doc: add xt_quota2 changelog items

Cherry-picked commit v2.4-1-gfb3e550.

.gitignore

@@ -3,7 +3,6 @@
 *.lo
 *.loT
 *.o
-.cache.mk
 .deps/
 .dirstamp
 .libs/

INSTALL

@@ -12,18 +12,16 @@ in combination with the kernel's Kbuild system.
 Supported configurations for this release
 =========================================
 
-	* iptables >= 1.6.0
+	* iptables >= 1.4.5
 
-	* kernel-devel >= 4.15
+	* kernel-devel >= 2.6.32
 	  with prepared build/output directory
-	  - CONFIG_NF_CONNTRACK
+	  - CONFIG_NF_CONNTRACK or CONFIG_IP_NF_CONNTRACK
-	  - CONFIG_NF_CONNTRACK_MARK enabled =y or as module (=m)
+	  - CONFIG_NF_CONNTRACK_MARK or CONFIG_IP_NF_CONNTRACK_MARK
+	    enabled =y or as module (=m)
 	  - CONFIG_CONNECTOR y/m if you wish to receive userspace
 	    notifications from pknock through netlink/connector
 
-(Use xtables-addons-1.x if you need support for Linux < 3.7.
-Use xtables-addons-2.x if you need support for Linux < 4.15.)
-
 
 Selecting extensions
 ====================

Makefile.am

@@ -11,10 +11,8 @@ FORCE:
 xtables-addons.8: FORCE
 	${MAKE} -f Makefile.mans all;
 
-clean-local-mans:
+install-exec-hook:
-	${MAKE} -f Makefile.mans clean;
+	depmod -a || :;
-
-clean-local: clean-local-mans
 
 config.status: Makefile.iptrules.in
 

Makefile.mans.in

@@ -3,8 +3,8 @@
 
 srcdir := @srcdir@
 
-wcman_matches := $(shell find "${srcdir}/extensions" -name 'libxt_[a-z]*.man' -print | sort)
+wcman_matches := $(shell find "${srcdir}" -name 'libxt_[a-z]*.man' | sort)
-wcman_targets := $(shell find "${srcdir}/extensions" -name 'libxt_[A-Z]*.man' -print | sort)
+wcman_targets := $(shell find "${srcdir}" -name 'libxt_[A-Z]*.man' | sort)
 wlist_matches := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_matches})
 wlist_targets := $(patsubst ${srcdir}/libxt_%.man,%,${wcman_targets})
 
@@ -38,6 +38,3 @@ matches.man: .manpages.lst ${wcman_matches}
 
 targets.man: .manpages.lst ${wcman_targets}
 	$(call man_run,${wlist_targets})
-
-clean:
-	rm -f xtables-addons.8 matches.man targets.man

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([xtables-addons], [3.2])
+AC_INIT([xtables-addons], [1.47.1])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -26,7 +26,7 @@ fi
 
 AC_CHECK_HEADERS([linux/netfilter/x_tables.h], [],
 	[AC_MSG_ERROR([You need to have linux/netfilter/x_tables.h, see INSTALL file for details])])
-PKG_CHECK_MODULES([libxtables], [xtables >= 1.6.0])
+PKG_CHECK_MODULES([libxtables], [xtables >= 1.4.5])
 xtlibdir="$(pkg-config --variable=xtlibdir xtables)"
 
 AC_ARG_WITH([xtlibdir],
@@ -44,23 +44,31 @@ regular_CFLAGS="-Wall -Waggregate-return -Wmissing-declarations \
 
 if test -n "$kbuilddir"; then
 	AC_MSG_CHECKING([kernel version that we will build against])
-	krel="$(make -sC "$kbuilddir" M=$PWD kernelrelease | $AWK -v 'FS=[[^0-9.]]' '{print $1; exit}')"
+	krel="$(make -sC "$kbuilddir" M=$PWD kernelrelease)";
-	save_IFS="$IFS"
+	kmajor="${krel%%[[^0-9]]*}";
-	IFS='.'
+	kmajor="$(($kmajor+0))";
-	set x $krel
+	krel="${krel:${#kmajor}}";
-	IFS="$save_IFS"
+	krel="${krel#.}";
-	kmajor="$(($2+0))"
+	kminor="${krel%%[[^0-9]]*}";
-	kminor="$(($3+0))"
+	kminor="$(($kminor+0))";
-	kmicro="$(($4+0))"
+	krel="${krel:${#kminor}}";
-	kstable="$(($5+0))"
+	krel="${krel#.}";
+	kmicro="${krel%%[[^0-9]]*}";
+	kmicro="$(($kmicro+0))";
+	krel="${krel:${#kmicro}}";
+	krel="${krel#.}";
+	kstable="${krel%%[[^0-9]]*}";
+	kstable="$(($kstable+0))";
 	if test -z "$kmajor" -o -z "$kminor" -o -z "$kmicro"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 4 -o "$kmajor" -eq 4 -a "$kminor" -gt 18; then
+		if test "$kmajor" -gt 3 -o "$kmajor" -eq 3 -a "$kminor" -gt 6; then
-			echo "WARNING: That kernel version is not officially supported yet. Continue at own luck.";
+			echo "WARNING: That kernel version is not officially supported.";
-		elif test "$kmajor" -eq 4 -a "$kminor" -ge 18; then
+		elif test "$kmajor" -eq 3; then
-			:
+			:;
+		elif test "$kmajor" -eq 2 -a "$kminor" -eq 6 -a "$kmicro" -ge 32; then
+			:;
 		else
 			echo "WARNING: That kernel version is not officially supported.";
 		fi;

doc/api/2.6.17.c

@@ -0,0 +1,64 @@
+match:
+
+	/* true/false */
+	int
+	(*match)(
+		const struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		const struct xt_match *match,
+		const void *matchinfo,
+		int offset,
+		unsigned int protoff,
+		int *hotdrop,
+	);
+
+	/* true/false */
+	int
+	(*checkentry)(
+		const char *tablename,
+		const void *ip,
+		const struct xt_match *match,
+		void *matchinfo,
+		unsigned int matchinfosize,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_match *match,
+		void *matchinfo,
+		unsigned int matchinfosize,
+	);
+
+target:
+
+	/* verdict */
+	unsigned int
+	(*target)(
+		struct sk_buff **pskb,
+		const struct net_device *in,
+		const struct net_device *out,
+		unsigned int hooknum,
+		const struct xt_target *target,
+		const void *targinfo,
+		void *userdata,
+	);
+
+	/* true/false */
+	int
+	(*checkentry)(
+		const char *tablename,
+		const void *entry,
+		const struct xt_target *target,
+		void *targinfo,
+		unsigned int targinfosize,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_target *target,
+		void *targinfo,
+		unsigned int targinfosize,
+	);

doc/api/2.6.19.c

@@ -0,0 +1,59 @@
+match:
+
+	/* true/false */
+	int
+	(*match)(
+		const struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		const struct xt_match *match,
+		const void *matchinfo,
+		int offset,
+		unsigned int protoff,
+		int *hotdrop,
+	);
+
+	/* true/false */
+	int
+	(*checkentry)(
+		const char *tablename,
+		const void *ip,
+		const struct xt_match *match,
+		void *matchinfo,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_match *match,
+		void *matchinfo,
+	);
+
+target:
+
+	/* verdict */
+	unsigned int
+	(*target)(
+		struct sk_buff **pskb,
+		const struct net_device *in,
+		const struct net_device *out,
+		unsigned int hooknum,
+		const struct xt_target *target,
+		const void *targinfo,
+	);
+
+	/* true/false */
+	int
+	(*checkentry)(
+		const char *tablename,
+		const void *entry,
+		const struct xt_target *target,
+		void *targinfo,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_target *target,
+		void *targinfo,
+	);

doc/api/2.6.23.c

@@ -0,0 +1,59 @@
+match:
+
+	/* true/false */
+	bool
+	(*match)(
+		const struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		const struct xt_match *match,
+		const void *matchinfo,
+		int offset,
+		unsigned int protoff,
+		bool *hotdrop,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const char *tablename,
+		const void *ip,
+		const struct xt_match *match,
+		void *matchinfo,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_match *match,
+		void *matchinfo,
+	);
+
+target:
+
+	/* verdict */
+	unsigned int
+	(*target)(
+		struct sk_buff **pskb,
+		const struct net_device *in,
+		const struct net_device *out,
+		unsigned int hooknum,
+		const struct xt_target *target,
+		const void *targinfo,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const char *tablename,
+		const void *entry,
+		const struct xt_target *target,
+		void *targinfo,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_target *target,
+		void *targinfo,
+	);

doc/api/2.6.24.c

@@ -0,0 +1,59 @@
+match:
+
+	/* true/false */
+	bool
+	(*match)(
+		const struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		const struct xt_match *match,
+		const void *matchinfo,
+		int offset,
+		unsigned int protoff,
+		bool *hotdrop,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const char *tablename,
+		const void *ip,
+		const struct xt_match *match,
+		void *matchinfo,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_match *match,
+		void *matchinfo,
+	);
+
+target:
+
+	/* verdict */
+	unsigned int
+	(*target)(
+		struct sk_buff *skb,
+		const struct net_device *in,
+		const struct net_device *out,
+		unsigned int hooknum,
+		const struct xt_target *target,
+		const void *targinfo,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const char *tablename,
+		const void *entry,
+		const struct xt_target *target,
+		void *targinfo,
+		unsigned int hook_mask,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_target *target,
+		void *targinfo,
+	);

doc/api/2.6.28.c

@@ -0,0 +1,39 @@
+match:
+
+	/* true/false */
+	bool
+	(*match)(
+		const struct sk_buff *skb,
+		const struct xt_match_param *,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const struct xt_mtchk_param *,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_mtdtor_param *,
+	);
+
+target:
+
+	/* verdict */
+	unsigned int
+	(*target)(
+		struct sk_buff *skb,
+		const struct xt_target_param *,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const struct xt_tgchk_param *,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_tgdtor_param *,
+	);

doc/api/2.6.31.c

@@ -0,0 +1,38 @@
+match:
+
+	/* true/false */
+	bool
+	(*match)(
+		const struct sk_buff *skb,
+		const struct xt_match_param *,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const struct xt_mtchk_param *,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_mtdtor_param *,
+	);
+
+target:
+
+	unsigned int
+	(*target)(
+		struct sk_buff *skb,
+		const struct xt_target_param *,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const struct xt_tgchk_param *,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_tgdtor_param *,
+	);

doc/api/2.6.32.c

@@ -0,0 +1,39 @@
+match:
+
+	/* true/false */
+	bool
+	(*match)(
+		const struct sk_buff *skb,
+		const struct xt_match_param *,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const struct xt_mtchk_param *,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_mtdtor_param *,
+	);
+
+target:
+
+	/* verdict */
+	unsigned int
+	(*target)(
+		struct sk_buff *skb,
+		const struct xt_target_param *,
+	);
+
+	/* true/false */
+	bool
+	(*checkentry)(
+		const struct xt_tgchk_param *,
+	);
+
+	void
+	(*destroy)(
+		const struct xt_tgdtor_param *,
+	);

doc/changelog.txt

@@ -1,110 +1,8 @@
 
 HEAD
 ====
-
+Changes
-
-v3.2 (2018-09-07)
-=================
-Changes:
-- rework xt_geoip_build to scan the immediate directory for .csv,
-  not to scan for GeoLite2-Country-CSV_\d+.
-
-
-v3.1 (2018-08-14)
-=================
-Enhancements:
-- support for Linux 4.17, 4.18
-
-
-v3.0 (2018-02-12)
-=================
-Enhancements:
-- support for Linux 4.15, 4.16
-Changes:
-- remove support for Linux 3.7--4.14
-
-
-v2.14 (2017-11-22)
-==================
-Enhancements:
-- support for Linux up to 4.14
-Fixes:
-- xt_DNETMAP: fix some reports from PVSStudio (a static checker)
-
-
-v2.13 (2017-06-29)
-==================
-Enhancements:
-- support for Linux up to 4.12
-- xt_condition: namespace support
-Fixes:
-- xt_geoip: check for allocation overflow
-- xt_DNETMAP: fix a buffer overflow
-
-
-v2.12 (2017-01-11)
-==================
-Enhancements:
-- support for Linux up to 4.10
-
-
-v2.11 (2016-05-20)
-==================
-Enhancements:
-- support for Linux 4.5, 4.6
-- xt_ECHO: tentatively support responding to fragments
-
-
-v2.10 (2015-11-20)
-==================
-Enhancements:
-- Support for Linux 4.4
-Fixes:
-- xt_ACCOUNT: call free_page with the right amount of pages
-
-
-v2.9 (2015-10-12)
-=================
-Enhancements:
-- Support for Linux 4.3
-
-
-v2.8 (2015-08-19)
-=================
-Enhancements:
-- Support for Linux 4.2
-- Enable xt_ECHO for Linux 4.0+
-
-
-v2.7 (2015-07-06)
-=================
-Enhancements:
-- Support for Linux up to 4.1
-
-
-v2.6 (2014-09-29)
-=================
-Enhancements:
-- Support for Linux up to 3.17
-Fixes:
-- xt_pknock: UDP SPA mode erroneously returned an error saying
-  crypto was unavailable
-
-
-v2.5 (2014-04-18)
-=================
-Enhancements:
-- Support for Linux up to 3.15
-- xt_quota2: introduce support for network namespaces
-
-
-v2.4 (2014-01-09)
-=================
-Enhancements:
-- Support for Linux up to 3.13
-Changes:
 - remove unmaintained RAWSNAT/RAWDNAT code
-- remove unused parts of compat_xtables that served Linux <3.7
 Fixes:
 - xt_quota2: --no-change should not alter quota to zero ever
 - xt_quota2: --packet should not be set to zero based on skb->len
@@ -148,5 +46,515 @@ Changes:
 Enhancements:
 - Support for Linux 3.7
 
