP
-\fItarget_dir\fP] [\fB\-i\fP \fIinput_file\fP]
+\fItarget_dir\fP] [\fIfile\fP...]
 .SH Description
 .PP
 xt_geoip_build is used to build packed raw representations of the range
@@ -16,26 +16,20 @@ required to be loaded into memory. The ranges in the packed database files are
 also ordered, as xt_geoip relies on this property for its bisection approach to
 work.
 .PP
+Input is processed from the listed files, or if none is given, from stdin.
+.PP
 Since the script is usually installed to the libexec directory of the
 xtables-addons package and this is outside $PATH (on purpose), invoking the
 script requires it to be called with a path.
 .PP Options
 .TP
 \fB\-D\fP \fItarget_dir\fP
-Specifies the target directory into which the files are to be put. Defaults to ".".
-.TP
-\fB\-i\fP \fIinput_file\fP
-Specifies the source location of the DBIP CSV file. Defaults to
-"dbip-country-lite.csv". Use "-" to read from stdin.
-.TP
-\fB\-s\fP
-"System mode". Equivalent to \fB\-D /usr/share/xt_geoip\fP.
+Specify a target directory into which the files are to be put.
 .SH Application
 .PP
-Shell commands to build the databases and put them to where they are expected
-(usually run as root):
+Shell commands to build the databases and put them to where they are expected:
 .PP
-xt_geoip_build \-s
+xt_geoip_build \-D /usr/share/xt_geoip
 .SH See also
 .PP
 xt_geoip_dl(1)
--- a/geoip/xt_geoip_dl
+++ b/geoip/xt_geoip_dl
@@ -1,5 +1,8 @@
 #!/bin/sh

-timestamp=$(date "+%Y-%m")
-wget -q "https://download.db-ip.com/free/dbip-country-lite-$timestamp.csv.gz" -O- | \
-	gzip -cd >dbip-country-lite.csv
+rm -f GeoIPv6.csv GeoIPv6.csv.gz GeoIPCountryCSV.zip GeoIPCountryWhois.csv;
+wget \
+	http://geolite.maxmind.com/download/geoip/database/GeoIPv6.csv.gz \
+	http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip;
+gzip -d GeoIPv6.csv.gz;
+unzip GeoIPCountryCSV.zip;
--- a/geoip/xt_geoip_fetch
+++ b/geoip/xt_geoip_fetch
@@ -1,95 +0,0 @@
-#!/usr/bin/perl
-#
-#	Utility to query GeoIP database
-#	Copyright Philip Prindeville, 2018
-#
-use Getopt::Long;
-use Socket qw(AF_INET AF_INET6 inet_ntop);
-use warnings;
-use strict;
-
-sub AF_INET_SIZE() { 4 }
-sub AF_INET6_SIZE() { 16 }
-
-my $target_dir = ".";
-my $ipv4 = 0;
-my $ipv6 = 0;
-
-&Getopt::Long::Configure(qw(bundling));
-&GetOptions(
-	"D=s" => \$target_dir,
-	"4"   => \$ipv4,
-	"6"   => \$ipv6,
-);
-
-if (!-d $target_dir) {
-	print STDERR "Target directory $target_dir does not exit.\n";
-	exit 1;
-}
-
-# if neither specified, assume both
-if (! $ipv4 && ! $ipv6) {
-	$ipv4 = $ipv6 = 1;
-}
-
-foreach my $cc (@ARGV) {
-	if ($cc !~ m/^([a-z]{2}|a[12]|o1)$/i) {
-		print STDERR "Invalid country code '$cc'\n";
-		exit 1;
-	}
-
-	my $file = $target_dir . '/' . uc($cc) . '.iv4';
-
-	if (! -f $file) {
-		printf STDERR "Can't find data for country '$cc'\n";
-		exit 1;
-	}
-
-	my ($contents, $buffer, $bytes, $fh);
-
-	if ($ipv4) {
-		open($fh, '<', $file) || die "Couldn't open file for '$cc'\n";
-
-		binmode($fh);
-
-		while (($bytes = read($fh, $buffer, AF_INET_SIZE * 2)) == AF_INET_SIZE * 2) {
-			my ($start, $end) = unpack('a4a4', $buffer);
-			$start = inet_ntop(AF_INET, $start);
-			$end = inet_ntop(AF_INET, $end);
-			print $start, '-', $end, "\n";
-		}
-		close($fh);
-		if (! defined $bytes) {
-			printf STDERR "Error reading file for '$cc'\n";
-			exit 1;
-		} elsif ($bytes != 0) {
-			printf STDERR "Short read on file for '$cc'\n";
-			exit 1;
-		}
-	}
-
-	substr($file, -1) = '6';
-
-	if ($ipv6) {
-		open($fh, '<', $file) || die "Couldn't open file for '$cc'\n";
-
-		binmode($fh);
-
-		while (($bytes = read($fh, $buffer, AF_INET6_SIZE * 2)) == AF_INET6_SIZE * 2) {
-			my ($start, $end) = unpack('a16a16', $buffer);
-			$start = inet_ntop(AF_INET6, $start);
-			$end = inet_ntop(AF_INET6, $end);
-			print $start, '-', $end, "\n";
-		}
-		close($fh);
-		if (! defined $bytes) {
-			printf STDERR "Error reading file for '$cc'\n";
-			exit 1;
-		} elsif ($bytes != 0) {
-			printf STDERR "Short read on file for '$cc'\n";
-			exit 1;
-		}
-	}
-}
-
-exit 0;
--- a/geoip/xt_geoip_fetch.1
+++ b/geoip/xt_geoip_fetch.1
@@ -1,35 +0,0 @@
-.TH xt_geoip_fetch 1 "2020-04-30" "xtables-addons" "xtables-addons"
-.SH Name
-.PP
-xt_geoip_fetch \(em dump a country database to stdout
-.SH Syntax
-.PP
-\fBxt_geoip_fetch\fP [\fB\-D\fP
-\fIdatabase_dir\fP] [\fB-4\fP] [\fB-6\fP] \fIcc\fP [ \fIcc\fP ... ]
-.SH Description
-.PP
-xt_geoip_fetch unpacks a country's IPv4 or IPv6 databases and dumps
-them to standard output as a sorted, non-overlaping list of ranges (which
-is how they're represented in the database) suitable for browsing or
-further processing.