-If you want to use Xtables-addons with kernels older than 4.15,
+If you want to use Xtables-addons with kernels older than 3.7,
-use the addons 2.x series.
+use the addons 1.x series, which continues to be maintained for
+the time being.
+>>>>>>> fb3e550... doc: add xt_quota2 changelog items
+
+
+v1.47.1 (2010-10-15)
+====================
+Enhancements:
+- xt_psd gained IPv6 support
+Notes for this release:
+- Linux 3.7+ is expressly unsupported by this release.
+
+
+v1.46 (2012-08-23)
+==================
+Fixes:
+- length2, SYSRQ, RAWNAT: preinitialize values for ipv6_find_hdr
+- TARPIT: fix memory leak when tarpit_generic() fails
+- build: remove extraneous closing bracket in configure.ac
+- doc: update xt_SYSRQ.man to reflect that the full IPv6 address is needed
+Enhancements:
+- Support for Linux 3.6
+
+
+v1.45 (2012-07-16)
+==================
+Fixes:
+- build: export missing functions
+  (fixes: "WARNING 'xtnu_ipv6_find_hdr' [xt_TARPIT.ko] not found")
+- build: avoid use of unexported functions
+  (fixes: "WARNING 'ipv6_find_hdr' [xt_TARPIT.ko] not found"
+  in <= linux-2.6.37)
+
+
+v1.44 (2012-07-15)
+==================
+Fixes:
+- SYSRQ: fix double target initialization at module load
+- build: do not attempt to build IPv6 parts if CONFIG_IP6_NF_IPTABLES=n
+Enhancements:
+- TARPIT gained IPv6 support
+
+
+v1.43 (2012-06-30)
+==================
+Fixes:
+- xt_psd: avoid crash due to curr->next corruption
+Changes:
+- xt_psd: reject invalid match options
+Enhancements:
+- Support for Linux 3.5
+- DNETMAP: new type: static binding
+- DNETMAP: new persistent flag option for prefix
+- DNETMAP: add write support to procfs interface
+
+
+v1.42 (2012-04-05)
+==================
+Fixes:
+- compat_xtables: fixed mistranslation of checkentry return values
+  (affected kernels < 2.6.23)
+- xt_SYSRQ: fix compile error when crypto is turned off
+Changes:
+- ipset6-genl has been dropped from the tree;
+  the libmnl build-time dependency is thus no longer needed
+Enhancements:
+- Support for Linux 3.3, 3.4
+
+
+v1.41 (2012-01-04)
+==================
+Changes:
+- Deactivate build of ipset-genl by default.
+  I think the original ipset package can now take over, given there are
+  a handful of kernels (2.6.39 onwards) that do not need patching.
+Enhancements:
+- Support for Linux 3.2
+
+
+v1.40 (2011-11-30)
+==================
+Fixes:
+- build: the code actually requires at least iptables 1.4.5 (would yield a
+  compile error otherwise), make sure configure checks for it; update INSTALL
+- xt_ECHO: fix kernel warning about RTAX_HOPLIMIT being used
+- xt_ipv4options: fix an infinite loop
+Changes:
+- xt_ECHO: now calculates UDP checksum
+- Linux kernel versions below 2.6.32 are no longer officially
+  supported, and will not be part of compilation testing.
+- update to ipset 6.10
+Enhancements:
+- xt_ECHO: IPv6 support
+
+
+v1.39 (2011-09-21)
+==================
+Fixes:
+- libxt_ACCOUNT: fix compilation after missing libxtables_CFLAGS
+- build: fix compilation after missing libxtables_CFLAGS in submodules
+- build: add missing linux/version.h includes where needed
+Changes:
+- Remove unsupported ipset 4.x from the Xtables-addons distribution
+- ipset: move ipset_errcode from src to library to avoid undefined reference
+- update to ipset 6.9.1
+
+
+v1.38 (2011-08-20)
+==================
+- xt_CHECKSUM: abort build when the feature is already provided by mainline
+- xt_SYSRQ: fix UDPLITE header lookup in IPv6
+- xt_TARPIT: fix kernel warning about RTAX_HOPLIMIT being used
+- xt_TEE: abort build when the feature is already provided by mainline
+- xt_ipp2p: support UDPLITE
+- xt_pknock: support UDPLITE
+- xt_psd: restore functionality with UDP
+- xt_psd: support UDPLITE
+- update to ipset 6.8
+- support for Linux 3.1
+
+
+v1.37 (2011-06-25)
+==================
+Fixes:
+- xt_SYSRQ: make IPv6 trigger work again
+- xt_SYSRQ: improve security: include host address in digest
+- xt_TARPIT: fix a kernel oops in --reset mode
+
+
+v1.36 (2011-06-03)
+==================
+Changes:
+- xt_geoip: avoid recursive function calls
+- xt_TARPIT: unlock for use in all tables
+- xt_TARPIT: honeypot and reset modes
+- update to ipset 6.7
+- support for Linux 3.0
+
+
+v1.35 (2011-04-11)
+==================
+Enhancements:
+- update to ipset 6.3
+  * allow "new" as a commad alias to "create"
+  * resolving IP addresses did not work at listing/saving sets, fixed
+  * check ICMP and ICMPv6 with the set match and target in the testsuite
+  * avoid possible syntax clashing at saving hostnames
+  * fix linking with CONFIG_IPV6=n
+  * sctp, udplite support for the hash:*port* types
+- ipset-genl: handle EAGAIN return value emitted from autoloader
+- ipset-genl: resolve nfgenmsg remains and fix spurious protocol abort
+
+
+v1.34 (2011-04-07)
+==================
+Fixes:
+- xt_pknock: avoid crash when hash TFM could not be allocated
+- xt_pknock: avoid inversion of rule lookup that led to warnings
+- xt_DNETMAP: add missing module alias
+- xt_DNETMAP: support for kernels below 2.6.34
+Changes:
+- Linux kernel versions below 2.6.29 are no longer officially
+  supported, and will not be part of compilation testing.
+
+
+v1.33 (2011-02-02)
+==================
+Fixes:
+- build: restore functionality of `configure --without-kbuild`
+- build: fix objdir builds for ipset-5 (xt-a specific)
+- build: fix missing inclusion of dependency rules
+- xt_LOGMARK: fix detection of untracked connection for Linux >= 2.6.36
+Enhancements:
+- IPv6 support for xt_geoip
+- Update to ipset 5.3
+  * make IPv4 and IPv6 address handling similar
+  * show correct line numbers in restore output for parser errors
+- Update to ipset 5.4
+  * fixed ICMP and ICMPv6 handling
+  * fixed trailing whitespaces and pr_* messages
+  * fixed module loading at create/header commands
+- build: support for Linux up to 2.6.38
+- build: preliminary support for iptables 1.4.11
+
+
+v1.32 (2011-01-04)
+==================
+Fixes:
+- Update to ipset 4.5
+  * the iptreemap type used wrong gfp flags when deleting entries
+- Include ipset 5.2 with genetlink patch (beta)
+  * no kernel patch needed, but requires Linux >= 2.6.35
+    and thus needs to be manually enabled in mconfig
+
+
+v1.31 (2010-11-05)
+==================
+Fixes:
+- build: improve detection of kernel version and error handling
+Changes:
+- build: automatically derive Xtables module directory, thus
+  --with-xtlibdir is no longer needed for ./configure in most cases
+  (If I still see a distro using it, I will scold you for not
+  reading this changelog.)
+Enhancements:
+- LOGMARK: print remaining lifetime of cts
+- xt_iface: allow matching against incoming/outgoing interface
+- libxt_gradm: match packets based on status of grsecurity RBAC
+  (userspace part only - xt_gradm is in the grsec patch)
+
+
+v1.30 (2010-010-02)
+===================
+Fixes:
+- update to ipset 4.4
+  * ipport{,ip,net}hash did not work with mixed "src" and "dst"
+    destination parameters
+Changes:
+- deactivate building xt_TEE and xt_CHECKSUM by default, as these have been
+  merged upstream in Linux 2.6.35 and 2.6.36, respectively.
+  Distros still wishing to build this need to enable it in their build
+  script, e.g. perl -i -pe 's{^build_TEE=.*}{build_TEE=m}' mconfig;
+
+
+v1.29 (2010-09-29)
+==================
+- compat_xtables: return bool for match_check and target_check in 2.6.23..34
+- ipset: enable building of ip_set_ipport{ip,net}hash.ko
+- support for Linux 2.6.36
+- SYSRQ: resolve compile error with Linux 2.6.36
+- TEE: resolve compile error with Linux 2.6.36
+- add workaround for broken linux-glibc-devel 2.6.34 userspace headers
+  ("implicit declaration of function 'ALIGN'")
+
+
+v1.28 (2010-07-24)
+==================
+- RAWNAT: IPv6 variants erroneously rejected masks /33-/128
+- new target xt_CHECKSUM
+- xt_length2: add support for IPv6 jumbograms
+- xt_geoip: fix possible out-of-bounds access
+- import xt_geoip database scripts
+
+
+v1.27 (2010-05-16)
+==================
+- further updates for the upcoming 2.6.35 changes
+
+
+v1.26 (2010-04-30)
+==================
+- compat_xtables: fix 2.6.34 compile error due to a typo
+
+
+v1.25 (2010-04-26)
+==================
+- TEE: do rechecksumming in PREROUTING too
+- TEE: decrease TTL on cloned packet
+- TEE: set dont-fragment on cloned packets
+- TEE: free skb when route lookup failed
+- TEE: do not limit use to mangle table
+- TEE: do not retain iif and mark on cloned packet
+- TEE: new loop detection logic
+- TEE: use less expensive pskb_copy
+- condition: remove unnecessary RCU protection
+
+
+v1.24 (2010-03-17)
+==================
+- build: fix build of userspace modules against old (pre-2.6.25)
+  headers from linux-glibc-devel (/usr/include/linux)
+- ipp2p: updated bittorent command recognition
+- SYSRQ: let module load when crypto is unavailable
+- SYSRQ: allow processing of UDP-Lite
+
+
+v1.23 (2010-02-24)
+==================
+- build: support for Linux 2.6.34
+- build: remove unused --with-ksource option
+- build: remove unneeded --with-xtables option
+- build: fix compilations in RAWNAT, SYSRQ and length2 when CONFIG_IPV6=n
+- ipset: update to 4.2
+- ECHO: fix compilation w.r.t. skb_dst
+
+
+v1.22 (2010-01-22)
+==================
+- compat_xtables: support for 2.6.33 skb_iif changes
+- geoip: for FHS compliance use /usr/share/xt_geoip instead of /var/geoip
+- ipset: enable build of ip_set_setlist.ko
+- quota2: add the --no-change mode
+
+
+v1.21 (2009-12-09)
+==================
+- ACCOUNT: avoid collision with arp_tables setsockopt numbers
+- doc: fix option mismatch --gw/--gateway in libxt_TEE.man
+
+
+v1.20 (2009-11-19)
+==================
+- ipp2p: add more boundary checks
+- ipp2p: fix Gnutelle line ending detection
+- LOGMARK: remove unknown options from manpage
+- ACCOUNT: endianess-correctness
+- ipset: install manpage
+- ipset: fast forward to v4.1
+
+
+v1.19 (2009-10-12)
+==================
+- build: compile fixes for 2.6.31-rt
+- build: support for Linux 2.6.32
+- ipp2p: try to address underflows
+- psd: avoid potential crash when dealing with non-linear skbs
+- merge xt_ACCOUNT userspace utilities
+- added reworked xt_pknock module
+  Changes from pknock v0.5:
+  - pknock: "strict" and "checkip" flags were not displayed in `iptables -L`
+  - pknock: the GC expire time's lower bound is now the default gc time
+    (65000 msec) to avoid rendering anti-spoof protection in SPA mode useless
+  - pknock: avoid crash on memory allocation failure and fix memleak
+  - pknock: avoid fillup of peer table during DDoS
+  - pknock: automatic closing of ports
+  - pknock: make non-zero time mandatory for TCP mode
+  - pknock: display only pknock mode and state relevant information in procfs
+  - pknock: check interknock time only for !ST_ALLOWED peers
+  - pknock: preserve time/autoclose values for rules added in
+    reverse/arbitrary order
+  - pknock: add a manpage
+
+
+v1.18 (2009-09-09)
+==================
+- build: support for Linux 2.6.31
+- ipset: fast forward to v3.2
+- quota2: support anonymous counters
+- quota2: reduce memory footprint for anonymous counters
+- quota2: extend locked period during cleanup (locking bugfix)
+- quota2: use strtoull instead of strtoul
+- merged xt_ACCOUNT module
+- merged xt_psd module
+
+
+v1.17 (2009-06-16)
+==================
+- IPMARK: print missing --shift parameter
+- build: use readlink -f in extensions/ipset/
+- build: support for Linux 2.6.30
+
+
+v1.16 (2009-05-27)
+==================
+- RAWNAT: make iptable_rawpost compile with 2.6.30-rc5
+- ipset: fast forward to 3.0
+
+
+v1.15 (2009-04-30)
+==================
+- build: add kernel version check to configure
+- condition: compile fix for 2.6.30-rc
+- condition: fix intrapositional negation sign
+- fuzzy: fix bogus comparison logic leftover from move to new 1.4.3 API
+- ipp2p: fix bogus varargs call
+- ipp2p: fix typo in error message
+- added "iface" match
+- added rawpost table (for use with RAWNAT)
+- added RAWSNAT/RAWDNAT targets
+
+
+v1.14 (2009-03-31)
+==================
+- fuzzy: need to account for kernel-level modified variables in .userspacesize
+- geoip: remove XT_ALIGN from .userspacesize when used with offsetof
+- SYSRQ: ignore non-UDP packets
+- SYSRQ: do proper L4 header access in IPv6 code
+  (must not use tcp/udp_hdr in input path)
+- add "STEAL" target
+- dhcpmac: rename from dhcpaddr
+
+
+v1.13 (2009-03-23)
+==================
+- added a reworked ipv4options match
+- upgrade to iptables 1.4.3 API
+
+
+v1.12 (2009-03-07)
+==================
+- ipset: fix for compilation with 2.6.29-rt
+- ipset: fast forward to 2.5.0
+- rename xt_portscan to xt_lscan ("low-level scan") because
+  "portscan" as a word caused confusion
+- xt_LOGMARK: print incoming interface index
+- revert "TEE: do not use TOS for routing"
+- xt_TEE: resolve unknown symbol error with CONFIG_IPV6=n
+- xt_TEE: enable routing by iif, nfmark and flowlabel
+
+
+v1.10 (2009-02-18)
+==================
+- compat: compile fixes for 2.6.29
+- ipset: upgrade to ipset 2.4.9
+
+
+v1.9 (2009-01-30)
+=================
+- add the xt_length2 extension
+- xt_TEE: remove intrapositional '!' support
+- ipset: upgrade to ipset 2.4.7
+
+
+v1.8 (2009-01-10)
+=================
+- xt_TEE: IPv6 support
+- xt_TEE: do not include TOS value in routing decision
+- xt_TEE: fix switch-case inversion for name/IP display
+- xt_ipp2p: update manpages and help text
+- xt_ipp2p: remove log flooding
+- xt_portscan: update manpage about --grscan option caveats
+
+
+v1.7 (2008-12-25)
+=================
+- xt_ECHO: compile fix
+- avoid the use of "_init" which led to compile errors on some installations
+- build: do not unconditionally install ipset
+- doc: add manpages for xt_ECHO and xt_TEE
+- xt_ipp2p: kazaa detection code cleanup
+- xt_ipp2p: fix newline inspection in kazaa detection
+- xt_ipp2p: ensure better array bounds checking
+- xt_SYSRQ: improve security by hashing password
+
+
+v1.6 (2008-11-18)
+=================
+- build: support for Linux 2.6.17
+- build: compile fixes for 2.6.18 and 2.6.19
+- xt_ECHO: resolve compile errors in xt_ECHO
+- xt_ipp2p: parenthesize unaligned-access macros
+
+
+v1.5.7 (2008-09-01)
+===================
+- API layer: fix use of uninitialized 'hotdrop' variable
+- API layer: move to pskb-based signatures
+- xt_SYSRQ: compile fixes for Linux <= 2.6.19
+- ipset: adjust semaphore.h include for Linux >= 2.6.27
+- build: automatically run `depmod -a` on installation
+- add reworked xt_fuzzy module
+- add DHCP address match and mangle module
+- xt_portscan: IPv6 support
+- xt_SYSRQ: add missing module aliases
+
+
+v1.5.5 (2008-08-03)
+===================
+- manpage updates for xt_CHAOS, xt_IPMARK; README updates
+- build: properly recognize external Kbuild/Mbuild files
+- build: remove dependency on CONFIG_NETWORK_SECMARK
+- add the xt_SYSRQ target
+- add the xt_quota2 extension
+- import ipset extension group
+
+
+v1.5.4.1 (2008-04-26)
+=====================
+- build: fix compile error for 2.6.18-stable
+
+
+v1.5.4 (2008-04-09)
+===================
+- build: support building multiple files with one config option
+- API layer: add check for pskb relocation
+- doc: generate manpages
+- xt_ECHO: catch skb_linearize out-of-memory condition
+- xt_LOGMARK: add hook= and ctdir= fields in dump
+- xt_LOGMARK: fix comma output in ctstatus= list
+- xt_TEE: fix address copying bug
+- xt_TEE: make skb writable before attempting checksum update
+- add reworked xt_condition match
+- add reworked xt_ipp2p match
+- add reworked xt_IPMARK target
+
+
+v1.5.3 (2008-03-22)
+===================
+- support for Linux 2.6.18
+- add xt_ECHO sample target
+- add reworked xt_geoip match
+
+
+v1.5.2 (2008-03-04)
+===================
+- build: support for GNU make < 3.81 which does not have $(realpath)
+
+
+v1.5.1 (2008-02-21)
+===================
+- build: allow user to select what extensions to compile and install
+- build: allow external proejcts to be downloaded into the tree
+- xt_LOGMARK: dump classify mark, ctstate and ctstatus
+- add xt_CHAOS, xt_DELUDE and xt_portscan from Chaostables
+
+
+v1.5.0 (2008-02-11)
+===================
+Initial release with:
+- extensions: xt_LOGMARK, xt_TARPIT, xt_TEE
+- support for Linux >= 2.6.19

extensions/ACCOUNT/iptaccount.c

@@ -64,7 +64,7 @@ int main(int argc, char *argv[])
 	struct ipt_ACCOUNT_context ctx;
 	struct ipt_acc_handle_ip *entry;
 	int i;
-	int optchar;
+	char optchar;
 	bool doHandleUsage = false, doHandleFree = false, doTableNames = false;
 	bool doFlush = false, doContinue = false, doCSV = false;
 
@@ -200,19 +200,13 @@ int main(int argc, char *argv[])
 			while ((entry = ipt_ACCOUNT_get_next_entry(&ctx)) != NULL)
 			{
 				if (doCSV)
-					printf("%s;%llu;%llu;%llu;%llu\n",
+					printf("%s;%u;%u;%u;%u\n",
-					       addr_to_dotted(entry->ip),
+					       addr_to_dotted(entry->ip), entry->src_packets, entry->src_bytes,
-					       (unsigned long long)entry->src_packets,
+					       entry->dst_packets, entry->dst_bytes);
-					       (unsigned long long)entry->src_bytes,
-					       (unsigned long long)entry->dst_packets,
-					       (unsigned long long)entry->dst_bytes);
 				else
-					printf("IP: %s SRC packets: %llu bytes: %llu DST packets: %llu bytes: %llu\n",
+					printf("IP: %s SRC packets: %u bytes: %u DST packets: %u bytes: %u\n",
-					       addr_to_dotted(entry->ip),
+					       addr_to_dotted(entry->ip), entry->src_packets, entry->src_bytes,
-					       (unsigned long long)entry->src_packets,
+					       entry->dst_packets, entry->dst_bytes);
-					       (unsigned long long)entry->src_bytes,
-					       (unsigned long long)entry->dst_packets,
-					       (unsigned long long)entry->dst_bytes);
 			}
 
 			if (doContinue)

extensions/ACCOUNT/xt_ACCOUNT.c

@@ -15,7 +15,6 @@
 //#define DEBUG 1
 #include <linux/module.h>
 #include <linux/version.h>
-#include <net/net_namespace.h>
 #include <linux/skbuff.h>
 #include <linux/ip.h>
 #include <net/icmp.h>
@@ -23,14 +22,17 @@
 #include <net/tcp.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 
-#include <linux/semaphore.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
+    #include <linux/semaphore.h>
+#else
+    #include <asm/semaphore.h>
+#endif
 
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/string.h>
 #include <linux/spinlock.h>
 #include <asm/uaccess.h>
-#include <net/netns/generic.h>
 
 #include <net/route.h>
 #include "xt_ACCOUNT.h"
@@ -75,13 +77,13 @@ struct ipt_acc_handle {
 };
 
 /* Used for every IP entry
-   Size is 32 bytes so that 256 (class C network) * 16
+   Size is 16 bytes so that 256 (class C network) * 16
-   fits in a double kernel (zero) page (two consecutive kernel pages)*/
+   fits in one kernel (zero) page */
 struct ipt_acc_ip {
-	uint64_t src_packets;
+	uint32_t src_packets;
-	uint64_t src_bytes;
+	uint32_t src_bytes;
-	uint64_t dst_packets;
+	uint32_t dst_packets;
-	uint64_t dst_bytes;
+	uint32_t dst_bytes;
 };
 
 /*
@@ -102,28 +104,25 @@ struct ipt_acc_mask_8 {
 	struct ipt_acc_mask_16 *mask_16[256];
 };
 
-static int ipt_acc_net_id __read_mostly;
+static struct ipt_acc_table *ipt_acc_tables;
+static struct ipt_acc_handle *ipt_acc_handles;
+static void *ipt_acc_tmpbuf;
 
-struct ipt_acc_net {
+/* Spinlock used for manipulating the current accounting tables/data */
-	/* Spinlock used for manipulating the current accounting tables/data */
+static DEFINE_SPINLOCK(ipt_acc_lock);
-	spinlock_t ipt_acc_lock;
+/* Mutex (semaphore) used for manipulating userspace handles/snapshot data */
+static struct semaphore ipt_acc_userspace_mutex;
 
-	/* Mutex (semaphore) used for manipulating userspace handles/snapshot data */
+/* Allocates a page and clears it */
-	struct semaphore ipt_acc_userspace_mutex;
-
-	struct ipt_acc_table *ipt_acc_tables;
-	struct ipt_acc_handle *ipt_acc_handles;
-	void *ipt_acc_tmpbuf;
-};
-
-/* Allocates a page pair and clears it */
 static void *ipt_acc_zalloc_page(void)
 {
 	// Don't use get_zeroed_page until it's fixed in the kernel.
 	// get_zeroed_page(GFP_ATOMIC)
-	void *mem = (void *)__get_free_pages(GFP_ATOMIC, 2);
+	void *mem = (void *)__get_free_page(GFP_ATOMIC);
-	if (mem != NULL)
+	if (mem) {
-		memset(mem, 0,  2 *PAGE_SIZE);
+		memset (mem, 0, PAGE_SIZE);
+	}
+
 	return mem;
 }
 
@@ -136,7 +135,7 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 
 	/* Free for 8 bit network */
 	if (depth == 0) {
-		free_pages((unsigned long)data, 2);
+		free_page((unsigned long)data);
 		return;
 	}
 
@@ -144,10 +143,12 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 	if (depth == 1) {
 		struct ipt_acc_mask_16 *mask_16 = data;
 		unsigned int b;
-		for (b = 0; b <= 255; ++b)
+		for (b = 0; b <= 255; b++) {
-			if (mask_16->mask_24[b])
+			if (mask_16->mask_24[b]) {
-				free_pages((unsigned long)mask_16->mask_24[b], 2);
+				free_page((unsigned long)mask_16->mask_24[b]);
-		free_pages((unsigned long)data, 2);
+			}
+		}
+		free_page((unsigned long)data);
 		return;
 	}
 
@@ -159,13 +160,15 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 				struct ipt_acc_mask_16 *mask_16 =
 					((struct ipt_acc_mask_8 *)data)->mask_16[a];
 
-				for (b = 0; b <= 255; ++b)
+				for (b = 0; b <= 255; b++) {
-					if (mask_16->mask_24[b])
+					if (mask_16->mask_24[b]) {
-						free_pages((unsigned long)mask_16->mask_24[b], 2);
+						free_page((unsigned long)mask_16->mask_24[b]);
-				free_pages((unsigned long)mask_16, 2);
+					}
+				}
+				free_page((unsigned long)mask_16);
 			}
 		}
-		free_pages((unsigned long)data, 2);
+		free_page((unsigned long)data);
 		return;
 	}
 
@@ -176,8 +179,7 @@ static void ipt_acc_data_free(void *data, uint8_t depth)
 
 /* Look for existing table / insert new one.
    Return internal ID or -1 on error */
-static int ipt_acc_table_insert(struct ipt_acc_table *ipt_acc_tables,
+static int ipt_acc_table_insert(const char *name, __be32 ip, __be32 netmask)
-				const char *name, __be32 ip, __be32 netmask)
 {
 	unsigned int i;
 
@@ -264,15 +266,13 @@ static int ipt_acc_table_insert(struct ipt_acc_table *ipt_acc_tables,
 
 static int ipt_acc_checkentry(const struct xt_tgchk_param *par)
 {
-	struct ipt_acc_net *ian = net_generic(par->net, ipt_acc_net_id);
 	struct ipt_acc_info *info = par->targinfo;
 	int table_nr;
 
-	spin_lock_bh(&ian->ipt_acc_lock);
+	spin_lock_bh(&ipt_acc_lock);
-	table_nr = ipt_acc_table_insert(ian->ipt_acc_tables,
+	table_nr = ipt_acc_table_insert(info->table_name, info->net_ip,
-					info->table_name, info->net_ip,
 		info->net_mask);
-	spin_unlock_bh(&ian->ipt_acc_lock);
+	spin_unlock_bh(&ipt_acc_lock);
 
 	if (table_nr == -1) {
 		printk("ACCOUNT: Table insert problem. Aborting\n");
@@ -287,11 +287,10 @@ static int ipt_acc_checkentry(const struct xt_tgchk_param *par)
 
 static void ipt_acc_destroy(const struct xt_tgdtor_param *par)
 {
-	struct ipt_acc_net *ian = net_generic(par->net, ipt_acc_net_id);
 	unsigned int i;
 	struct ipt_acc_info *info = par->targinfo;
 
-	spin_lock_bh(&ian->ipt_acc_lock);
+	spin_lock_bh(&ipt_acc_lock);
 
 	pr_debug("ACCOUNT: ipt_acc_deleteentry called for table: %s (#%d)\n",
 		info->table_name, info->table_nr);
@@ -300,31 +299,31 @@ static void ipt_acc_destroy(const struct xt_tgdtor_param *par)
 
 	/* Look for table */
 	for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
-		if (strncmp(ian->ipt_acc_tables[i].name, info->table_name,
+		if (strncmp(ipt_acc_tables[i].name, info->table_name,
 		    ACCOUNT_TABLE_NAME_LEN) == 0) {
 			pr_debug("ACCOUNT: Found table at slot: %d\n", i);
 
-			ian->ipt_acc_tables[i].refcount--;
+			ipt_acc_tables[i].refcount--;
 			pr_debug("ACCOUNT: Refcount left: %d\n",
-				ian->ipt_acc_tables[i].refcount);
+				ipt_acc_tables[i].refcount);
 
 			/* Table not needed anymore? */
-			if (ian->ipt_acc_tables[i].refcount == 0) {
+			if (ipt_acc_tables[i].refcount == 0) {
 				pr_debug("ACCOUNT: Destroying table at slot: %d\n", i);
-				ipt_acc_data_free(ian->ipt_acc_tables[i].data,
+				ipt_acc_data_free(ipt_acc_tables[i].data,
-					ian->ipt_acc_tables[i].depth);
+					ipt_acc_tables[i].depth);
-				memset(&ian->ipt_acc_tables[i], 0,
+				memset(&ipt_acc_tables[i], 0,
 					sizeof(struct ipt_acc_table));
 			}
 
-			spin_unlock_bh(&ian->ipt_acc_lock);
+			spin_unlock_bh(&ipt_acc_lock);
 			return;
 		}
 	}
 
 	/* Table not found */
 	printk("ACCOUNT: Table %s not found for destroy\n", info->table_name);
-	spin_unlock_bh(&ian->ipt_acc_lock);
+	spin_unlock_bh(&ipt_acc_lock);
 }
 
 static void ipt_acc_depth0_insert(struct ipt_acc_mask_24 *mask_24,
@@ -479,25 +478,22 @@ static void ipt_acc_depth2_insert(struct ipt_acc_mask_8 *mask_8,
 	}
 }
 
-static unsigned int
+static unsigned int ipt_acc_target(struct sk_buff **pskb, const struct xt_action_param *par)
-ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
-	struct ipt_acc_net *ian = net_generic(par->state->net, ipt_acc_net_id);
-	struct ipt_acc_table *ipt_acc_tables = ian->ipt_acc_tables;
 	const struct ipt_acc_info *info =
 		par->targinfo;
 
-	__be32 src_ip = ip_hdr(skb)->saddr;
+	__be32 src_ip = ip_hdr(*pskb)->saddr;
-	__be32 dst_ip = ip_hdr(skb)->daddr;
+	__be32 dst_ip = ip_hdr(*pskb)->daddr;
-	uint32_t size = ntohs(ip_hdr(skb)->tot_len);
+	uint32_t size = ntohs(ip_hdr(*pskb)->tot_len);
 