-.PP Options
-.TP
-\fB\-D\fP \fIdatabase_dir\fP
-Specifies the directory into which the files have been put. Defaults to ".".
-.TP
-\fB-4\fP
-Specifies IPv4 data only.
-.TP
-\fB-6\fP
-Specifies IPv6 data only.
-.TP
-\fIcc\fP [ \fIcc\fP ... ]
-The ISO-3166 country code names of the desired countries' databases.
-.SH Application
-.PP
-Shell command to dump the list of Swiss IPv6 address ranges:
-.PP
-xt_geoip_fetch \-D /usr/share/xt_geoip \-6 ch
-.SH See also
-.PP
-xt_geoip_build(1)
--- a/1
+++ b/1
@@ -8,7 +8,6 @@ build_DNETMAP=m
 build_ECHO=m
 build_IPMARK=m
 build_LOGMARK=m
-build_PROTO=m
 build_SYSRQ=m
 build_TARPIT=m
 build_condition=m
--- a/3
+++ b/3
@@ -0,0 +1,3 @@
+#
+# Source URLs for external patchlets
+#
--- a/83
+++ b/83
@@ -0,0 +1,83 @@
+#!/usr/bin/perl -w
+
+use HTTP::Request;
+use LWP::UserAgent;
+use strict;
+
+&main(\@ARGV);
+
+sub main
+{
+	local *FH;
+
+	if (!-d "downloads") {
+		if (!mkdir("downloads")) {
+			die "Could not create downloads/ directory";
+		}
+	}
+
+	open(FH, "<sources");
+	while (defined($_ = <FH>)) {
+		chomp $_;
+		$_ =~ s/#.*//gs;
+		$_ =~ s/^\s+|\s+$//gs;
+		if (length($_) == 0) {
+			next;
+		}
+		&process_index($_);
+	}
+
+	close FH;
+}
+
+sub process_index
+{
+	my $top = shift @_;
+	my($agent, $res, $url);
+	local *FH;
+
+	$agent = LWP::UserAgent->new();
+	$agent->env_proxy();
+
+	$url = &slash_remove("$top/xa-index.txt");
+	print "  GET     $url\n";
+	$res = $agent->get($url);
+	if (!$res->is_success()) {
+		print STDERR "  `->     ", $res->status_line(), "\n";
+		return;
+	}
+
+	foreach my $ext (split(/\s+/, $res->content())) {
+		my($ex_url, $ex_res);
+
+		$ex_url = &slash_remove("$top/$ext");
+		print "  GET     $ex_url\n";
+
+		$ex_res = $agent->mirror($ex_url, "downloads/$ext");
+		if ($ex_res->code() == 304) {
+			# "Not modified" = up to date
+			next;
+		}
+		if (!$ex_res->is_success()) {
+			print STDERR "  `->     ", $ex_res->status_line(), "\n";
+			next;
+		}
+
+		print "  UNPACK  downloads/$ext\n";
+		system "tar", "-xjf", "downloads/$ext";
+	}
+}
+
+sub slash_remove
+{
+	my $s = shift @_;
+	$s =~ s{(\w+://)(.*)}{$1.&slash_remove2($2)}eg;
+	return $s;
+}
+
+sub slash_remove2
+{
+	my $s = shift @_;
+	$s =~ s{/+}{/}g;
+	return $s;
+}
--- a/xtables-addons.8.in
+++ b/xtables-addons.8.in
@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "" "" "v3.11 (2020-09-06)"
+.TH xtables-addons 8 "" "" "v2.15 (2021-02-05)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets
Author	SHA1	Message	Date
Jan Engelhardt	47f5391a37	Xtables-addons 2.15	2021-02-05 19:02:49 +01:00
Jan Engelhardt	16a64492ae	xt_lscan: add --mirai option	2021-02-05 19:00:13 +01:00
Jan Engelhardt	cdcf874366	xt_lscan: extend info struct to support more flags (without size change)	2021-01-20 03:09:52 +01:00