-	spin_lock_bh(&ian->ipt_acc_lock);
+	spin_lock_bh(&ipt_acc_lock);
 
 	if (ipt_acc_tables[info->table_nr].name[0] == 0) {
 		printk("ACCOUNT: ipt_acc_target: Invalid table id %u. "
 			"IPs %u.%u.%u.%u/%u.%u.%u.%u\n", info->table_nr,
 			NIPQUAD(src_ip), NIPQUAD(dst_ip));
-		spin_unlock_bh(&ian->ipt_acc_lock);
+		spin_unlock_bh(&ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -509,7 +505,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 			ipt_acc_tables[info->table_nr].ip,
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
-		spin_unlock_bh(&ian->ipt_acc_lock);
+		spin_unlock_bh(&ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -520,7 +516,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 			ipt_acc_tables[info->table_nr].ip,
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
-		spin_unlock_bh(&ian->ipt_acc_lock);
+		spin_unlock_bh(&ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -531,7 +527,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 			ipt_acc_tables[info->table_nr].ip,
 			ipt_acc_tables[info->table_nr].netmask,
 			src_ip, dst_ip, size, &ipt_acc_tables[info->table_nr].itemcount);
-		spin_unlock_bh(&ian->ipt_acc_lock);
+		spin_unlock_bh(&ipt_acc_lock);
 		return XT_CONTINUE;
 	}
 
@@ -539,13 +535,13 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 		"Table id %u. IPs %u.%u.%u.%u/%u.%u.%u.%u\n",
 		info->table_nr, NIPQUAD(src_ip), NIPQUAD(dst_ip));
 
-	spin_unlock_bh(&ian->ipt_acc_lock);
+	spin_unlock_bh(&ipt_acc_lock);
 	return XT_CONTINUE;
 }
 
 /*
 	Functions dealing with "handles":
-	Handles are snapshots of an accounting state.
+	Handles are snapshots of a accounting state.
 
 	read snapshots are only for debugging the code
 	and are very expensive concerning speed/memory
@@ -560,7 +556,7 @@ ipt_acc_target(struct sk_buff *skb, const struct xt_action_param *par)
 	but there could be two or more applications accessing the data
 	at the same time.
 */
-static int ipt_acc_handle_find_slot(struct ipt_acc_handle *ipt_acc_handles)
+static int ipt_acc_handle_find_slot(void)
 {
 	unsigned int i;
 	/* Insert new table */
@@ -580,8 +576,7 @@ static int ipt_acc_handle_find_slot(struct ipt_acc_handle *ipt_acc_handles)
 	return -1;
 }
 
-static int ipt_acc_handle_free(struct ipt_acc_handle *ipt_acc_handles,
+static int ipt_acc_handle_free(unsigned int handle)
-			       unsigned int handle)
 {
 	if (handle >= ACCOUNT_MAX_HANDLES) {
 		printk("ACCOUNT: Invalid handle for ipt_acc_handle_free() specified:"
@@ -597,8 +592,7 @@ static int ipt_acc_handle_free(struct ipt_acc_handle *ipt_acc_handles,
 
 /* Prepare data for read without flush. Use only for debugging!
    Real applications should use read&flush as it's way more efficent */
-static int ipt_acc_handle_prepare_read(struct ipt_acc_table *ipt_acc_tables,
+static int ipt_acc_handle_prepare_read(char *tablename,
-				       char *tablename,
 		 struct ipt_acc_handle *dest, uint32_t *count)
 {
 	int table_nr = -1;
@@ -640,18 +634,18 @@ static int ipt_acc_handle_prepare_read(struct ipt_acc_table *ipt_acc_tables,
 		unsigned int b;
 
 		for (b = 0; b <= 255; b++) {
-			if (src_16->mask_24[b] == NULL)
+			if (src_16->mask_24[b]) {
-				continue;
+				if ((network_16->mask_24[b] =
-			if ((network_16->mask_24[b] =
+				    ipt_acc_zalloc_page()) == NULL) {
-			    ipt_acc_zalloc_page()) == NULL) {
+					printk("ACCOUNT: out of memory during copy of 16 bit "
-				printk("ACCOUNT: out of memory during copy of 16 bit "
+						"network in ipt_acc_handle_prepare_read()\n");
-					"network in ipt_acc_handle_prepare_read()\n");
+					ipt_acc_data_free(dest->data, depth);
-				ipt_acc_data_free(dest->data, depth);
+					return -1;
-				return -1;
+				}
-			}
 
-			memcpy(network_16->mask_24[b], src_16->mask_24[b],
+				memcpy(network_16->mask_24[b], src_16->mask_24[b],
-				sizeof(struct ipt_acc_mask_24));
+					sizeof(struct ipt_acc_mask_24));
+			}
 		}
 	} else if (depth == 2) {
 		struct ipt_acc_mask_8 *src_8 =
@@ -661,35 +655,35 @@ static int ipt_acc_handle_prepare_read(struct ipt_acc_table *ipt_acc_tables,
 		unsigned int a, b;
 
 		for (a = 0; a <= 255; a++) {
-			if (src_8->mask_16[a] == NULL)
+			if (src_8->mask_16[a]) {
-				continue;
+				if ((network_8->mask_16[a] =
-			if ((network_8->mask_16[a] =
-			    ipt_acc_zalloc_page()) == NULL) {
-				printk("ACCOUNT: out of memory during copy of 24 bit network"
-					" in ipt_acc_handle_prepare_read()\n");
-				ipt_acc_data_free(dest->data, depth);
-				return -1;
-			}
-
-			memcpy(network_8->mask_16[a], src_8->mask_16[a],
-				sizeof(struct ipt_acc_mask_16));
-
-			src_16 = src_8->mask_16[a];
-			network_16 = network_8->mask_16[a];
-
-			for (b = 0; b <= 255; b++) {
-				if (src_16->mask_24[b] == NULL)
-					continue;
-				if ((network_16->mask_24[b] =
 				    ipt_acc_zalloc_page()) == NULL) {
-					printk("ACCOUNT: out of memory during copy of 16 bit"
+					printk("ACCOUNT: out of memory during copy of 24 bit network"
-						" network in ipt_acc_handle_prepare_read()\n");
+						" in ipt_acc_handle_prepare_read()\n");
 					ipt_acc_data_free(dest->data, depth);
 					return -1;
 				}
 
-				memcpy(network_16->mask_24[b], src_16->mask_24[b],
+				memcpy(network_8->mask_16[a], src_8->mask_16[a],
-					sizeof(struct ipt_acc_mask_24));
+					sizeof(struct ipt_acc_mask_16));
+
+				src_16 = src_8->mask_16[a];
+				network_16 = network_8->mask_16[a];
+
+				for (b = 0; b <= 255; b++) {
+					if (src_16->mask_24[b]) {
+						if ((network_16->mask_24[b] =
+						    ipt_acc_zalloc_page()) == NULL) {
+							printk("ACCOUNT: out of memory during copy of 16 bit"
+								" network in ipt_acc_handle_prepare_read()\n");
+							ipt_acc_data_free(dest->data, depth);
+							return -1;
+						}
+
+						memcpy(network_16->mask_24[b], src_16->mask_24[b],
+							sizeof(struct ipt_acc_mask_24));
+					}
+				}
 			}
 		}
 	}
@@ -700,8 +694,7 @@ static int ipt_acc_handle_prepare_read(struct ipt_acc_table *ipt_acc_tables,
 }
 
 /* Prepare data for read and flush it */
-static int ipt_acc_handle_prepare_read_flush(struct ipt_acc_table *ipt_acc_tables,
+static int ipt_acc_handle_prepare_read_flush(char *tablename,
-					     char *tablename,
 			   struct ipt_acc_handle *dest, uint32_t *count)
 {
 	int table_nr;
@@ -742,8 +735,7 @@ static int ipt_acc_handle_prepare_read_flush(struct ipt_acc_table *ipt_acc_table
 /* Copy 8 bit network data into a prepared buffer.
    We only copy entries != 0 to increase performance.
 */
-static int ipt_acc_handle_copy_data(struct ipt_acc_net *ian,
+static int ipt_acc_handle_copy_data(void *to_user, unsigned long *to_user_pos,
-				    void *to_user, unsigned long *to_user_pos,
 				unsigned long *tmpbuf_pos,
 				struct ipt_acc_mask_24 *data,
 				uint32_t net_ip, uint32_t net_OR_mask)
@@ -753,26 +745,25 @@ static int ipt_acc_handle_copy_data(struct ipt_acc_net *ian,
 	unsigned int i;
 
 	for (i = 0; i <= 255; i++) {
-		if (data->ip[i].src_packets == 0 &&
+		if (data->ip[i].src_packets || data->ip[i].dst_packets) {
-		    data->ip[i].dst_packets == 0)
+			handle_ip.ip = net_ip | net_OR_mask | i;
-			continue;
 
-		handle_ip.ip = net_ip | net_OR_mask | i;
+			handle_ip.src_packets = data->ip[i].src_packets;
-		handle_ip.src_packets = data->ip[i].src_packets;
+			handle_ip.src_bytes = data->ip[i].src_bytes;
-		handle_ip.src_bytes = data->ip[i].src_bytes;
+			handle_ip.dst_packets = data->ip[i].dst_packets;
-		handle_ip.dst_packets = data->ip[i].dst_packets;
+			handle_ip.dst_bytes = data->ip[i].dst_bytes;
-		handle_ip.dst_bytes = data->ip[i].dst_bytes;
 
-		/* Temporary buffer full? Flush to userspace */
+			/* Temporary buffer full? Flush to userspace */
-		if (*tmpbuf_pos + handle_ip_size >= PAGE_SIZE) {
+			if (*tmpbuf_pos + handle_ip_size >= PAGE_SIZE) {
-			if (copy_to_user(to_user + *to_user_pos, ian->ipt_acc_tmpbuf,
+				if (copy_to_user(to_user + *to_user_pos, ipt_acc_tmpbuf,
-			    *tmpbuf_pos))
+				    *tmpbuf_pos))
-				return -EFAULT;
+					return -EFAULT;
-			*to_user_pos = *to_user_pos + *tmpbuf_pos;
+				*to_user_pos = *to_user_pos + *tmpbuf_pos;
-			*tmpbuf_pos = 0;
+				*tmpbuf_pos = 0;
+			}
+			memcpy(ipt_acc_tmpbuf + *tmpbuf_pos, &handle_ip, handle_ip_size);
+			*tmpbuf_pos += handle_ip_size;
 		}
-		memcpy(ian->ipt_acc_tmpbuf + *tmpbuf_pos, &handle_ip, handle_ip_size);
-		*tmpbuf_pos += handle_ip_size;
 	}
 
 	return 0;
@@ -782,8 +773,7 @@ static int ipt_acc_handle_copy_data(struct ipt_acc_net *ian,
    We only copy entries != 0 to increase performance.
    Overwrites ipt_acc_tmpbuf.
 */
-static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
+static int ipt_acc_handle_get_data(uint32_t handle, void *to_user)
-				   uint32_t handle, void *to_user)
 {
 	unsigned long to_user_pos = 0, tmpbuf_pos = 0;
 	uint32_t net_ip;
@@ -795,25 +785,25 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 		return -1;
 	}
 
-	if (ian->ipt_acc_handles[handle].data == NULL) {
+	if (ipt_acc_handles[handle].data == NULL) {
 		printk("ACCOUNT: handle %u is BROKEN: Contains no data\n", handle);
 		return -1;
 	}
 
-	net_ip = ntohl(ian->ipt_acc_handles[handle].ip);
+	net_ip = ntohl(ipt_acc_handles[handle].ip);
-	depth = ian->ipt_acc_handles[handle].depth;
+	depth = ipt_acc_handles[handle].depth;
 
 	/* 8 bit network */
 	if (depth == 0) {
 		struct ipt_acc_mask_24 *network =
-			ian->ipt_acc_handles[handle].data;
+			ipt_acc_handles[handle].data;
-		if (ipt_acc_handle_copy_data(ian, to_user, &to_user_pos, &tmpbuf_pos,
+		if (ipt_acc_handle_copy_data(to_user, &to_user_pos, &tmpbuf_pos,
 		    network, net_ip, 0))
 			return -1;
 
 		/* Flush remaining data to userspace */
 		if (tmpbuf_pos)
-			if (copy_to_user(to_user + to_user_pos, ian->ipt_acc_tmpbuf, tmpbuf_pos))
+			if (copy_to_user(to_user + to_user_pos, ipt_acc_tmpbuf, tmpbuf_pos))
 				return -1;
 
 		return 0;
@@ -822,13 +812,13 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 	/* 16 bit network */
 	if (depth == 1) {
 		struct ipt_acc_mask_16 *network_16 =
-			ian->ipt_acc_handles[handle].data;
+			ipt_acc_handles[handle].data;
 		unsigned int b;
 		for (b = 0; b <= 255; b++) {
 			if (network_16->mask_24[b]) {
 				struct ipt_acc_mask_24 *network =
 					network_16->mask_24[b];
-				if (ipt_acc_handle_copy_data(ian, to_user, &to_user_pos,
+				if (ipt_acc_handle_copy_data(to_user, &to_user_pos,
 				    &tmpbuf_pos, network, net_ip, (b << 8)))
 					return -1;
 			}
@@ -836,7 +826,7 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 
 		/* Flush remaining data to userspace */
 		if (tmpbuf_pos)
-			if (copy_to_user(to_user + to_user_pos, ian->ipt_acc_tmpbuf, tmpbuf_pos))
+			if (copy_to_user(to_user + to_user_pos, ipt_acc_tmpbuf, tmpbuf_pos))
 				return -1;
 
 		return 0;
@@ -845,7 +835,7 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 	/* 24 bit network */
 	if (depth == 2) {
 		struct ipt_acc_mask_8 *network_8 =
-			ian->ipt_acc_handles[handle].data;
+			ipt_acc_handles[handle].data;
 		unsigned int a, b;
 		for (a = 0; a <= 255; a++) {
 			if (network_8->mask_16[a]) {
@@ -855,7 +845,7 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 					if (network_16->mask_24[b]) {
 						struct ipt_acc_mask_24 *network =
 							network_16->mask_24[b];
-						if (ipt_acc_handle_copy_data(ian, to_user,
+						if (ipt_acc_handle_copy_data(to_user,
 						    &to_user_pos, &tmpbuf_pos,
 						    network, net_ip, (a << 16) | (b << 8)))
 							return -1;
@@ -866,7 +856,7 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 
 		/* Flush remaining data to userspace */
 		if (tmpbuf_pos)
-			if (copy_to_user(to_user + to_user_pos, ian->ipt_acc_tmpbuf, tmpbuf_pos))
+			if (copy_to_user(to_user + to_user_pos, ipt_acc_tmpbuf, tmpbuf_pos))
 				return -1;
 
 		return 0;
@@ -878,8 +868,6 @@ static int ipt_acc_handle_get_data(struct ipt_acc_net *ian,
 static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 			void *user, unsigned int len)
 {
-	struct net *net = sock_net(sk);
-	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
 	struct ipt_acc_handle_sockopt handle;
 	int ret = -EINVAL;
 
@@ -901,16 +889,16 @@ static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 			break;
 		}
 
-		down(&ian->ipt_acc_userspace_mutex);
+		down(&ipt_acc_userspace_mutex);
-		ret = ipt_acc_handle_free(ian->ipt_acc_handles, handle.handle_nr);
+		ret = ipt_acc_handle_free(handle.handle_nr);
-		up(&ian->ipt_acc_userspace_mutex);
+		up(&ipt_acc_userspace_mutex);
 		break;
 	case IPT_SO_SET_ACCOUNT_HANDLE_FREE_ALL: {
 		unsigned int i;
-		down(&ian->ipt_acc_userspace_mutex);
+		down(&ipt_acc_userspace_mutex);
 		for (i = 0; i < ACCOUNT_MAX_HANDLES; i++)
-			ipt_acc_handle_free(ian->ipt_acc_handles, i);
+			ipt_acc_handle_free(i);
-		up(&ian->ipt_acc_userspace_mutex);
+		up(&ipt_acc_userspace_mutex);
 		ret = 0;
 		break;
 	}
@@ -923,8 +911,6 @@ static int ipt_acc_set_ctl(struct sock *sk, int cmd,
 
 static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 {
-	struct net *net = sock_net(sk);
-	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
 	struct ipt_acc_handle_sockopt handle;
 	int ret = -EINVAL;
 
@@ -949,28 +935,28 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 			break;
 		}
 
-		spin_lock_bh(&ian->ipt_acc_lock);
+		spin_lock_bh(&ipt_acc_lock);
 		if (cmd == IPT_SO_GET_ACCOUNT_PREPARE_READ_FLUSH)
 			ret = ipt_acc_handle_prepare_read_flush(
-				ian->ipt_acc_tables, handle.name, &dest, &handle.itemcount);
+				handle.name, &dest, &handle.itemcount);
 		else
 			ret = ipt_acc_handle_prepare_read(
-				ian->ipt_acc_tables, handle.name, &dest, &handle.itemcount);
+				handle.name, &dest, &handle.itemcount);
-		spin_unlock_bh(&ian->ipt_acc_lock);
+		spin_unlock_bh(&ipt_acc_lock);
 		// Error occured during prepare_read?
 		if (ret == -1)
 			return -EINVAL;
 
 		/* Allocate a userspace handle */
-		down(&ian->ipt_acc_userspace_mutex);
+		down(&ipt_acc_userspace_mutex);
-		if ((handle.handle_nr = ipt_acc_handle_find_slot(ian->ipt_acc_handles)) == -1) {
+		if ((handle.handle_nr = ipt_acc_handle_find_slot()) == -1) {
 			ipt_acc_data_free(dest.data, dest.depth);
-			up(&ian->ipt_acc_userspace_mutex);
+			up(&ipt_acc_userspace_mutex);
 			return -EINVAL;
 		}
-		memcpy(&ian->ipt_acc_handles[handle.handle_nr], &dest,
+		memcpy(&ipt_acc_handles[handle.handle_nr], &dest,
 			sizeof(struct ipt_acc_handle));
-		up(&ian->ipt_acc_userspace_mutex);
+		up(&ipt_acc_userspace_mutex);
 
 		if (copy_to_user(user, &handle,
 		    sizeof(struct ipt_acc_handle_sockopt))) {
@@ -999,19 +985,19 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 			break;
 		}
 
-		if (*len < ian->ipt_acc_handles[handle.handle_nr].itemcount
+		if (*len < ipt_acc_handles[handle.handle_nr].itemcount
 		    * sizeof(struct ipt_acc_handle_ip)) {
 			printk("ACCOUNT: ipt_acc_get_ctl: not enough space (%u < %zu)"
 				" to store data from IPT_SO_GET_ACCOUNT_GET_DATA\n",
-				*len, ian->ipt_acc_handles[handle.handle_nr].itemcount
+				*len, ipt_acc_handles[handle.handle_nr].itemcount
 				* sizeof(struct ipt_acc_handle_ip));
 			ret = -ENOMEM;
 			break;
 		}
 
-		down(&ian->ipt_acc_userspace_mutex);
+		down(&ipt_acc_userspace_mutex);
-		ret = ipt_acc_handle_get_data(ian, handle.handle_nr, user);
+		ret = ipt_acc_handle_get_data(handle.handle_nr, user);
-		up(&ian->ipt_acc_userspace_mutex);
+		up(&ipt_acc_userspace_mutex);
 		if (ret) {
 			printk("ACCOUNT: ipt_acc_get_ctl: ipt_acc_handle_get_data"
 				" failed for handle %u\n", handle.handle_nr);
@@ -1031,11 +1017,11 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 
 		/* Find out how many handles are in use */
 		handle.itemcount = 0;
-		down(&ian->ipt_acc_userspace_mutex);
+		down(&ipt_acc_userspace_mutex);
 		for (i = 0; i < ACCOUNT_MAX_HANDLES; i++)
-			if (ian->ipt_acc_handles[i].data)
+			if (ipt_acc_handles[i].data)
 				handle.itemcount++;
-		up(&ian->ipt_acc_userspace_mutex);
+		up(&ipt_acc_userspace_mutex);
 
 		if (copy_to_user(user, &handle,
 		    sizeof(struct ipt_acc_handle_sockopt))) {
@@ -1049,38 +1035,38 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 		uint32_t size = 0, i, name_len;
 		char *tnames;
 
-		spin_lock_bh(&ian->ipt_acc_lock);
+		spin_lock_bh(&ipt_acc_lock);
 
 		/* Determine size of table names */
 		for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
-			if (ian->ipt_acc_tables[i].name[0] != 0)
+			if (ipt_acc_tables[i].name[0] != 0)
-				size += strlen(ian->ipt_acc_tables[i].name) + 1;
+				size += strlen(ipt_acc_tables[i].name) + 1;
 		}
 		size += 1;	/* Terminating NULL character */
 
 		if (*len < size || size > PAGE_SIZE) {
-			spin_unlock_bh(&ian->ipt_acc_lock);
+			spin_unlock_bh(&ipt_acc_lock);
 			printk("ACCOUNT: ipt_acc_get_ctl: not enough space (%u < %u < %lu)"
 				" to store table names\n", *len, size, PAGE_SIZE);
 			ret = -ENOMEM;
 			break;
 		}
 		/* Copy table names to userspace */
-		tnames = ian->ipt_acc_tmpbuf;
+		tnames = ipt_acc_tmpbuf;
 		for (i = 0; i < ACCOUNT_MAX_TABLES; i++) {
-			if (ian->ipt_acc_tables[i].name[0] != 0) {
+			if (ipt_acc_tables[i].name[0] != 0) {
-				name_len = strlen(ian->ipt_acc_tables[i].name) + 1;
+				name_len = strlen(ipt_acc_tables[i].name) + 1;
-				memcpy(tnames, ian->ipt_acc_tables[i].name, name_len);
+				memcpy(tnames, ipt_acc_tables[i].name, name_len);
 				tnames += name_len;
 			}
 		}
-		spin_unlock_bh(&ian->ipt_acc_lock);
+		spin_unlock_bh(&ipt_acc_lock);
 
 		/* Terminating NULL character */
 		*tnames = 0;
 
 		/* Transfer to userspace */
-		if (copy_to_user(user, ian->ipt_acc_tmpbuf, size))
+		if (copy_to_user(user, ipt_acc_tmpbuf, size))
 			return -EFAULT;
 
 		ret = 0;
@@ -1093,59 +1079,6 @@ static int ipt_acc_get_ctl(struct sock *sk, int cmd, void *user, int *len)
 	return ret;
 }
 
-static int __net_init ipt_acc_net_init(struct net *net)
-{
-	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
-
-	memset(ian, 0, sizeof(*ian));
-	sema_init(&ian->ipt_acc_userspace_mutex, 1);
-
-	ian->ipt_acc_tables = kcalloc(ACCOUNT_MAX_TABLES,
-		sizeof(struct ipt_acc_table), GFP_KERNEL);
-	if (ian->ipt_acc_tables == NULL) {
-		printk("ACCOUNT: Out of memory allocating account_tables structure");
-		goto error_cleanup;
-	}
-	ian->ipt_acc_handles = kcalloc(ACCOUNT_MAX_HANDLES,
-		sizeof(struct ipt_acc_handle), GFP_KERNEL);
-	if (ian->ipt_acc_handles == NULL) {
-		printk("ACCOUNT: Out of memory allocating account_handles structure");
-		goto error_cleanup;
-	}
-
-	/* Allocate one page as temporary storage */
-	ian->ipt_acc_tmpbuf = (void *)__get_free_pages(GFP_KERNEL, 2);
-	if (ian->ipt_acc_tmpbuf == NULL) {
-		printk("ACCOUNT: Out of memory for temporary buffer page\n");
-		goto error_cleanup;
-	}
-
-	return 0;
-
- error_cleanup:
-	kfree(ian->ipt_acc_tables);
-	kfree(ian->ipt_acc_handles);
-	free_pages((unsigned long)ian->ipt_acc_tmpbuf, 2);
-
-	return -ENOMEM;
-}
-
-static void __net_exit ipt_acc_net_exit(struct net *net)
-{
-	struct ipt_acc_net *ian = net_generic(net, ipt_acc_net_id);
-
-	kfree(ian->ipt_acc_tables);
-	kfree(ian->ipt_acc_handles);
-	free_pages((unsigned long)ian->ipt_acc_tmpbuf, 2);
-}
-
-static struct pernet_operations ipt_acc_net_ops = {
-	.init = ipt_acc_net_init,
-	.exit = ipt_acc_net_exit,
-	.id   = &ipt_acc_net_id,
-	.size = sizeof(struct ipt_acc_net),
-};
-
 static struct xt_target xt_acc_reg __read_mostly = {
 	.name = "ACCOUNT",
 	.revision = 1,
@@ -1169,41 +1102,63 @@ static struct nf_sockopt_ops ipt_acc_sockopts = {
 
 static int __init account_tg_init(void)
 {
-	int ret;
+	sema_init(&ipt_acc_userspace_mutex, 1);
 
-	ret = register_pernet_subsys(&ipt_acc_net_ops);
+	if ((ipt_acc_tables =
-	if (ret < 0) {
+	    kmalloc(ACCOUNT_MAX_TABLES *
-		pr_err("ACCOUNT: cannot register per net operations.\n");
+	    sizeof(struct ipt_acc_table), GFP_KERNEL)) == NULL) {
-		goto error_out;
+		printk("ACCOUNT: Out of memory allocating account_tables structure");
+		goto error_cleanup;
+	}
+	memset(ipt_acc_tables, 0,
+		ACCOUNT_MAX_TABLES * sizeof(struct ipt_acc_table));
+
+	if ((ipt_acc_handles =
+	    kmalloc(ACCOUNT_MAX_HANDLES *
+	    sizeof(struct ipt_acc_handle), GFP_KERNEL)) == NULL) {
+		printk("ACCOUNT: Out of memory allocating account_handles structure");
+		goto error_cleanup;
+	}
+	memset(ipt_acc_handles, 0,
+		ACCOUNT_MAX_HANDLES * sizeof(struct ipt_acc_handle));
+
+	/* Allocate one page as temporary storage */
+	if ((ipt_acc_tmpbuf = (void*)__get_free_page(GFP_KERNEL)) == NULL) {
+		printk("ACCOUNT: Out of memory for temporary buffer page\n");
+		goto error_cleanup;
 	}
 
 	/* Register setsockopt */
-	ret = nf_register_sockopt(&ipt_acc_sockopts);
+	if (nf_register_sockopt(&ipt_acc_sockopts) < 0) {
-	if (ret < 0) {
+		printk("ACCOUNT: Can't register sockopts. Aborting\n");
-		pr_err("ACCOUNT: cannot register sockopts.\n");
+		goto error_cleanup;
-		goto unreg_pernet;
 	}
 
-	ret = xt_register_target(&xt_acc_reg);
+	if (xt_register_target(&xt_acc_reg))
-	if (ret < 0) {
+		goto error_cleanup;
-		pr_err("ACCOUNT: cannot register sockopts.\n");
+
-		goto unreg_sockopt;
-	}
 	return 0;
 
- unreg_sockopt:
+error_cleanup:
-	nf_unregister_sockopt(&ipt_acc_sockopts);
+	if (ipt_acc_tables)
- unreg_pernet:
+		kfree(ipt_acc_tables);
-	unregister_pernet_subsys(&ipt_acc_net_ops);
+	if (ipt_acc_handles)
- error_out:
+		kfree(ipt_acc_handles);
-        return ret;
+	if (ipt_acc_tmpbuf)
+		free_page((unsigned long)ipt_acc_tmpbuf);
+
+	return -EINVAL;
 }
 
 static void __exit account_tg_exit(void)
 {
 	xt_unregister_target(&xt_acc_reg);
+
 	nf_unregister_sockopt(&ipt_acc_sockopts);
-	unregister_pernet_subsys(&ipt_acc_net_ops);
+
+	kfree(ipt_acc_tables);
+	kfree(ipt_acc_handles);
+	free_page((unsigned long)ipt_acc_tmpbuf);
 }
 
 module_init(account_tg_init);

extensions/ACCOUNT/xt_ACCOUNT.h

@@ -59,11 +59,11 @@ struct ipt_acc_handle_sockopt {
 	Used for every IP when returning data
 */
 struct ipt_acc_handle_ip {
-	__be32 ip, __dummy;
+	__be32 ip;
-	uint64_t src_packets;
+	uint32_t src_packets;
-	uint64_t src_bytes;
+	uint32_t src_bytes;
-	uint64_t dst_packets;
+	uint32_t dst_packets;
-	uint64_t dst_bytes;
+	uint32_t dst_bytes;
 };
 
 #endif /* _IPT_ACCOUNT_H */

extensions/Kbuild

@@ -7,14 +7,18 @@ obj-m                    += compat_xtables.o
 
 obj-${build_ACCOUNT}     += ACCOUNT/
 obj-${build_CHAOS}       += xt_CHAOS.o
+obj-${build_CHECKSUM}    += xt_CHECKSUM.o
 obj-${build_DELUDE}      += xt_DELUDE.o
 obj-${build_DHCPMAC}     += xt_DHCPMAC.o
 obj-${build_DNETMAP}     += xt_DNETMAP.o
+ifeq (${VERSION},3)
 obj-${build_ECHO}        += xt_ECHO.o
+endif
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
 obj-${build_SYSRQ}       += xt_SYSRQ.o
 obj-${build_TARPIT}      += xt_TARPIT.o
+obj-${build_TEE}         += xt_TEE.o
 obj-${build_condition}   += xt_condition.o
 obj-${build_fuzzy}       += xt_fuzzy.o
 obj-${build_geoip}       += xt_geoip.o

extensions/Mbuild

@@ -2,6 +2,7 @@
 
 obj-${build_ACCOUNT}     += ACCOUNT/
 obj-${build_CHAOS}       += libxt_CHAOS.so
+obj-${build_CHECKSUM}    += libxt_CHECKSUM.so
 obj-${build_DELUDE}      += libxt_DELUDE.so
 obj-${build_DHCPMAC}     += libxt_DHCPMAC.so libxt_dhcpmac.so
 obj-${build_DNETMAP}     += libxt_DNETMAP.so
@@ -10,6 +11,7 @@ obj-${build_IPMARK}      += libxt_IPMARK.so
 obj-${build_LOGMARK}     += libxt_LOGMARK.so
 obj-${build_SYSRQ}       += libxt_SYSRQ.so
 obj-${build_TARPIT}      += libxt_TARPIT.so
+obj-${build_TEE}         += libxt_TEE.so
 obj-${build_condition}   += libxt_condition.so
 obj-${build_fuzzy}       += libxt_fuzzy.so
 obj-${build_geoip}       += libxt_geoip.so

extensions/compat_nfinetaddr.h

@@ -0,0 +1,14 @@
+#ifndef _COMPAT_NFINETADDR_H
+#define _COMPAT_NFINETADDR_H 1
+
+#include <linux/in.h>
+#include <linux/in6.h>
+
+union nf_inet_addr {
+	__be32 ip;
+	__be32 ip6[4];
+	struct in_addr in;
+	struct in6_addr in6;
+};
+
+#endif /* _COMPAT_NFINETADDR_H */

extensions/compat_skbuff.h

@@ -4,8 +4,34 @@
 struct tcphdr;
 struct udphdr;
 
-#define skb_ifindex(skb) (skb)->skb_iif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 30)
-#define skb_nfmark(skb) (((struct sk_buff *)(skb))->mark)
+static inline void skb_dst_set(struct sk_buff *skb, struct dst_entry *dst)
+{
+	skb->dst = dst;
+}
+
+static inline struct dst_entry *skb_dst(const struct sk_buff *skb)
+{
+	return skb->dst;
+}
+
+static inline struct rtable *skb_rtable(const struct sk_buff *skb)
+{
+	return (void *)skb->dst;
+}
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
+#	define skb_ifindex(skb) \
+		(((skb)->input_dev != NULL) ? (skb)->input_dev->ifindex : 0)
+#	define skb_nfmark(skb) (((struct sk_buff *)(skb))->nfmark)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 32)
+#	define skb_ifindex(skb) (skb)->iif
+#	define skb_nfmark(skb) (((struct sk_buff *)(skb))->mark)
+#else
+#	define skb_ifindex(skb) (skb)->skb_iif
+#	define skb_nfmark(skb) (((struct sk_buff *)(skb))->mark)
+#endif
 
 #ifdef CONFIG_NETWORK_SECMARK
 #	define skb_secmark(skb) ((skb)->secmark)
@@ -13,4 +39,24 @@ struct udphdr;
 #	define skb_secmark(skb) 0
 #endif
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 21)
+#	define ip_hdr(skb) ((skb)->nh.iph)
+#	define ip_hdrlen(skb) (ip_hdr(skb)->ihl * 4)
+#	define ipv6_hdr(skb) ((skb)->nh.ipv6h)
+#	define skb_network_header(skb) ((skb)->nh.raw)
+#	define skb_transport_header(skb) ((skb)->h.raw)
+static inline void skb_reset_network_header(struct sk_buff *skb)
+{
+	skb->nh.raw = skb->data;
+}
+static inline struct tcphdr *tcp_hdr(const struct sk_buff *skb)
+{
+	return (void *)skb_transport_header(skb);
+}
+static inline struct udphdr *udp_hdr(const struct sk_buff *skb)
+{
+	return (void *)skb_transport_header(skb);
+}
+#endif
+
 #endif /* COMPAT_SKBUFF_H */

extensions/compat_xtables.c

@@ -21,13 +21,588 @@
 #include <net/ip.h>
 #include <net/ipv6.h>
 #include <net/route.h>
-#include <linux/export.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 2, 0)
+#	include <linux/export.h>
+#endif
 #include "compat_skbuff.h"
 #include "compat_xtnu.h"
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
 #	define WITH_IPV6 1
 #endif
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 22)
+static int xtnu_match_run(const struct sk_buff *skb,
+    const struct net_device *in, const struct net_device *out,
+    const struct xt_match *cm, const void *matchinfo, int offset,
+    unsigned int protoff, int *hotdrop)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+static bool xtnu_match_run(const struct sk_buff *skb,
+    const struct net_device *in, const struct net_device *out,
+    const struct xt_match *cm, const void *matchinfo, int offset,
+    unsigned int protoff, bool *hotdrop)
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+{
+	struct xtnu_match *nm = xtcompat_numatch(cm);
+	bool lo_ret;
+	struct xt_action_param local_par;
+	local_par.in        = in;
+	local_par.out       = out;
+	local_par.match     = cm;
+	local_par.matchinfo = matchinfo;
+	local_par.fragoff   = offset;
+	local_par.thoff     = protoff;
+	local_par.hotdrop   = false;
+	local_par.family    = NFPROTO_UNSPEC; /* don't have that info */
+
+	if (nm == NULL || nm->match == NULL)
+		return false;
+	lo_ret = nm->match(skb, &local_par);
+	*hotdrop = local_par.hotdrop;
+	return lo_ret;
+}
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) && \
+    LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+static bool xtnu_match_run(const struct sk_buff *skb,
+    const struct xt_match_param *par)
+{
+	struct xtnu_match *nm = xtcompat_numatch(par->match);
+	struct xt_action_param local_par;
+	bool ret;
+
+	local_par.in        = par->in;
+	local_par.out       = par->out;
+	local_par.match     = par->match;
+	local_par.matchinfo = par->matchinfo;
+	local_par.fragoff   = par->fragoff;
+	local_par.thoff     = par->thoff;
+	local_par.hotdrop   = false;
+	local_par.family    = par->family;
+
+	if (nm == NULL || nm->match == NULL)
+		return false;
+	ret = nm->match(skb, &local_par);
+	*par->hotdrop = local_par.hotdrop;
+	return ret;
+}
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+static int xtnu_match_check(const char *table, const void *entry,
+    const struct xt_match *cm, void *matchinfo, unsigned int matchinfosize,
+    unsigned int hook_mask)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 22)
+static int xtnu_match_check(const char *table, const void *entry,
+    const struct xt_match *cm, void *matchinfo, unsigned int hook_mask)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+static bool xtnu_match_check(const char *table, const void *entry,
+    const struct xt_match *cm, void *matchinfo, unsigned int hook_mask)
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+{
+	struct xtnu_match *nm = xtcompat_numatch(cm);
+	struct xt_mtchk_param local_par = {
+		.table     = table,
+		.entryinfo = entry,
+		.match     = cm,
+		.matchinfo = matchinfo,
+		.hook_mask = hook_mask,
+		.family    = NFPROTO_UNSPEC,
+	};
+
+	if (nm == NULL)
+		return false;
+	if (nm->checkentry == NULL)
+		return true;
+	return nm->checkentry(&local_par) == 0;
+}
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) && \
+    LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+static bool xtnu_match_check(const struct xt_mtchk_param *par)
+{
+	struct xtnu_match *nm = xtcompat_numatch(par->match);
+
+	if (nm == NULL)
+		return false;
+	if (nm->checkentry == NULL)
+		return true;
+	return nm->checkentry(par) == 0;
+}
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+static void xtnu_match_destroy(const struct xt_match *cm, void *matchinfo,
+    unsigned int matchinfosize)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+static void xtnu_match_destroy(const struct xt_match *cm, void *matchinfo)
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+{
+	struct xtnu_match *nm = xtcompat_numatch(cm);
+	struct xt_mtdtor_param local_par = {
+		.match     = cm,
+		.matchinfo = matchinfo,
+		.family    = NFPROTO_UNSPEC,
+	};
+
+	if (nm != NULL && nm->destroy != NULL)
+		nm->destroy(&local_par);
+}
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+int xtnu_register_match(struct xtnu_match *nt)
+{
+	struct xt_match *ct;
+	char *tmp;
+	int ret;
+
+	ct = kzalloc(sizeof(struct xt_match), GFP_KERNEL);
+	if (ct == NULL)
+		return -ENOMEM;
+
+	tmp = (char *)ct->name;
+	memcpy(tmp, nt->name, sizeof(nt->name));
+	tmp = (char *)(ct->name + sizeof(ct->name) - sizeof(void *));
+	*(tmp-1) = '\0';
+	memcpy(tmp, &nt, sizeof(void *));
+
+	ct->revision   = nt->revision;
+	ct->family     = nt->family;
+	ct->table      = (char *)nt->table;
+	ct->hooks      = nt->hooks;
+	ct->proto      = nt->proto;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+	ct->match      = xtnu_match_run;
+	ct->checkentry = xtnu_match_check;
+	ct->destroy    = xtnu_match_destroy;
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+	ct->match      = xtnu_match_run;
+	ct->checkentry = xtnu_match_check;
+	ct->destroy    = nt->destroy;
+#else
+	ct->match      = nt->match;
+	ct->checkentry = xtnu_match_check;
+	ct->destroy    = nt->destroy;
+#endif
+	ct->matchsize  = nt->matchsize;
+	ct->me         = nt->me;
+
+	nt->__compat_match = ct;
+	ret = xt_register_match(ct);
+	if (ret != 0)
+		kfree(ct);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(xtnu_register_match);
+
+int xtnu_register_matches(struct xtnu_match *nt, unsigned int num)
+{
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < num; ++i) {
+		ret = xtnu_register_match(&nt[i]);
+		if (ret < 0) {
+			if (i > 0)
+				xtnu_unregister_matches(nt, i);
+			return ret;
+		}
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(xtnu_register_matches);
+
+void xtnu_unregister_match(struct xtnu_match *nt)
+{
+	xt_unregister_match(nt->__compat_match);
+	kfree(nt->__compat_match);
+}
+EXPORT_SYMBOL_GPL(xtnu_unregister_match);
+
+void xtnu_unregister_matches(struct xtnu_match *nt, unsigned int num)
+{
+	unsigned int i;
+
+	for (i = 0; i < num; ++i)
+		xtnu_unregister_match(&nt[i]);
+}
+EXPORT_SYMBOL_GPL(xtnu_unregister_matches);
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+static unsigned int xtnu_target_run(struct sk_buff **pskb,
+    const struct net_device *in, const struct net_device *out,
+    unsigned int hooknum, const struct xt_target *ct, const void *targinfo,
+    void *userdata)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+static unsigned int xtnu_target_run(struct sk_buff **pskb,
+    const struct net_device *in, const struct net_device *out,
+    unsigned int hooknum, const struct xt_target *ct, const void *targinfo)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+static unsigned int xtnu_target_run(struct sk_buff *skb,
+    const struct net_device *in, const struct net_device *out,
+    unsigned int hooknum, const struct xt_target *ct, const void *targinfo)
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(ct);
+	struct xt_action_param local_par;
+
+	local_par.in       = in;
+	local_par.out      = out;
+	local_par.hooknum  = hooknum;
+	local_par.target   = ct;
+	local_par.targinfo = targinfo;
+	local_par.family   = NFPROTO_UNSPEC;
+
+	if (nt != NULL && nt->target != NULL)
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+		return nt->target(pskb, &local_par);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+		return nt->target(&skb, &local_par);
+#endif
+	return XT_CONTINUE;
+}
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) && \
+    LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+static unsigned int
+xtnu_target_run(struct sk_buff *skb, const struct xt_target_param *par)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(par->target);
+	struct xt_action_param local_par;
+
+	local_par.in       = par->in;
+	local_par.out      = par->out;
+	local_par.hooknum  = par->hooknum;
+	local_par.target   = par->target;
+	local_par.targinfo = par->targinfo;
+	local_par.family   = par->family;
+
+	return nt->target(&skb, &local_par);
+}
+#endif
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+static unsigned int
+xtnu_target_run(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(par->target);
+
+	return nt->target(&skb, par);
+}
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+static int xtnu_target_check(const char *table, const void *entry,
+    const struct xt_target *ct, void *targinfo,
+    unsigned int targinfosize, unsigned int hook_mask)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 22)
+static int xtnu_target_check(const char *table, const void *entry,
+    const struct xt_target *ct, void *targinfo, unsigned int hook_mask)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+static bool xtnu_target_check(const char *table, const void *entry,
+    const struct xt_target *ct, void *targinfo, unsigned int hook_mask)
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(ct);
+	struct xt_tgchk_param local_par = {
+		.table     = table,
+		.entryinfo = entry,
+		.target    = ct,
+		.targinfo  = targinfo,
+		.hook_mask = hook_mask,
+		.family    = NFPROTO_UNSPEC,
+	};
+
+	if (nt == NULL)
+		return false;
+	if (nt->checkentry == NULL)
+		/* this is valid, just like if there was no function */
+		return true;
+	return nt->checkentry(&local_par) == 0;
+}
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 28) && \
+    LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+static bool xtnu_target_check(const struct xt_tgchk_param *par)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(par->target);
+
+	if (nt == NULL)
+		return false;
+	if (nt->checkentry == NULL)
+		return true;
+	return nt->checkentry(par) == 0;
+}
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+static void xtnu_target_destroy(const struct xt_target *ct, void *targinfo,
+    unsigned int targinfosize)
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+static void xtnu_target_destroy(const struct xt_target *ct, void *targinfo)
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+{
+	struct xtnu_target *nt = xtcompat_nutarget(ct);
+	struct xt_tgdtor_param local_par = {
+		.target   = ct,
+		.targinfo = targinfo,
+		.family   = NFPROTO_UNSPEC,
+	};
+
+	if (nt != NULL && nt->destroy != NULL)
+		nt->destroy(&local_par);
+}
+#endif
+
+int xtnu_register_target(struct xtnu_target *nt)
+{
+	struct xt_target *ct;
+	char *tmp;
+	int ret;
+
+	ct = kzalloc(sizeof(struct xt_target), GFP_KERNEL);
+	if (ct == NULL)
+		return -ENOMEM;
+
+	tmp = (char *)ct->name;
+	memcpy(tmp, nt->name, sizeof(nt->name));
+	tmp = (char *)(ct->name + sizeof(ct->name) - sizeof(void *));
+	*(tmp-1) = '\0';
+	memcpy(tmp, &nt, sizeof(void *));
+
+	ct->revision   = nt->revision;
+	ct->family     = nt->family;
+	ct->table      = (char *)nt->table;
+	ct->hooks      = nt->hooks;
+	ct->proto      = nt->proto;
+	ct->target     = xtnu_target_run;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+	ct->checkentry = xtnu_target_check;
+	ct->destroy    = xtnu_target_destroy;
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+	ct->checkentry = xtnu_target_check;
+	ct->destroy    = nt->destroy;
+#else
+	ct->checkentry = nt->checkentry;
+	ct->destroy    = nt->destroy;
+#endif
+	ct->targetsize = nt->targetsize;
+	ct->me         = nt->me;
+
+	nt->__compat_target = ct;
+	ret = xt_register_target(ct);
+	if (ret != 0)
+		kfree(ct);
+	return ret;
+}
+EXPORT_SYMBOL_GPL(xtnu_register_target);
+
+int xtnu_register_targets(struct xtnu_target *nt, unsigned int num)
+{
+	unsigned int i;
+	int ret;
+
+	for (i = 0; i < num; ++i) {
+		ret = xtnu_register_target(&nt[i]);
+		if (ret < 0) {
+			if (i > 0)
+				xtnu_unregister_targets(nt, i);
+			return ret;
+		}
+	}
+	return 0;
+}
+EXPORT_SYMBOL_GPL(xtnu_register_targets);
+
+void xtnu_unregister_target(struct xtnu_target *nt)
+{
+	xt_unregister_target(nt->__compat_target);
+	kfree(nt->__compat_target);
+}
+EXPORT_SYMBOL_GPL(xtnu_unregister_target);
+
+void xtnu_unregister_targets(struct xtnu_target *nt, unsigned int num)
+{
+	unsigned int i;
+
+	for (i = 0; i < num; ++i)
+		xtnu_unregister_target(&nt[i]);
+}
+EXPORT_SYMBOL_GPL(xtnu_unregister_targets);
+
+struct xt_match *xtnu_request_find_match(unsigned int af, const char *name,
+    uint8_t revision)
+{
+	static const char *const xt_prefix[] = {
+		[AF_UNSPEC] = "x",
+		[AF_INET]   = "ip",
+		[AF_INET6]  = "ip6",
+#ifdef AF_ARP
+		[AF_ARP]    = "arp",
+#elif defined(NF_ARP) && NF_ARP != AF_UNSPEC
+		[NF_ARP]    = "arp",
+#endif
+	};
+	struct xt_match *match;
+
+	match = try_then_request_module(xt_find_match(af, name, revision),
+		"%st_%s", xt_prefix[af], name);
+	if (IS_ERR(match) || match == NULL)
+		return NULL;
+
+	return match;
+}
+EXPORT_SYMBOL_GPL(xtnu_request_find_match);
+
+int xtnu_ip_route_me_harder(struct sk_buff **pskb, unsigned int addr_type)
+{
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 17)
+	/* Actually this one is valid up to 2.6.18.4, but changed in 2.6.18.5 */
+	return ip_route_me_harder(pskb);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+	return ip_route_me_harder(pskb, addr_type);
+#else
+	return ip_route_me_harder(*pskb, addr_type);
+#endif
+}
+EXPORT_SYMBOL_GPL(xtnu_ip_route_me_harder);
+
+int xtnu_skb_make_writable(struct sk_buff **pskb, unsigned int len)
+{
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+	return skb_make_writable(pskb, len);
+#else
+	return skb_make_writable(*pskb, len);
+#endif
+}
+EXPORT_SYMBOL_GPL(xtnu_skb_make_writable);
+
+#if LINUX_VERSION_CODE == KERNEL_VERSION(2, 6, 24)
+static int __xtnu_ip_local_out(struct sk_buff *skb)
+{
+	struct iphdr *iph = ip_hdr(skb);
+
+	iph->tot_len = htons(skb->len);
+	ip_send_check(iph);
+	return nf_hook(PF_INET, NF_IP_LOCAL_OUT, skb, NULL,
+	               skb->dst->dev, dst_output);
+}
+
+int xtnu_ip_local_out(struct sk_buff *skb)
+{
+	int err;
+
+	err = __xtnu_ip_local_out(skb);
+	if (likely(err == 1))
+		err = dst_output(skb);
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(xtnu_ip_local_out);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+static int __xtnu_ip_local_out(struct sk_buff **pskb)
+{
+	struct iphdr *iph = ip_hdr(*pskb);
+
+	iph->tot_len = htons((*pskb)->len);
+	ip_send_check(iph);
+	return nf_hook(PF_INET, NF_IP_LOCAL_OUT, pskb, NULL,
+	               (*pskb)->dst->dev, dst_output);
+}
+
+int xtnu_ip_local_out(struct sk_buff *skb)
+{
+	int err;
+
+	err = __xtnu_ip_local_out(&skb);
+	if (likely(err == 1))
+		err = dst_output(skb);
+
+	return err;
+}
+EXPORT_SYMBOL_GPL(xtnu_ip_local_out);
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
+int xtnu_ip_route_output_key(void *net, struct rtable **rp, struct flowi *flp)
+{
+	return ip_route_output_flow(rp, flp, NULL, 0);
+}
+EXPORT_SYMBOL_GPL(xtnu_ip_route_output_key);
+
+void xtnu_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb,
+    __be32 from, __be32 to, bool pseudohdr)
+{
+	__be32 diff[] = {~from, to};
+	const void *dv = diff; /* kludge for < v2.6.19-555-g72685fc */
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+	if (skb->ip_summed != CHECKSUM_PARTIAL) {
+		*sum = csum_fold(csum_partial(dv, sizeof(diff),
+		       ~csum_unfold(*sum)));
+		if (skb->ip_summed == CHECKSUM_COMPLETE && pseudohdr)
+			skb->csum = ~csum_partial(dv, sizeof(diff),
+			            ~skb->csum);
+	} else if (pseudohdr) {
+		*sum = ~csum_fold(csum_partial(dv, sizeof(diff),
+		       csum_unfold(*sum)));
+	}
+#else
+	*sum = csum_fold(csum_partial(dv, sizeof(diff),
+	       ~csum_unfold(*sum)));
+#endif
+}
+EXPORT_SYMBOL_GPL(xtnu_proto_csum_replace4);
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
+int xtnu_neigh_hh_output(struct hh_cache *hh, struct sk_buff *skb)
+{
+	unsigned int hh_alen;
+
+	read_lock_bh(&hh->hh_lock);
+	hh_alen = HH_DATA_ALIGN(hh->hh_len);
+	memcpy(skb->data - hh_alen, hh->hh_data, hh_alen);
+	read_unlock_bh(&hh->hh_lock);
+	skb_push(skb, hh->hh_len);
+	return hh->hh_output(skb);
+}
+EXPORT_SYMBOL_GPL(xtnu_neigh_hh_output);
+
+static inline __wsum xtnu_csum_unfold(__sum16 n)
+{
+	return (__force __wsum)n;
+}
+
+void xtnu_csum_replace4(__sum16 *sum, __be32 from, __be32 to)
+{
+	__be32 diff[] = {~from, to};
+	*sum = csum_fold(csum_partial((char *)diff, sizeof(diff),
+	       ~xtnu_csum_unfold(*sum)));
+}
+
+void xtnu_csum_replace2(__sum16 *sum, __be16 from, __be16 to)
+{
+	xtnu_csum_replace4(sum, (__force __be32)from, (__force __be32)to);
+}
+EXPORT_SYMBOL_GPL(xtnu_csum_replace2);
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 17)
+int xtnu_skb_linearize(struct sk_buff *skb)
+{
+	return skb_linearize(skb, GFP_ATOMIC);
+}
+EXPORT_SYMBOL_GPL(xtnu_skb_linearize);
+#endif
+
 void *HX_memmem(const void *space, size_t spacesize,
     const void *point, size_t pointsize)
 {
@@ -42,4 +617,22 @@ void *HX_memmem(const void *space, size_t spacesize,
 }
 EXPORT_SYMBOL_GPL(HX_memmem);
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0) && defined(WITH_IPV6)
+int xtnu_ipv6_skip_exthdr(const struct sk_buff *skb, int start,
+    uint8_t *nexthdrp, __be16 *fragoffp)
+{
+	return ipv6_skip_exthdr(skb, start, nexthdrp);
+}
+EXPORT_SYMBOL_GPL(xtnu_ipv6_skip_exthdr);
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0) && defined(WITH_IPV6)
+int xtnu_ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+    int target, unsigned short *fragoff, int *fragflg)
+{
+	return ipv6_find_hdr(skb, offset, target, fragoff);
+}
+EXPORT_SYMBOL_GPL(xtnu_ipv6_find_hdr);
+#endif
+
 MODULE_LICENSE("GPL");

extensions/compat_xtables.h

@@ -8,8 +8,8 @@
 
 #define DEBUGP Use__pr_debug__instead
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(4, 15, 0)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 17)
-#	warning Kernels below 4.15 not supported.
+#	warning Kernels below 2.6.17 not supported.
 #endif
 
 #if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
@@ -17,8 +17,86 @@
 #		warning You have CONFIG_NF_CONNTRACK enabled, but CONFIG_NF_CONNTRACK_MARK is not (please enable).
 #	endif
 #	include <net/netfilter/nf_conntrack.h>
+#elif defined(CONFIG_IP_NF_CONNTRACK) || defined(CONFIG_IP_NF_CONNTRACK_MODULE)
+#	if !defined(CONFIG_IP_NF_CONNTRACK_MARK)
+#		warning You have CONFIG_IP_NF_CONNTRACK enabled, but CONFIG_IP_NF_CONNTRACK_MARK is not (please enable).
+#	endif
+#	include <linux/netfilter_ipv4/ip_conntrack.h>
+#	define nf_conn ip_conntrack
+#	define nf_ct_get ip_conntrack_get
+#	define nf_conntrack_untracked ip_conntrack_untracked
 #else
-#	warning You need CONFIG_NF_CONNTRACK.
+#	warning You need either CONFIG_NF_CONNTRACK or CONFIG_IP_NF_CONNTRACK.
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 17)
+#	define skb_init_secmark(skb)
+#	define skb_linearize	xtnu_skb_linearize
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
+#	define neigh_hh_output xtnu_neigh_hh_output
+#	define IPPROTO_UDPLITE 136
+#	define CSUM_MANGLED_0 ((__force __sum16)0xffff)
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
+#	define NF_INET_PRE_ROUTING  NF_IP_PRE_ROUTING
+#	define NF_INET_LOCAL_IN     NF_IP_LOCAL_IN
+#	define NF_INET_FORWARD      NF_IP_FORWARD
+#	define NF_INET_LOCAL_OUT    NF_IP_LOCAL_OUT
+#	define NF_INET_POST_ROUTING NF_IP_POST_ROUTING
+#	define ip_local_out         xtnu_ip_local_out
+#	define ip_route_output_key  xtnu_ip_route_output_key
+#	include "compat_nfinetaddr.h"
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+#	define init_net               xtnu_ip_route_output_key /* yes */
+#	define init_net__loopback_dev (&loopback_dev)
+#	define init_net__proc_net     proc_net
+#else
+#	define init_net__loopback_dev init_net.loopback_dev
+#	define init_net__proc_net     init_net.proc_net
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+#	define xt_match              xtnu_match
+#	define xt_register_match     xtnu_register_match
+#	define xt_unregister_match   xtnu_unregister_match
+#	define xt_register_matches   xtnu_register_matches
+#	define xt_unregister_matches xtnu_unregister_matches
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
+#	define csum_replace2 xtnu_csum_replace2
+#	define csum_replace4 xtnu_csum_replace4
+#	define inet_proto_csum_replace4 xtnu_proto_csum_replace4
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 24)
+#	define csum_replace2 nf_csum_replace2
+#	define csum_replace4 nf_csum_replace4
+#	define inet_proto_csum_replace4 xtnu_proto_csum_replace4
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34)
+#	define ipt_unregister_table(tbl) ipt_unregister_table(&init_net, (tbl))
+#	define ip6t_unregister_table(tbl) ip6t_unregister_table(&init_net, (tbl))
+#else
+#	define ipt_unregister_table(tbl) ipt_unregister_table(tbl)
+#	define ip6t_unregister_table(tbl) ip6t_unregister_table(tbl)
+#endif
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#	define rt_dst(rt)	(&(rt)->dst)
+#else
+#	define rt_dst(rt)	(&(rt)->u.dst)
+#endif
+
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0)
+#	define nf_nat_ipv4_multi_range_compat nf_nat_multi_range_compat
+#	define nf_nat_ipv4_range nf_nat_range
+#	define NF_NAT_RANGE_MAP_IPS IP_NAT_RANGE_MAP_IPS
+#	define ipv6_skip_exthdr xtnu_ipv6_skip_exthdr
 #endif
 
 #if !defined(NIP6) && !defined(NIP6_FMT)
@@ -31,7 +109,7 @@
 		ntohs((addr).s6_addr16[5]), \
 		ntohs((addr).s6_addr16[6]), \
 		ntohs((addr).s6_addr16[7])
-#	define NIP6_FMT "%04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx:%04hx"
+#	define NIP6_FMT "%04x:%04x:%04x:%04x:%04x:%04x:%04x:%04x"
 #endif
 #if !defined(NIPQUAD) && !defined(NIPQUAD_FMT)
 #	define NIPQUAD(addr) \
@@ -39,16 +117,21 @@
 		((const unsigned char *)&addr)[1], \
 		((const unsigned char *)&addr)[2], \
 		((const unsigned char *)&addr)[3]
-#	define NIPQUAD_FMT "%hhu.%hhu.%hhu.%hhu"
+#	define NIPQUAD_FMT "%u.%u.%u.%u"
 #endif
 
-static inline struct net *par_net(const struct xt_action_param *par)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 5, 0)
-{
+#	define ipv6_find_hdr xtnu_ipv6_find_hdr
-	return par->state->net;
-}
-
-#ifndef NF_CT_ASSERT
-#	define NF_CT_ASSERT(x)	WARN_ON(!(x))
 #endif
 
+#define ip_route_me_harder    xtnu_ip_route_me_harder
+#define skb_make_writable     xtnu_skb_make_writable
+#define xt_target             xtnu_target
+#define xt_register_target    xtnu_register_target
+#define xt_unregister_target  xtnu_unregister_target
+#define xt_register_targets   xtnu_register_targets
+#define xt_unregister_targets xtnu_unregister_targets
+
+#define xt_request_find_match xtnu_request_find_match
+
 #endif /* _XTABLES_COMPAT_H */

extensions/compat_xtnu.h

@@ -1,11 +1,93 @@
 #ifndef _COMPAT_XTNU_H
 #define _COMPAT_XTNU_H 1
 
+#include <linux/list.h>
 #include <linux/netfilter/x_tables.h>
+#include <linux/spinlock.h>
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+typedef _Bool bool;
+enum { false = 0, true = 1, };
+#endif
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
+typedef __u16 __bitwise __sum16;
+typedef __u32 __bitwise __wsum;
+#endif
+
+struct flowi;
+struct hh_cache;
 struct module;
+struct net_device;
+struct rtable;
 struct sk_buff;
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+enum {
+	NFPROTO_UNSPEC =  0,
+	NFPROTO_IPV4   =  2,
+	NFPROTO_ARP    =  3,
+	NFPROTO_BRIDGE =  7,
+	NFPROTO_IPV6   = 10,
+	NFPROTO_DECNET = 12,
+	NFPROTO_NUMPROTO,
+};
+
+struct xt_mtchk_param {
+	const char *table;
+	const void *entryinfo;
+	const struct xt_match *match;
+	void *matchinfo;
+	unsigned int hook_mask;
+	u_int8_t family;
+};
+
+struct xt_mtdtor_param {
+	const struct xt_match *match;
+	void *matchinfo;
+	u_int8_t family;
+};
+
+struct xt_target_param {
+	const struct net_device *in, *out;
+	unsigned int hooknum;
+	const struct xt_target *target;
+	const void *targinfo;
+	u_int8_t family;
+};
+
+struct xt_tgchk_param {
+	const char *table;
+	const void *entryinfo;
+	const struct xt_target *target;
+	void *targinfo;
+	unsigned int hook_mask;
+	u_int8_t family;
+};
+
+struct xt_tgdtor_param {
+	const struct xt_target *target;
+	void *targinfo;
+	u_int8_t family;
+};
+#endif
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+struct xt_action_param {
+	union {
+		const struct xt_match *match;
+		const struct xt_target *target;
+	};
+	union {
+		const void *matchinfo, *targinfo;
+	};
+	const struct net_device *in, *out;
+	int fragoff;
+	unsigned int thoff, hooknum;
+	u_int8_t family;
+	bool hotdrop;
+};
+#endif
+
 struct xtnu_match {
 	/*
 	 * Making it smaller by sizeof(void *) on purpose to catch
@@ -53,7 +135,18 @@ static inline struct xtnu_target *xtcompat_nutarget(const struct xt_target *t)
 	return q;
 }
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 19)
+static inline __wsum csum_unfold(__sum16 n)
+{
+	return (__force __wsum)n;
+}
+#endif
+
+extern int xtnu_ip_local_out(struct sk_buff *);
+extern int xtnu_ip_route_me_harder(struct sk_buff **, unsigned int);
+extern int xtnu_skb_make_writable(struct sk_buff **, unsigned int);
 extern int xtnu_register_match(struct xtnu_match *);
+extern int xtnu_ip_route_output_key(void *, struct rtable **, struct flowi *);
 extern void xtnu_unregister_match(struct xtnu_match *);
 extern int xtnu_register_matches(struct xtnu_match *, unsigned int);
 extern void xtnu_unregister_matches(struct xtnu_match *, unsigned int);
@@ -61,6 +154,18 @@ extern int xtnu_register_target(struct xtnu_target *);
 extern void xtnu_unregister_target(struct xtnu_target *);
 extern int xtnu_register_targets(struct xtnu_target *, unsigned int);
 extern void xtnu_unregister_targets(struct xtnu_target *, unsigned int);
+extern struct xt_match *xtnu_request_find_match(unsigned int,
+	const char *, uint8_t);
+extern int xtnu_neigh_hh_output(struct hh_cache *, struct sk_buff *);
+extern void xtnu_csum_replace2(__u16 __bitwise *, __be16, __be16);
+extern void xtnu_csum_replace4(__u16 __bitwise *, __be32, __be32);
+extern void xtnu_proto_csum_replace4(__u16 __bitwise *, struct sk_buff *,
+	__be32, __be32, bool);
+extern int xtnu_skb_linearize(struct sk_buff *);
+extern int xtnu_ipv6_skip_exthdr(const struct sk_buff *, int,
+	uint8_t *, __be16 *);
+extern int xtnu_ipv6_find_hdr(const struct sk_buff *, unsigned int *,
+	int, unsigned short *, int *);
 
 extern void *HX_memmem(const void *, size_t, const void *, size_t);
 

extensions/libxt_CHAOS.c

@@ -64,6 +64,21 @@ static void chaos_tg_check(unsigned int flags)
 		           "may be specified");
 }
 
+static void chaos_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_chaos_tginfo *info = (const void *)target->data;
+
+	switch (info->variant) {
+	case XTCHAOS_DELUDE:
+		printf(" DELUDE ");
+		break;
+	case XTCHAOS_TARPIT:
+		printf(" TARPIT ");
+		break;
+	}
+}
+
 static void chaos_tg_save(const void *ip, const struct xt_entry_target *target)
 {
 	const struct xt_chaos_tginfo *info = (const void *)target->data;
@@ -78,13 +93,6 @@ static void chaos_tg_save(const void *ip, const struct xt_entry_target *target)
 	}
 }
 
-static void chaos_tg_print(const void *ip,
-    const struct xt_entry_target *target, int numeric)
-{
-	printf(" -j CHAOS");
-	chaos_tg_save(ip, target);
-}
-
 static struct xtables_target chaos_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "CHAOS",

extensions/libxt_CHAOS.man

@@ -1,4 +1,3 @@
-.PP
 Causes confusion on the other end by doing odd things with incoming packets.
 CHAOS will randomly reply (or not) with one of its configurable subtargets:
 .TP

extensions/libxt_CHECKSUM.c

@@ -0,0 +1,94 @@
+/*
+ * (C) 2002 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 by Red Hat, Inc
+ * Author: Michael S. Tsirkin <mst@redhat.com>
+ *
+ * This program is distributed under the terms of GNU GPL v2, 1991
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+
+#include <xtables.h>
+#include "xt_CHECKSUM.h"
+#include "compat_user.h"
+
+static void CHECKSUM_help(void)
+{
+	printf(
+"CHECKSUM target options\n"
+"  --checksum-fill        Fill in packet checksum.\n");
+}
+
+static const struct option CHECKSUM_opts[] = {
+	{ "checksum-fill", 0, NULL, 'F' },
+	{ .name = NULL }
+};
+
+static int CHECKSUM_parse(int c, char **argv, int invert, unsigned int *flags,
+                     const void *entry, struct xt_entry_target **target)
+{
+	struct xt_CHECKSUM_info *einfo
+		= (struct xt_CHECKSUM_info *)(*target)->data;
+
+	switch (c) {
+	case 'F':
+		xtables_param_act(XTF_ONLY_ONCE, "CHECKSUM", "--checksum-fill",
+			*flags & XT_CHECKSUM_OP_FILL);
+		einfo->operation = XT_CHECKSUM_OP_FILL;
+		*flags |= XT_CHECKSUM_OP_FILL;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void CHECKSUM_check(unsigned int flags)
+{
+	if (!flags)
+		xtables_error(PARAMETER_PROBLEM,
+		           "CHECKSUM target: Parameter --checksum-fill is required");
+}
+
+static void CHECKSUM_print(const void *ip, const struct xt_entry_target *target,
+                      int numeric)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	printf("CHECKSUM ");
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf(" fill ");
+}
+
+static void CHECKSUM_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_CHECKSUM_info *einfo =
+		(const struct xt_CHECKSUM_info *)target->data;
+
+	if (einfo->operation & XT_CHECKSUM_OP_FILL)
+		printf(" --checksum-fill ");
+}
+
+static struct xtables_target checksum_tg_reg = {
+	.name          = "CHECKSUM",
+	.version       = XTABLES_VERSION,
+	.family        = NFPROTO_UNSPEC,
+	.size          = XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.userspacesize = XT_ALIGN(sizeof(struct xt_CHECKSUM_info)),
+	.help          = CHECKSUM_help,
+	.parse         = CHECKSUM_parse,
+	.final_check   = CHECKSUM_check,
+	.print         = CHECKSUM_print,
+	.save          = CHECKSUM_save,
+	.extra_opts    = CHECKSUM_opts,
+};
+
+static __attribute__((constructor)) void _init(void)
+{
+	xtables_register_target(&checksum_tg_reg);
+}

extensions/libxt_CHECKSUM.man

@@ -0,0 +1,8 @@
+This target allows to selectively work around broken/old applications.
+It can only be used in the mangle table.
+.TP
+\fB\-\-checksum\-fill\fP
+Compute and fill in the checksum in a packet that lacks a checksum.
+This is particularly useful, if you need to work around old applications
+such as dhcp clients, that do not work well with checksum offloads,
+but don't want to disable checksum offload in your device.

extensions/libxt_DELUDE.man

@@ -1,4 +1,3 @@
-.PP
 The DELUDE target will reply to a SYN packet with SYN-ACK, and to all other
 packets with an RST. This will terminate the connection much like REJECT, but
 network scanners doing TCP half-open discovery can be spoofed to make them

extensions/libxt_DHCPMAC.c

@@ -61,6 +61,15 @@ static void dhcpmac_tg_check(unsigned int flags)
 		           "--set-mac parameter required");
 }
 
+static void dhcpmac_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct dhcpmac_info *info = (void *)target->data;
+
+	printf(" DHCPMAC %s" DH_MAC_FMT "/%u ",
+	       info->invert ? "!" : "", DH_MAC_HEX(info->addr), info->mask);
+}
+
 static void dhcpmac_tg_save(const void *ip,
     const struct xt_entry_target *target)
 {
@@ -72,13 +81,6 @@ static void dhcpmac_tg_save(const void *ip,
 	       DH_MAC_HEX(info->addr), info->mask);
 }
 
-static void dhcpmac_tg_print(const void *ip,
-    const struct xt_entry_target *target, int numeric)
-{
-	printf(" -j DHCPMAC");
-	dhcpmac_tg_save(ip, target);
-}
-
 static struct xtables_target dhcpmac_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "DHCPMAC",

extensions/libxt_DHCPMAC.man

@@ -1,4 +1,3 @@
-.PP
 In conjunction with ebtables, DHCPMAC can be used to completely change all MAC
 addresses from and to a VMware-based virtual machine. This is needed because
 VMware does not allow to set a non-VMware MAC address before an operating

extensions/libxt_DNETMAP.c

@@ -69,8 +69,19 @@ static int netmask2bits(u_int32_t netmask)
 	return bits;
 }
 
+static void DNETMAP_init(struct xt_entry_target *t)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&t->data;
+	struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
+
+	/* Actually, it's 0, but it's ignored at the moment. */
+	mr->rangesize = 1;
+	tginfo->ttl = 0;
+	tginfo->flags = 0;
+}
+
 /* Parses network address */
-static void parse_prefix(char *arg, struct nf_nat_range *range)
+static void parse_prefix(char *arg, struct nf_nat_ipv4_range *range)
 {
 	char *slash;
 	const struct in_addr *ip;
@@ -86,7 +97,7 @@ static void parse_prefix(char *arg, struct nf_nat_range *range)
 	if (ip == NULL)
 		xtables_error(PARAMETER_PROBLEM, "Bad IP address \"%s\"\n",
 			      arg);
-	range->min_addr.in = *ip;
+	range->min_ip = ip->s_addr;
 	if (slash) {
 		if (strchr(slash + 1, '.')) {
 			ip = xtables_numeric_to_ipmask(slash + 1);
@@ -112,20 +123,20 @@ static void parse_prefix(char *arg, struct nf_nat_range *range)
 	} else
 		netmask = ~0;
 
-	if (range->min_addr.ip & ~netmask) {
+	if (range->min_ip & ~netmask) {
 		if (slash)
 			*slash = '/';
 		xtables_error(PARAMETER_PROBLEM, "Bad network address \"%s\"\n",
 			      arg);
 	}
-	range->max_addr.ip = range->min_addr.ip | ~netmask;
+	range->max_ip = range->min_ip | ~netmask;
 }
 
 static int DNETMAP_parse(int c, char **argv, int invert, unsigned int *flags,
 			 const void *entry, struct xt_entry_target **target)
 {
 	struct xt_DNETMAP_tginfo *tginfo = (void *)(*target)->data;
-	struct nf_nat_range *mr = &tginfo->prefix;
+	struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
 	char *end;
 
 	switch (c) {
@@ -136,7 +147,7 @@ static int DNETMAP_parse(int c, char **argv, int invert, unsigned int *flags,
 				  invert);
 
 		/* TO-DO use xtables_ipparse_any instead? */
-		parse_prefix(optarg, mr);
+		parse_prefix(optarg, &mr->range[0]);
 		*flags |= XT_DNETMAP_PREFIX;
 		tginfo->flags |= XT_DNETMAP_PREFIX;
 		return 1;
@@ -181,13 +192,14 @@ static void DNETMAP_print_addr(const void *ip,
 			       int numeric)
 {
 	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
-	const struct nf_nat_range *r = &tginfo->prefix;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_range *r = &mr->range[0];
 	struct in_addr a;
 	int bits;
 
-	a = r->min_addr.in;
+	a.s_addr = r->min_ip;
 	printf("%s", xtables_ipaddr_to_numeric(&a));
-	a.s_addr = ~(r->min_addr.ip ^ r->max_addr.ip);
+	a.s_addr = ~(r->min_ip ^ r->max_ip);
 	bits = netmask2bits(a.s_addr);
 	if (bits < 0)
 		printf("/%s", xtables_ipaddr_to_numeric(&a));
@@ -195,6 +207,33 @@ static void DNETMAP_print_addr(const void *ip,
 		printf("/%d", bits);
 }
 
+static void DNETMAP_print(const void *ip, const struct xt_entry_target *target,
+			  int numeric)
+{
+	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
+	const __u8 *flags = &tginfo->flags;
+
+	printf(" prefix ");
+	if (*flags & XT_DNETMAP_PREFIX)
+		DNETMAP_print_addr(ip, target, numeric);
+	else
+		printf("any");
+
+	if (*flags & XT_DNETMAP_REUSE)
+		printf(" reuse");
+
+	if (*flags & XT_DNETMAP_STATIC)
+		printf(" static");
+
+	if (*flags & XT_DNETMAP_PERSISTENT)
+		printf(" persistent");
+
+	if (*flags & XT_DNETMAP_TTL)
+		printf(" ttl %i", tginfo->ttl);
+	else
+		printf(" ttl default");
+}
+
 static void DNETMAP_save(const void *ip, const struct xt_entry_target *target)
 {
 	struct xt_DNETMAP_tginfo *tginfo = (void *)&target->data;
@@ -219,13 +258,6 @@ static void DNETMAP_save(const void *ip, const struct xt_entry_target *target)
 		printf(" --ttl %i ", tginfo->ttl);
 }
 
-static void DNETMAP_print(const void *ip, const struct xt_entry_target *target,
-			  int numeric)
-{
-	printf(" -j DNETMAP");
-	DNETMAP_save(ip, target);
-}
-
 static struct xtables_target dnetmap_tg_reg = {
 	.name          = MODULENAME,
 	.version       = XTABLES_VERSION,
@@ -233,6 +265,7 @@ static struct xtables_target dnetmap_tg_reg = {
 	.size          = XT_ALIGN(sizeof(struct xt_DNETMAP_tginfo)),
 	.userspacesize = XT_ALIGN(sizeof(struct xt_DNETMAP_tginfo)),
 	.help          = DNETMAP_help,
+	.init          = DNETMAP_init,
 	.parse         = DNETMAP_parse,
 	.print         = DNETMAP_print,
 	.save          = DNETMAP_save,

extensions/libxt_DNETMAP.man

@@ -1,179 +1,172 @@
-.PP
+The \fBDNETMAP\fR target allows dynamic two-way 1:1 mapping of IPv4 subnets.
-The \fBDNETMAP\fR target allows dynamic two-way 1:1 mapping of IPv4 subnets. A
+Single rule can map private subnet to shorter public subnet creating and
-single rule can map a private subnet to a shorter public subnet, creating and
+maintaining unambigeous private-public ip bindings. Second rule can be used to
-maintaining unambiguous private-public IP address bindings. The second rule can
+map new flows to private subnet according to maintained bindings. Target allows
-be used to map new flows to a private subnet according to maintained bindings.
+efficient public IPv4 space usage and unambigeous NAT at the same time.
-The target allows efficient public IPv4 space usage and unambiguous NAT at the
+
-same time.
+Target can be used only in \fBnat\fR table in \fBPOSTROUTING\fR or \fBOUTPUT\fR
-.PP
+chains for SNAT and in \fBPREROUTING\fR for DNAT. Only flows directed to bound
-The target can be used only in the \fBnat\fR table in \fBPOSTROUTING\fR or
+IPs will be DNATed. Packet continues chain traversal if there is no free
-\fBOUTPUT\fR chains for SNAT, and in \fBPREROUTING\fR for DNAT. Only flows
+postnat-ip to be assigned to prenat-ip. Default binding \fBttl\fR is \fI10
-directed to bound addresses will be DNATed. The packet continues chain
+minutes\fR and can be changed using \fBdefault_ttl\fR module option. Default ip
-traversal if there is no free postnat address to be assigned to the prenat
+hash size is 256 and can be changed using \fBhash_size\fR module option.
-address. The default binding \fBTTL\fR is \fI10 minutes\fR and can be changed
+
-using the \fBdefault_ttl\fR module option. The default address hash size is 256
-and can be changed using the \fBhash_size\fR module option.
 .TP
 \fB\-\-prefix\fR \fIaddr\fR\fB/\fR\fImask\fR
-The network subnet to map to. If not specified, all existing prefixes are used.
+Network subnet to map to. If not specified, all existing prefixes are used.
 .TP
 \fB\-\-reuse\fR
-Reuse the entry for a given prenat address from any prefix even if the
+Reuse entry for given prenat-ip from any prefix despite bindings ttl < 0.
-binding's TTL is < 0.
 .TP
 \fB\-\-persistent\fR
-Set the prefix to be persistent. It will not be removed after deleting the last
+Set prefix persistent. It won't be removed after deleting last iptables rule.
-iptables rule. The option is effective only in the first rule for a given
+Option is effective only in the first rule for a given prefix. If you
-prefix. If you need to change persistency for an existing prefix, please use
+need to change persistency for existing prefix, please use proc interface
-the procfs interface described below.
+described below.
 .TP
 \fB\-\-static\fR
-Do not create dynamic mappings using this rule. Use static mappings only. Note
+Don't create dynamic mappings using this rule. Use static mappings only. Note
-that you need to create static mappings via the procfs interface for this rule
+that you need to create static mappings via proc interface for this rule with
-for this option to have any effect.
+this option to have any effect.
 .TP
 \fB\-\-ttl\fR \fIseconds\fR
-Reset the binding's TTL value to \fIseconds\fR. If a negative value is
+Regenerate bindings ttl value to \fIseconds\fR. If negative value is specified,
-specified, the binding's TTL is kept unchanged. If this option is not
+bindings ttl is kept unchanged. If not specified then default ttl value (600s)
-specified, then the default TTL value (600s) is used.
+is used.
 .PP
 \fB* /proc interface\fR
-.PP
+
-The module creates the following entries for each new specified subnet:
+Module creates following entries for each new specified subnet:
 .TP
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR
-Contains the binding table for the given \fIsubnet/mask\fP. Each line contains
+Contains binding table for subnet/mask. Each line contains \fBprenat-ip\fR,
-\fBprenat address\fR, \fBpostnat address\fR, \fBttl\fR (seconds until the entry
+\fBpostnat-ip\fR,\fBttl\fR (seconds till entry times out), \fBlasthit\fR (last
-times out), \fBlasthit\fR (last hit to the entry in seconds relative to system
+entry hit in seconds relative to system boot time). Please note that \fBttl\fR
-boot time). Please note that the \fBttl\fR and \fBlasthit\fR entries contain an
+and \fBlasthit\fR entries contain \fBS\fR in case of static binding.
-'\fBS\fR' in case of a static binding.
 .TP
 \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
-Contains statistics for a given \fIsubnet/mask\fP. The line contains four
+Contains statistics for given subnet/mask. Line contains contains four
-numerical values separated by spaces. The first one is the number of currently
+numerical values separated by spaces. First one is number of currently used
-used dynamic addresses (bindings with negative TTL excluded), the second one is
+dynamic addresses (bindings with negative ttl excluded), second one is number
-the number of static assignments, the third one is the number of all usable
+static assignments, third one is number of all usable addresses in subnet and
-addresses in the subnet, and the fourth one is the mean \fBTTL\fR value for all
+the fourth one is mean \fBttl\fR value for all active entries. If prefix has
-active entries. If the prefix has the persistent flag set, it will be noted as
+persistent flag set it'll be noted as fifth entry.
-fifth entry.
 .PP
-The following write operations are supported via the procfs interface:
+Following write operations are supported via proc interface:
 .TP
-echo "+\fIprenat-address\fR:\fIpostnat-address\fR" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "+\fIprenatIP\fR:\fIpostnatIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Adds a static binding between the prenat and postnap address. If
+Adds static binding between prenatIP nad postnatIP. If postnatIP is already
-postnat_address is already bound, any previous binding will be timed out
+bound, previous binding will be timedout immediatelly. Static binding is never
-immediately. A static binding is never timed out.
+timedout.
 .TP
-echo "\-\fIaddress\fR" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "-\fIIP\fR" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Removes the binding with \fIaddress\fR as prenat or postnat address. If the
+Removes binding with \fIIP\fR as prenat or postnat address. If removed binding
-removed binding is currently static, it will make the entry available for
+is currently static, it'll make entry available for dynamic allocation.
-dynamic allocation.
 .TP
-echo "+persistent" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "+persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Sets the persistent flag for the prefix. It is useful if you do not want
+Sets persistent flag for prefix. It's usefull if you don't want bindings to get
-bindings to get flushed when the firewall is restarted. You can check if the
+flushed when firewall is restarted. You can check if prefix is persistent by
-prefix is persistent by printing the contents of
+printing \fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR
-\fB/proc/net/xt_DNETMAP/\fR\fIsubnet\fR\fB_\fR\fImask\fR\fB_stat\fR.
+contents.
 .TP
-echo "\-persistent" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "-persistent" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Unsets the persistent flag for the prefix. In this mode, the prefix will be
+Unsets persistent flag for prefix. In this mode prefix will be deleted if the
-deleted if the last iptables rule for that prefix is removed.
+last iptables rule for that prefix is removed.
 .TP
-echo "flush" >\fB/proc/net/xt_DNETMAP/subnet_mask\fR
+echo "flush" > \fB/proc/net/xt_DNETMAP/subnet_mask\fR
-Flushes all bindings for the specific prefix. All static entries are also
+Flushes all bindings for specific prefix. All static entries are also flushed
-flushed and become available for dynamic bindings.
+and are available for dynamic bindings.
 .PP
 Note! Entries are removed if the last iptables rule for a specific prefix is
-deleted unless the persistent flag is set.
+deleted unless there's persistent flag set.
 .PP
+
 \fB* Logging\fR
-.PP
+
-The module logs binding add/timeout events to klog. This behaviour can be
+Module logs binding add/timeout events to klog. This behaviour can be disabled
-disabled using the \fBdisable_log\fR module parameter.
+using \fBdisable_log\fR module parameter.
-.PP
+
 \fB* Examples\fR
-.PP
+
 \fB1.\fR Map subnet 192.168.0.0/24 to subnets 20.0.0.0/26. SNAT only:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-.PP
+
-Active hosts from the 192.168.0.0/24 subnet are mapped to 20.0.0.0/26. If the
+Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26. If packet
-packet from a not yet bound prenat address hits the rule and there are no free
+from not yet bound prenat-ip hits the rule and there are no free or timed-out
-or timed-out (TTL<0) entries in prefix 20.0.0.0/28, then a notice is logged to
+(ttl<0) entries in prefix 20.0.0.0/28, then notice is logged to klog and chain
-klog and chain traversal continues. If packet from an already-bound prenat
+traversal continues. If packet from already bound prenat-ip hits the rule,
-address hits the rule, the binding's TTL value is reset to default_ttl and SNAT
+bindings ttl value is regenerated to default_ttl and SNAT is performed.
-is performed.
+
-.PP
 \fB2.\fR Use of \fB\-\-reuse\fR and \fB\-\-ttl\fR switches, multiple rule
 interaction:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix
-20.0.0.0/26 \-\-reuse \-\-ttl 200
+20.0.0.0/26 --reuse --ttl 200
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 30.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 30.0.0.0/26
-.PP
+
-Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26 with TTL =
+Active hosts from 192.168.0.0/24 subnet are mapped to 20.0.0.0/26 with ttl =
-200 seconds. If there are no free addresses in first prefix, the next one
+200 seconds. If there are no free addresses in first prefix the next one
-(30.0.0.0/26) is used with the default TTL. It is important to note that the
+(30.0.0.0/26) is used with default ttl. It's important to note that the first
-first rule SNATs all flows whose source address is already actively bound
+rule SNATs all flows whose source IP is already actively (ttl>0) bound to ANY
-(TTL>0) to ANY prefix. The \fB\-\-reuse\fR parameter makes this functionality
+prefix. Parameter \fB\-\-reuse\fR makes this functionality work even for
-work even for inactive (TTL<0) entries.
+inactive (ttl<0) entries.
-.PP
+
-If both subnets are exhausted, then chain traversal continues.
+If both subnets are exhaused, then chain traversal continues.
-.PP
+
-\fB3.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 in a bidirectional way:
+\fB3.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 bidirectional way:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-.PP
+
-iptables \-t nat \-A PREROUTING \-j DNETMAP
+iptables -t nat -A PREROUTING -j DNETMAP
-.PP
+
-If the host 192.168.0.10 generates some traffic, it gets bound to first free
+If host 192.168.0.10 generates some traffic, it gets bound to first free IP in
-address in the subnet \(em 20.0.0.0. Now, any traffic directed to 20.0.0.0 gets
+subnet - 20.0.0.0. Now any traffic directed to 20.0.0.0 gets DNATed to
-DNATed to 192.168.0.10 as long as there is an active (TTL>0) binding. There is
+192.168.0.10 as long as there's an active (ttl>0) binding. There's no need to
-no need to specify \fB\-\-prefix\fR parameter in a PREROUTING rule, because
+specify \fB\-\-prefix\fR parameter in PREROUTING rule, because this way it DNATs
-this way, it DNATs traffic to all active prefixes. You could specify the prefix
+traffic to all active prefixes. You could specify prefix it you'd like to make
-you would like to make DNAT work for a specific prefix only.
+DNAT work for specific prefix only.
-.PP
+
-\fB4.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 with static assignments
+\fB4.\fR Map 192.168.0.0/24 to subnets 20.0.0.0/26 with static assignments only:
-only:
+
-.PP
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+--static
-\-\-static
+
-.PP
+echo "+192.168.0.10:20.0.0.1" > /proc/net/xt_DNETMAP/20.0.0.0_26
-echo "+192.168.0.10:20.0.0.1" >/proc/net/xt_DNETMAP/20.0.0.0_26
 .br
-echo "+192.168.0.11:20.0.0.2" >/proc/net/xt_DNETMAP/20.0.0.0_26
+echo "+192.168.0.11:20.0.0.2" > /proc/net/xt_DNETMAP/20.0.0.0_26
 .br
-echo "+192.168.0.51:20.0.0.3" >/proc/net/xt_DNETMAP/20.0.0.0_26
+echo "+192.168.0.51:20.0.0.3" > /proc/net/xt_DNETMAP/20.0.0.0_26
-.PP
+
 This configuration will allow only preconfigured static bindings to work due to
-the \fBstatic\fR rule option. Without this flag, dynamic bindings would be
+\fBstatic\fR rule option. Without this flag dynamic bindings would be created
-created using non-static entries.
+using non-static entries.
-.PP
+
 \fB5.\fR Persistent prefix:
-.PP
+
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
-\-\-persistent
+--persistent
 .br
 \fBor\fR
 .br
-iptables \-t nat \-A POSTROUTING \-s 192.168.0.0/24 \-j DNETMAP \-\-prefix 20.0.0.0/26
+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j DNETMAP --prefix 20.0.0.0/26
 .br
-echo "+persistent" >/proc/net/xt_DNETMAP/20.0.0.0_26
+echo "+persistent" > /proc/net/xt_DNETMAP/20.0.0.0_26
-.PP
+
-Now, we can check the persistent flag of the prefix:
+Now we can check persistent flag of the prefix:
 .br
 cat /proc/net/xt_DNETMAP/20.0.0.0_26
 .br
 0 0 64 0 \fBpersistent\fR
-.PP
+
-Flush the iptables nat table and see that prefix is still in existence:
+Flush iptables nat table and see that prefix is still in existence:
 .br
-iptables \-F \-t nat
+iptables -F -t nat
 .br
-ls \-l /proc/net/xt_DNETMAP
+ls -l /proc/net/xt_DNETMAP
 .br
-\-rw\-r\-\-r\-\- 1 root root 0 06\-10 09:01 20.0.0.0_26
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26
 .br
-\-rw\-r\-\-r\-\- 1 root root 0 06\-10 09:01 20.0.0.0_26_stat
+-rw-r--r-- 1 root root 0 06-10 09:01 20.0.0.0_26_stat
 .

extensions/libxt_ECHO.man

@@ -1,4 +1,3 @@
-.PP
 The \fBECHO\fP target will send back all packets it received. It serves as an
 examples for an Xtables target.
 .PP

extensions/libxt_IPMARK.c

@@ -112,6 +112,25 @@ static void ipmark_tg_check(unsigned int flags)
 		           "IPMARK target: Parameter --addr is required");
 }
 
+static void
+ipmark_tg_print(const void *entry, const struct xt_entry_target *target,
+                int numeric)
+{
+	const struct xt_ipmark_tginfo *info = (const void *)target->data;
+
+	if (info->selector == XT_IPMARK_SRC)
+		printf(" IPMARK src ip ");
+	else
+		printf(" IPMARK dst ip ");
+
+	if (info->shift != 0)
+		printf(" shift %u ", (unsigned int)info->shift);
+	if (info->andmask != ~0U)
+		printf(" and 0x%x ", (unsigned int)info->andmask);
+	if (info->ormask != 0)
+		printf(" or 0x%x ", (unsigned int)info->ormask);
+}
+
 static void
 ipmark_tg_save(const void *entry, const struct xt_entry_target *target)
 {
@@ -130,14 +149,6 @@ ipmark_tg_save(const void *entry, const struct xt_entry_target *target)
 		printf(" --or-mask 0x%x ", (unsigned int)info->ormask);
 }
 
-static void
-ipmark_tg_print(const void *entry, const struct xt_entry_target *target,
-                int numeric)
-{
-	printf(" -j IPMARK");
-	ipmark_tg_save(entry, target);
-}
-
 static struct xtables_target ipmark_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "IPMARK",

extensions/libxt_IPMARK.man

@@ -1,8 +1,7 @@
-.PP
 Allows you to mark a received packet basing on its IP address. This
 can replace many mangle/mark entries with only one, if you use
 firewall based classifier.
-.PP
+
 This target is to be used inside the \fBmangle\fP table.
 .TP
 \fB\-\-addr\fP {\fBsrc\fP|\fBdst\fP}

extensions/libxt_LOGMARK.c

@@ -77,6 +77,15 @@ logmark_tg_parse(int c, char **argv, int invert, unsigned int *flags,
 	return false;
 }
 
+static void
+logmark_tg_print(const void *ip, const struct xt_entry_target *target,
+                 int numeric)
+{
+	const struct xt_logmark_tginfo *info = (void *)target->data;
+
+	printf(" LOGMARK level %u prefix \"%s\" ", info->level, info->prefix);
+}
+
 static void
 logmark_tg_save(const void *ip, const struct xt_entry_target *target)
 {
@@ -88,14 +97,6 @@ logmark_tg_save(const void *ip, const struct xt_entry_target *target)
 		printf(" --log-prefix \"%s\" ", info->prefix);
 }
 
-static void
-logmark_tg_print(const void *ip, const struct xt_entry_target *target,
-                 int numeric)
-{
-	printf(" -j LOGMARK");
-	logmark_tg_save(ip, target);
-}
-
 static struct xtables_target logmark_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "LOGMARK",

extensions/libxt_LOGMARK.man

@@ -1,4 +1,3 @@
-.PP
 The LOGMARK target will log packet and connection marks to syslog.
 .TP
 \fB\-\-log\-level\fR \fIlevel\fR

extensions/libxt_SYSRQ.man

@@ -1,4 +1,3 @@
-.PP
 The SYSRQ target allows to remotely trigger sysrq on the local machine over the
 network. This can be useful when vital parts of the machine hang, for example
 an oops in a filesystem causing locks to be not released and processes to get

extensions/libxt_TARPIT.c

@@ -67,6 +67,24 @@ static void tarpit_tg_check(unsigned int flags)
 			"TARPIT: only one action can be used at a time");
 }
 
+static void tarpit_tg_print(const void *ip,
+    const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_tarpit_tginfo *info = (void *)target->data;
+
+	switch (info->variant) {
+	case XTTARPIT_HONEYPOT:
+		printf(" honeypot mode ");
+		break;
+	case XTTARPIT_RESET:
+		printf(" reset mode ");
+		break;
+	default:
+		printf(" tarpit mode ");
+		break;
+	}
+}
+
 static void tarpit_tg_save(const void *ip,
     const struct xt_entry_target *target)
 {
@@ -85,13 +103,6 @@ static void tarpit_tg_save(const void *ip,
 	}
 }
 
-static void tarpit_tg_print(const void *ip,
-    const struct xt_entry_target *target, int numeric)
-{
-	printf(" -j TARPIT");
-	tarpit_tg_save(ip, target);
-}
-
 static struct xtables_target tarpit_tg_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "TARPIT",

extensions/libxt_TARPIT.man

@@ -1,4 +1,3 @@
-.PP
 Captures and holds incoming TCP connections using no local per-connection
 resources.
 .PP

extensions/libxt_TEE.c

@@ -0,0 +1,173 @@
+/*
+ *	"TEE" target extension for iptables
+ *	Copyright © Sebastian Claßen <sebastian.classen [at] freenet.ag>, 2007
+ *	Jan Engelhardt <jengelh [at] medozas de>, 2007 - 2009
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License; either
+ *	version 2 of the License, or any later version, as published by the
+ *	Free Software Foundation.
+ */
+#include <sys/socket.h>
+#include <getopt.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <arpa/inet.h>
+#include <net/if.h>
+#include <netinet/in.h>
+
+#include <xtables.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/x_tables.h>
+#include "xt_TEE.h"
+#include "compat_user.h"
+
+enum {
+	FLAG_GATEWAY = 1 << 0,
+};
+
+static const struct option tee_tg_opts[] = {
+	{.name = "gateway", .has_arg = true, .val = 'g'},
+	{NULL},
+};
+
+static void tee_tg_help(void)
+{
+	printf(
+"TEE target options:\n"
+"  --gateway IPADDR    Route packet via the gateway given by address\n"
+"\n");
+}
+
+static int tee_tg_parse(int c, char **argv, int invert, unsigned int *flags,
+                        const void *entry, struct xt_entry_target **target)
+{
+	struct xt_tee_tginfo *info = (void *)(*target)->data;
+	const struct in_addr *ia;
+
+	switch (c) {
+	case 'g':
+		if (*flags & FLAG_GATEWAY)
+			xtables_error(PARAMETER_PROBLEM,
+			           "Cannot specify --gateway more than once");
+
+		ia = xtables_numeric_to_ipaddr(optarg);
+		if (ia == NULL)
+			xtables_error(PARAMETER_PROBLEM,
+			           "Invalid IP address %s", optarg);
+
+		memcpy(&info->gw, ia, sizeof(*ia));
+		*flags |= FLAG_GATEWAY;
+		return true;
+	}
+
+	return false;
+}
+
+static int tee_tg6_parse(int c, char **argv, int invert, unsigned int *flags,
+                         const void *entry, struct xt_entry_target **target)
+{
+	struct xt_tee_tginfo *info = (void *)(*target)->data;
+	const struct in6_addr *ia;
+
+	switch (c) {
+	case 'g':
+		if (*flags & FLAG_GATEWAY)
+			xtables_error(PARAMETER_PROBLEM,
+			           "Cannot specify --gateway more than once");
+
+		ia = xtables_numeric_to_ip6addr(optarg);
+		if (ia == NULL)
+			xtables_error(PARAMETER_PROBLEM,
+			           "Invalid IP address %s", optarg);
+
+		memcpy(&info->gw, ia, sizeof(*ia));
+		*flags |= FLAG_GATEWAY;
+		return true;
+	}
+
+	return false;
+}
+
+static void tee_tg_check(unsigned int flags)
+{
+	if (flags == 0)
+		xtables_error(PARAMETER_PROBLEM, "TEE target: "
+		           "--gateway parameter required");
+}
+
+static void tee_tg_print(const void *ip, const struct xt_entry_target *target,
+                         int numeric)
+{
+	const struct xt_tee_tginfo *info = (const void *)target->data;
+
+	if (numeric)
+		printf(" TEE gw:%s ", xtables_ipaddr_to_numeric(&info->gw.in));
+	else
+		printf(" TEE gw:%s ", xtables_ipaddr_to_anyname(&info->gw.in));
+}
+
+static void tee_tg6_print(const void *ip, const struct xt_entry_target *target,
+                          int numeric)
+{
+	const struct xt_tee_tginfo *info = (const void *)target->data;
+
+	if (numeric)
+		printf(" TEE gw:%s ", xtables_ip6addr_to_numeric(&info->gw.in6));
+	else
+		printf(" TEE gw:%s ", xtables_ip6addr_to_anyname(&info->gw.in6));
+}
+
+static void tee_tg_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_tee_tginfo *info = (const void *)target->data;
+
+	printf(" --gateway %s ", xtables_ipaddr_to_numeric(&info->gw.in));
+}
+
+static void tee_tg6_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_tee_tginfo *info = (const void *)target->data;
+
+	printf(" --gateway %s ", xtables_ip6addr_to_numeric(&info->gw.in6));
+}
+
+static struct xtables_target tee_tg_reg[] = {
+	{
+		.name          = "TEE",
+		.version       = XTABLES_VERSION,
+		.revision      = 0,
+		.family        = NFPROTO_IPV4,
+		.size          = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.help          = tee_tg_help,
+		.parse         = tee_tg_parse,
+		.final_check   = tee_tg_check,
+		.print         = tee_tg_print,
+		.save          = tee_tg_save,
+		.extra_opts    = tee_tg_opts,
+	},
+	{
+		.name          = "TEE",
+		.version       = XTABLES_VERSION,
+		.revision      = 0,
+		.family        = NFPROTO_IPV6,
+		.size          = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.userspacesize = XT_ALIGN(sizeof(struct xt_tee_tginfo)),
+		.help          = tee_tg_help,
+		.parse         = tee_tg6_parse,
+		.final_check   = tee_tg_check,
+		.print         = tee_tg6_print,
+		.save          = tee_tg6_save,
+		.extra_opts    = tee_tg_opts,
+	},
+};
+
+static __attribute__((constructor)) void tee_tg_ldr(void)
+{
+	xtables_register_targets(tee_tg_reg,
+		sizeof(tee_tg_reg) / sizeof(*tee_tg_reg));
+}

extensions/libxt_TEE.man

@@ -0,0 +1,12 @@
+The \fBTEE\fP target will clone a packet and redirect this clone to another
+machine on the \fBlocal\fP network segment. In other words, the nexthop
+must be the target, or you will have to configure the nexthop to forward it
+further if so desired.
+.TP
+\fB\-\-gateway\fP \fIipaddr\fP
+Send the cloned packet to the host reachable at the given IP address.
+Use of 0.0.0.0 (for IPv4 packets) or :: (IPv6) is invalid.
+.PP
+To forward all incoming traffic on eth0 to an Network Layer logging box:
+.PP
+\-t mangle \-A PREROUTING \-i eth0 \-j TEE \-\-gateway 2001:db8::1

extensions/libxt_condition.c

@@ -62,6 +62,15 @@ static void condition_check(unsigned int flags)
 			   "Condition match: must specify --condition");
 }
 
+static void condition_print(const void *ip, const struct xt_entry_match *match,
+                            int numeric)
+{
+	const struct xt_condition_mtinfo *info = (const void *)match->data;
+
+	printf(" condition %s%s ", (info->invert) ? "!" : "", info->name);
+}
+
+
 static void condition_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_condition_mtinfo *info = (const void *)match->data;
@@ -69,13 +78,6 @@ static void condition_save(const void *ip, const struct xt_entry_match *match)
 	printf("%s --condition \"%s\" ", info->invert ? " !" : "", info->name);
 }
 
-static void condition_print(const void *ip, const struct xt_entry_match *match,
-                            int numeric)
-{
-	printf(" -m condition");
-	condition_save(ip, match);
-}
-
 static struct xtables_match condition_mt_reg = {
 	.name 		= "condition",
 	.revision	= 1,

extensions/libxt_condition.man

@@ -1,4 +1,3 @@
-.PP
 This matches if a specific condition variable is (un)set.
 .TP
 [\fB!\fP] \fB\-\-condition\fP \fIname\fP

extensions/libxt_dhcpmac.c

@@ -62,6 +62,15 @@ static void dhcpmac_mt_check(unsigned int flags)
 		           "--mac parameter required");
 }
 
+static void dhcpmac_mt_print(const void *ip,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct dhcpmac_info *info = (void *)match->data;
+
+	printf(" dhcpmac %s" DH_MAC_FMT "/%u ",
+	       info->invert ? "!" : "", DH_MAC_HEX(info->addr), info->mask);
+}
+
 static void dhcpmac_mt_save(const void *ip,
     const struct xt_entry_match *match)
 {
@@ -73,13 +82,6 @@ static void dhcpmac_mt_save(const void *ip,
 	       DH_MAC_HEX(info->addr), info->mask);
 }
 
-static void dhcpmac_mt_print(const void *ip,
-    const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m dhcpmac");
-	dhcpmac_mt_save(ip, match);
-}
-
 static struct xtables_match dhcpmac_mt_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "dhcpmac",

extensions/libxt_fuzzy.c

@@ -83,6 +83,15 @@ static void fuzzy_mt_check(unsigned int flags)
 {
 }
 
+static void fuzzy_mt_print(const void *ip, const struct xt_entry_match *match,
+                           int numeric)
+{
+	const struct xt_fuzzy_mtinfo *info = (const void *)match->data;
+
+	printf(" fuzzy: lower limit = %u pps - upper limit = %u pps ",
+	       info->minimum_rate, info->maximum_rate);
+}
+
 static void fuzzy_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_fuzzy_mtinfo *info = (const void *)match->data;
@@ -91,13 +100,6 @@ static void fuzzy_mt_save(const void *ip, const struct xt_entry_match *match)
 	printf(" --upper-limit %u ", info->maximum_rate);
 }
 
-static void fuzzy_mt_print(const void *ip, const struct xt_entry_match *match,
-                           int numeric)
-{
-	printf(" -m fuzzy");
-	fuzzy_mt_save(ip, match);
-}
-
 static struct xtables_match fuzzy_mt_reg = {
 	.name          = "fuzzy",
 	.revision      = 1,

extensions/libxt_fuzzy.man

@@ -1,4 +1,3 @@
-.PP
 This module matches a rate limit based on a fuzzy logic controller (FLC).
 .TP
 \fB\-\-lower\-limit\fP \fInumber\fP

extensions/libxt_geoip.c

@@ -49,38 +49,6 @@ static struct option geoip_opts[] = {
 	{NULL},
 };
 
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-static void geoip_swap_le16(uint16_t *buf)
-{
-	unsigned char *p = (void *)buf;
-	uint16_t n= p[0] + (p[1] << 8);
-	p[0] = (n >> 8) & 0xff;
-	p[1] = n & 0xff;
-}
-
-static void geoip_swap_in6(struct in6_addr *in6)
-{
-	geoip_swap_le16(&in6->s6_addr16[0]);
-	geoip_swap_le16(&in6->s6_addr16[1]);
-	geoip_swap_le16(&in6->s6_addr16[2]);
-	geoip_swap_le16(&in6->s6_addr16[3]);
-	geoip_swap_le16(&in6->s6_addr16[4]);
-	geoip_swap_le16(&in6->s6_addr16[5]);
-	geoip_swap_le16(&in6->s6_addr16[6]);
-	geoip_swap_le16(&in6->s6_addr16[7]);
-}
-
-static void geoip_swap_le32(uint32_t *buf)
-{
-	unsigned char *p = (void *)buf;
-	uint32_t n = p[0] + (p[1] << 8) + (p[2] << 16) + (p[3] << 24);
-	p[0] = (n >> 24) & 0xff;
-	p[1] = (n >> 16) & 0xff;
-	p[2] = (n >> 8) & 0xff;
-	p[3] = n & 0xff;
-}
-#endif
-
 static void *
 geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 {
@@ -88,15 +56,21 @@ geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 	struct stat sb;
 	char buf[256];
 	int fd;
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-	unsigned int n;
-#endif
 
 	/* Use simple integer vector files */
-	if (nfproto == NFPROTO_IPV6)
+	if (nfproto == NFPROTO_IPV6) {
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/%s.iv6", code);
+#if __BYTE_ORDER == _BIG_ENDIAN
-	else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv6", code);
-		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/%s.iv4", code);
+#else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv6", code);
+#endif
+	} else {
+#if __BYTE_ORDER == _BIG_ENDIAN
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/BE/%s.iv4", code);
+#else
+		snprintf(buf, sizeof(buf), GEOIP_DB_DIR "/LE/%s.iv4", code);
+#endif
+	}
 
 	if ((fd = open(buf, O_RDONLY)) < 0) {
 		fprintf(stderr, "Could not open %s: %s\n", buf, strerror(errno));
@@ -124,25 +98,6 @@ geoip_get_subnets(const char *code, uint32_t *count, uint8_t nfproto)
 		xtables_error(OTHER_PROBLEM, "geoip: insufficient memory");
 	read(fd, subnets, sb.st_size);
 	close(fd);
-
-#if __BYTE_ORDER == __LITTLE_ENDIAN
-	for (n = 0; n < *count; ++n) {
-		switch (nfproto) {
-		case NFPROTO_IPV6: {
-			struct geoip_subnet6 *gs6 = &(((struct geoip_subnet6 *)subnets)[n]);
-			geoip_swap_in6(&gs6->begin);
-			geoip_swap_in6(&gs6->end);
-			break;
-		}
-		case NFPROTO_IPV4: {
-			struct geoip_subnet4 *gs4 = &(((struct geoip_subnet4 *)subnets)[n]);
-			geoip_swap_le32(&gs4->begin);
-			geoip_swap_le32(&gs4->end);
-			break;
-		}
-		}
-	}
-#endif
 	return subnets;
 }
 
@@ -296,6 +251,31 @@ geoip_final_check(unsigned int flags)
 			"geoip: missing arguments");
 }
 
+static void
+geoip_print(const void *ip, const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_geoip_match_info *info = (void*)match->data;
+
+	u_int8_t i;
+
+	if (info->flags & XT_GEOIP_SRC)
+		printf(" Source ");
+	else
+		printf(" Destination ");
+
+	if (info->count > 1)
+		printf("countries: ");
+	else
+		printf("country: ");
+
+	if (info->flags & XT_GEOIP_INV)
+		printf("! ");
+
+	for (i = 0; i < info->count; i++)
+		 printf("%s%c%c", i ? "," : "", COUNTRY(info->cc[i]));
+	printf(" ");
+}
+
 static void
 geoip_save(const void *ip, const struct xt_entry_match *match)
 {
@@ -315,13 +295,6 @@ geoip_save(const void *ip, const struct xt_entry_match *match)
 	printf(" ");
 }
 
-static void
-geoip_print(const void *ip, const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m geoip");
-	geoip_save(ip, match);
-}
-
 static struct xtables_match geoip_match[] = {
 	{
 		.family        = NFPROTO_IPV6,

extensions/libxt_geoip.man

@@ -1,4 +1,3 @@
-.PP
 Match a packet by its source or destination country.
 .TP
 [\fB!\fP] \fB\-\-src\-cc\fP, \fB\-\-source\-country\fP \fIcountry\fP[\fB,\fP\fIcountry\fP\fB...\fP]
@@ -16,8 +15,8 @@ with the source package, and which should be available in compiled packages in
 /usr/lib(exec)/xtables-addons/. The first command retrieves CSV files from
 MaxMind, while the other two build packed bisectable range files:
 .PP
-mkdir \-p /usr/share/xt_geoip; cd /tmp; $path/to/xt_geoip_dl;
+mkdir -p /usr/share/xt_geoip; cd /tmp; $path/to/xt_geoip_dl;
 .PP
-$path/to/xt_geoip_build \-D /usr/share/xt_geoip GeoIP*.csv;
+$path/to/xt_geoip_build -D /usr/share/xt_geoip GeoIP*.csv;
 .PP
 The shared library is hardcoded to look in these paths, so use them.

extensions/libxt_gradm.c

@@ -57,6 +57,17 @@ static void gradm_mt_check(unsigned int flags)
 {
 }
 
+static void gradm_mt_print(const void *ip, const struct xt_entry_match *match,
+                           int numeric)
+{
+	const struct xt_gradm_mtinfo *info = (const void *)match->data;
+
+	if (info->invflags)
+		printf("gradm: disabled");
+	else
+		printf("gradm: enabled");
+}
+
 static void gradm_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_gradm_mtinfo *info = (const void *)match->data;
@@ -67,13 +78,6 @@ static void gradm_mt_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --enabled ");
 }
 
-static void gradm_mt_print(const void *ip, const struct xt_entry_match *match,
-                           int numeric)
-{
-	printf(" -m gradm");
-	gradm_mt_save(ip, match);
-}
-
 static struct xtables_match gradm_mt_reg = {
 	.family        = NFPROTO_UNSPEC,
 	.name          = "gradm",

extensions/libxt_gradm.man

@@ -1,4 +1,3 @@
-.PP
 This module matches packets based on grsecurity RBAC status.
 .TP
 [\fB!\fP] \fB\-\-enabled\fP

extensions/libxt_iface.c

@@ -175,6 +175,33 @@ static void iface_mt_check(unsigned int flags)
 			"iface: You must specify at least one option");
 }
 
+static void iface_mt_print(const void *ip, const struct xt_entry_match *match,
+    int numeric)
+{
+	const struct xt_iface_mtinfo *info = (const void *)match->data;
+
+	printf(" iface: ");
+	if (info->flags & XT_IFACE_DEV_IN)
+		printf("(in)");
+	else if (info->flags & XT_IFACE_DEV_OUT)
+		printf("(out)");
+	else
+		printf("%s", info->ifname);
+	printf(" [state:");
+	iface_print_opt(info, XT_IFACE_UP,          "up");
+	iface_print_opt(info, XT_IFACE_BROADCAST,   "broadcast");
+	iface_print_opt(info, XT_IFACE_LOOPBACK,    "loopback");
+	iface_print_opt(info, XT_IFACE_POINTOPOINT, "pointopoint");
+	iface_print_opt(info, XT_IFACE_RUNNING,     "running");
+	iface_print_opt(info, XT_IFACE_NOARP,       "noarp");
+	iface_print_opt(info, XT_IFACE_PROMISC,     "promisc");
+	iface_print_opt(info, XT_IFACE_MULTICAST,   "multicast");
+	iface_print_opt(info, XT_IFACE_DYNAMIC,     "dynamic");
+	iface_print_opt(info, XT_IFACE_LOWER_UP,    "lower_up");
+	iface_print_opt(info, XT_IFACE_DORMANT,     "dormant");
+	printf("] ");
+}
+
 static void iface_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_iface_mtinfo *info = (const void *)match->data;
@@ -199,13 +226,6 @@ static void iface_mt_save(const void *ip, const struct xt_entry_match *match)
 	printf(" ");
 }
 
-static void iface_mt_print(const void *ip, const struct xt_entry_match *match,
-    int numeric)
-{
-	printf(" -m iface");
-	iface_mt_save(ip, match);
-}
-
 static struct xtables_match iface_mt_reg = {
 	.version	= XTABLES_VERSION,
 	.name		= "iface",

extensions/libxt_iface.man

@@ -1,4 +1,3 @@
-.PP
 Allows you to check interface states. First, an interface needs to be selected
 for comparison. Exactly one option of the following three must be specified:
 .TP

extensions/libxt_ipp2p.c

@@ -217,7 +217,7 @@ ipp2p_mt_print1(const void *entry, const struct xt_entry_match *match,
 static void ipp2p_mt_print(const void *entry,
     const struct xt_entry_match *match, int numeric)
 {
-	printf(" -m ipp2p ");
+	printf(" ipp2p ");
 	ipp2p_mt_print1(entry, match, true);
 }
 

extensions/libxt_ipp2p.man

@@ -1,4 +1,3 @@
-.PP
 This module matches certain packets in P2P flows. It is not
 designed to match all packets belonging to a P2P connection \(em
 use IPP2P together with CONNMARK for this purpose.

extensions/libxt_ipv4options.c

@@ -133,6 +133,17 @@ static void ipv4options_print_flags(const struct xt_ipv4options_mtinfo1 *info,
 		}
 }
 
+static void ipv4options_mt_print(const void *ip,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_ipv4options_mtinfo1 *info = (void *)match->data;
+
+	printf(" ipv4options %s ",
+	       (info->flags & XT_V4OPTS_ANY) ? "any-of" : "all-of");
+	ipv4options_print_flags(info, numeric);
+	printf(" ");
+}
+
 static void ipv4options_mt_save(const void *ip,
     const struct xt_entry_match *match)
 {
@@ -147,13 +158,6 @@ static void ipv4options_mt_save(const void *ip,
 	printf(" ");
 }
 
-static void ipv4options_mt_print(const void *ip,
-    const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m ipv4options");
-	ipv4options_mt_save(ip, match);
-}
-
 static struct xtables_match ipv4options_mt_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "ipv4options",

extensions/libxt_ipv4options.man

@@ -1,4 +1,3 @@
-.PP
 The "ipv4options" module allows to match against a set of IPv4 header options.
 .TP
 \fB\-\-flags\fP [\fB!\fP]\fIsymbol\fP[\fB,\fP[\fB!\fP]\fIsymbol...\fP]

extensions/libxt_length2.c

@@ -107,6 +107,29 @@ static void length_mt_check(unsigned int flags)
 		        "--layer3. Consider specifying it explicitly.\n");
 }
 
+static void length_mt_print(const void *ip, const struct xt_entry_match *match,
+                            int numeric)
+{
+	const struct xt_length_mtinfo2 *info = (const void *)match->data;
+
+	if (info->flags & XT_LENGTH_LAYER3)
+		printf(" layer3 ");
+	else if (info->flags & XT_LENGTH_LAYER4)
+		printf(" layer4 ");
+	else if (info->flags & XT_LENGTH_LAYER5)
+		printf(" layer5 ");
+	else if (info->flags & XT_LENGTH_LAYER7)
+		printf(" layer7 ");
+	printf(" length ");
+	if (info->flags & XT_LENGTH_INVERT)
+		printf("! ");
+	if (info->min == info->max)
+		printf("%u ", (unsigned int)info->min);
+	else
+		printf("%u-%u ", (unsigned int)info->min,
+		       (unsigned int)info->max);
+}
+
 static void length_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_length_mtinfo2 *info = (const void *)match->data;
@@ -129,13 +152,6 @@ static void length_mt_save(const void *ip, const struct xt_entry_match *match)
 		       (unsigned int)info->max);
 }
 
-static void length_mt_print(const void *ip, const struct xt_entry_match *match,
-                            int numeric)
-{
-	printf(" -m length2");
-	length_mt_save(ip, match);
-}
-
 static struct xtables_match length2_mt_reg = {
 	.version        = XTABLES_VERSION,
 	.name           = "length2",

extensions/libxt_length2.man

@@ -1,4 +1,3 @@
-.PP
 This module matches the length of a packet against a specific value or range of
 values.
 .TP

extensions/libxt_lscan.c

@@ -64,6 +64,30 @@ static void lscan_mt_check(unsigned int flags)
 {
 }
 
+static void lscan_mt_print(const void *ip,
+    const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_lscan_mtinfo *info = (const void *)(match->data);
+	const char *s = "";
+
+	printf(" lscan ");
+	if (info->match_stealth) {
+		printf("STEALTH");
+		s = ",";
+	}
+	if (info->match_syn) {
+		printf("%sSYNSCAN", s);
+		s = ",";
+	}
+	if (info->match_cn) {
+		printf("%sCNSCAN", s);
+		s = ",";
+	}
+	if (info->match_gr)
+		printf("%sGRSCAN", s);
+	printf(" ");
+}
+
 static void lscan_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_lscan_mtinfo *info = (const void *)(match->data);
@@ -78,13 +102,6 @@ static void lscan_mt_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --grscan ");
 }
 
-static void lscan_mt_print(const void *ip,
-    const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m lscan");
-	lscan_mt_save(ip, match);
-}
-
 static struct xtables_match lscan_mt_reg = {
 	.version       = XTABLES_VERSION,
 	.name          = "lscan",

extensions/libxt_lscan.man

@@ -1,5 +1,4 @@
-.PP
+Detects simple low-level scan attemps based upon the packet's contents.
-Detects simple low-level scan attempts based upon the packet's contents.
 (This is
 different from other implementations, which also try to match the rate of new
 connections.) Note that an attempt is only discovered after it has been carried

extensions/libxt_psd.c

@@ -117,6 +117,18 @@ static int psd_mt_parse(int c, char **argv, int invert, unsigned int *flags,
 /* Final check; nothing. */
 static void psd_mt_final_check(unsigned int flags) {}
 
+/* Prints out the targinfo. */
+static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
+	printf(" psd ");
+	printf("weight-threshold: %u ", psdinfo->weight_threshold);
+	printf("delay-threshold: %u ", psdinfo->delay_threshold);
+	printf("lo-ports-weight: %u ", psdinfo->lo_ports_weight);
+	printf("hi-ports-weight: %u ", psdinfo->hi_ports_weight);
+}
+
+/* Saves the union ipt_targinfo in parsable form to stdout. */
 static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_psd_info *psdinfo = (const struct xt_psd_info *)match->data;
@@ -126,12 +138,6 @@ static void psd_mt_save(const void *ip, const struct xt_entry_match *match)
 	printf("--psd-hi-ports-weight %u ", psdinfo->hi_ports_weight);
 }
 
-static void psd_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
-{
-	printf(" -m psd");
-	psd_mt_save(ip, match);
-}
-
 static struct xtables_match psd_mt_reg = {
 	.name           = "psd",
 	.version        = XTABLES_VERSION,

extensions/libxt_psd.man

@@ -1,4 +1,3 @@
-.PP
 Attempt to detect TCP and UDP port scans. This match was derived from
 Solar Designer's scanlogd.
 .TP

extensions/libxt_quota2.c

@@ -98,6 +98,8 @@ quota_mt2_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct xt_quota_mtinfo2 *q = (void *)match->data;
 
+	if (q->flags & XT_QUOTA_INVERT)
+		printf(" !");
 	if (q->flags & XT_QUOTA_GROW)
 		printf(" --grow ");
 	if (q->flags & XT_QUOTA_NO_CHANGE)
@@ -106,16 +108,29 @@ quota_mt2_save(const void *ip, const struct xt_entry_match *match)
 		printf(" --packets ");
 	if (*q->name != '\0')
 		printf(" --name %s ", q->name);
-	if (q->flags & XT_QUOTA_INVERT)
-		printf(" !");
 	printf(" --quota %llu ", (unsigned long long)q->quota);
 }
 
 static void quota_mt2_print(const void *ip, const struct xt_entry_match *match,
                             int numeric)
 {
-	printf(" -m quota");
+	const struct xt_quota_mtinfo2 *q = (const void *)match->data;
-	quota_mt2_save(ip, match);
+
+	if (q->flags & XT_QUOTA_INVERT)
+		printf(" !");
+	if (q->flags & XT_QUOTA_GROW)
+		printf(" counter");
+	else
+		printf(" quota");
+	if (*q->name != '\0')
+		printf(" %s:", q->name);
+	printf(" %llu ", (unsigned long long)q->quota);
+	if (q->flags & XT_QUOTA_PACKET)
+		printf("packets ");
+	else
+		printf("bytes ");
+	if (q->flags & XT_QUOTA_NO_CHANGE)
+		printf("(no-change mode) ");
 }
 
 static struct xtables_match quota_mt2_reg = {

extensions/libxt_quota2.man

@@ -1,4 +1,3 @@
-.PP
 The "quota2" implements a named counter which can be increased or decreased
 on a per-match basis. Available modes are packet counting or byte counting.
 The value of the counter can be read and reset through procfs, thereby making

extensions/pknock/gen_hmac.py

@@ -1,17 +0,0 @@
-from Crypto.Hash import SHA256
-from Crypto.Hash import MD5
-import sys
-import hmac
-import struct
-import socket
-from time import time
-
-def gen_hmac(secret, ip):
-    epoch_mins = (long)(time()/60)
-    s = hmac.HMAC(secret, digestmod = SHA256)
-    s.update(socket.inet_aton(socket.gethostbyname(ip)))
-    s.update(struct.pack("i", epoch_mins)) # "i" is for integer
-    print s.hexdigest()
-
-if __name__ == '__main__':
-	gen_hmac(sys.argv[1], sys.argv[2])

extensions/pknock/knock.sh

@@ -1,6 +0,0 @@
-#!/bin/bash
-if [ "$#" -ne 4 ]; then
-    echo "usage: $0 <IP src> <IP dst> <PORT dst> <secret>"
-    exit 1
-fi
-python gen_hmac.py "$4" "$1" | socat - "udp-sendto:$2:$3,bind=$1"

extensions/pknock/libxt_pknock.man

@@ -15,10 +15,10 @@ modprobe xt_pknock
 .PP
 Example 1 (TCP mode, manual closing of opened port not possible):
 .IP
-iptables \-P INPUT DROP
+iptables -P INPUT DROP
 .IP
-iptables \-A INPUT \-p tcp \-m pknock \-\-knockports 4002,4001,4004 \-\-strict
+iptables -A INPUT -p tcp -m pknock --knockports 4002,4001,4004 --strict
-\-\-name SSH \-\-time 10 \-\-autoclose 60 \-\-dport 22 \-j ACCEPT
+--name SSH --time 10 --autoclose 60 --dport 22 -j ACCEPT
 .PP
 The rule will allow tcp port 22 for the attempting IP address after the successful reception of TCP SYN packets
 to ports 4002, 4001 and 4004, in this order (a.k.a. port-knocking).
@@ -33,10 +33,10 @@ Example 2 (UDP mode \(em non-replayable and non-spoofable, manual closing
 of opened port possible, secure, also called "SPA" = Secure Port
 Authorization):
 .IP
-iptables \-A INPUT \-p udp \-m pknock \-\-knockports 4000 \-\-name FTP
+iptables -A INPUT -p udp -m pknock --knockports 4000 --name FTP
-\-\-opensecret foo \-\-closesecret bar \-\-autoclose 240 \-j DROP
+--opensecret foo --closesecret bar --autoclose 240 -j DROP
 .IP
-iptables \-A INPUT \-p tcp \-m pknock \-\-checkip \-\-name FTP \-\-dport 21 \-j ACCEPT
+iptables -A INPUT -p tcp -m pknock --checkip --name FTP --dport 21 -j ACCEPT
 .PP
 The first rule will create an "ALLOWED" record in /proc/net/xt_pknock/FTP after
 the successful reception of an UDP packet to port 4000. The packet payload must be
@@ -62,6 +62,8 @@ Specifying \fB--autoclose 0\fP means that no automatic close will be performed a
 xt_pknock is capable of sending information about successful matches
 via a netlink socket to userspace, should you need to implement your own
 way of receiving and handling portknock notifications.
+Be sure to read the documentation in the doc/pknock/ directory,
+or visit the original site \(em http://portknocko.berlios.de/ .
 .PP
 \fBTCP mode\fP:
 .PP

extensions/pknock/xt_pknock.c

@@ -19,17 +19,23 @@
 #include <linux/spinlock.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/crypto.h>
 #include <linux/proc_fs.h>
+#include <linux/scatterlist.h>
 #include <linux/spinlock.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
 #include <linux/seq_file.h>
 #include <linux/connector.h>
+
 #include <linux/netfilter/x_tables.h>
-#include <crypto/hash.h>
 #include "xt_pknock.h"
 #include "compat_xtables.h"
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+#	define PK_CRYPTO 1
+#endif
+
 enum status {
 	ST_INIT = 1,
 	ST_MATCHING,
@@ -107,16 +113,18 @@ static struct proc_dir_entry *pde;
 
 static DEFINE_SPINLOCK(list_lock);
 
+#ifdef PK_CRYPTO
 static struct {
 	const char *algo;
-	struct crypto_shash *tfm;
+	struct crypto_hash	*tfm;
 	unsigned int size;
-	struct shash_desc desc;
+	struct hash_desc	desc;
 } crypto = {
 	.algo	= "hmac(sha256)",
 	.tfm	= NULL,
 	.size	= 0
 };
+#endif
 
 module_param(rule_hashsize, int, S_IRUGO);
 MODULE_PARM_DESC(rule_hashsize, "Buckets in rule hash table (default: 8)");
@@ -188,7 +196,8 @@ status_itoa(enum status status)
 static void *
 pknock_seq_start(struct seq_file *s, loff_t *pos)
 {
-	const struct xt_pknock_rule *rule = s->private;
+	const struct proc_dir_entry *pde = s->private;
+	const struct xt_pknock_rule *rule = pde->data;
 
 	spin_lock_bh(&list_lock);
 
@@ -207,7 +216,8 @@ pknock_seq_start(struct seq_file *s, loff_t *pos)
 static void *
 pknock_seq_next(struct seq_file *s, void *v, loff_t *pos)
 {
-	const struct xt_pknock_rule *rule = s->private;
+	const struct proc_dir_entry *pde = s->private;
+	const struct xt_pknock_rule *rule = pde->data;
 
 	++*pos;
 	if (*pos >= peer_hashsize)
@@ -239,7 +249,8 @@ pknock_seq_show(struct seq_file *s, void *v)
 	unsigned long time;
 	const struct list_head *peer_head = v;
 
-	const struct xt_pknock_rule *rule = s->private;
+	const struct proc_dir_entry *pde = s->private;
+	const struct xt_pknock_rule *rule = pde->data;
 
 	list_for_each_safe(pos, n, peer_head) {
 		peer = list_entry(pos, struct peer, head);
@@ -290,7 +301,7 @@ pknock_proc_open(struct inode *inode, struct file *file)
 	int ret = seq_open(file, &pknock_seq_ops);
 	if (ret == 0) {
 		struct seq_file *sf = file->private_data;
-		sf->private = PDE_DATA(inode);
+		sf->private = PDE(inode);
 	}
 	return ret;
 }
@@ -357,10 +368,11 @@ has_logged_during_this_minute(const struct peer *peer)
  *
  * @r: rule
  */
-static void peer_gc(struct timer_list *tl)
+static void
+peer_gc(unsigned long r)
 {
 	unsigned int i;
-	struct xt_pknock_rule *rule = from_timer(rule, tl, timer);
+	struct xt_pknock_rule *rule = (struct xt_pknock_rule *)r;
 	struct peer *peer;
 	struct list_head *pos, *n;
 
@@ -467,12 +479,18 @@ add_rule(struct xt_pknock_mtinfo *info)
 	rule->peer_head      = alloc_hashtable(peer_hashsize);
 	if (rule->peer_head == NULL)
 		goto out;
-	timer_setup(&rule->timer, peer_gc, 0);
+
-	rule->status_proc = proc_create_data(info->rule_name, 0, pde,
+	init_timer(&rule->timer);
-	                    &pknock_proc_ops, rule);
+	rule->timer.function	= peer_gc;
+	rule->timer.data	= (unsigned long)rule;
+
+	rule->status_proc = create_proc_entry(info->rule_name, 0, pde);
 	if (rule->status_proc == NULL)
 		goto out;
 
+	rule->status_proc->proc_fops = &pknock_proc_ops;
+	rule->status_proc->data = rule;
+
 	list_add(&rule->head, &rule_hashtable[hash]);
 	pr_debug("(A) rule_name: %s - created.\n", rule->rule_name);
 	return true;
@@ -614,10 +632,9 @@ static void add_peer(struct peer *peer, struct xt_pknock_rule *rule)
  */
 static void remove_peer(struct peer *peer)
 {
-	if (peer == NULL)
-		return;
 	list_del(&peer->head);
-	kfree(peer);
+	if (peer != NULL)
+		kfree(peer);
 }
 
 /**
@@ -694,12 +711,15 @@ msg_to_userspace_nl(const struct xt_pknock_mtinfo *info,
 	scnprintf(msg.rule_name, info->rule_name_len + 1, info->rule_name);
 
 	memcpy(m + 1, &msg, m->len);
-	cn_netlink_send(m, 0, multicast_group, GFP_ATOMIC);
+
+	cn_netlink_send(m, multicast_group, GFP_ATOMIC);
+
 	kfree(m);
 #endif
 	return true;
 }
 
+#ifdef PK_CRYPTO
 /**
  * Transforms a sequence of characters to hexadecimal.
  *
@@ -732,6 +752,7 @@ static bool
 has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
     const unsigned char *payload, unsigned int payload_len)
 {
+	struct scatterlist sg[2];
 	char result[64]; // 64 bytes * 8 = 512 bits
 	char *hexresult;
 	unsigned int hexa_size;
@@ -762,7 +783,13 @@ has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
 
 	epoch_min = get_seconds() / 60;
 
-	ret = crypto_shash_setkey(crypto.tfm, secret, secret_len);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
+	sg_init_table(sg, ARRAY_SIZE(sg));
+#endif
+	sg_set_buf(&sg[0], &ipsrc, sizeof(ipsrc));
+	sg_set_buf(&sg[1], &epoch_min, sizeof(epoch_min));
+
+	ret = crypto_hash_setkey(crypto.tfm, secret, secret_len);
 	if (ret != 0) {
 		printk("crypto_hash_setkey() failed ret=%d\n", ret);
 		goto out;
@@ -773,10 +800,10 @@ has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
 	 * 4 bytes IP (32 bits) +
 	 * 4 bytes int epoch_min (32 bits)
 	 */
-	if ((ret = crypto_shash_update(&crypto.desc, (const void *)&ipsrc, sizeof(ipsrc))) != 0 ||
+	ret = crypto_hash_digest(&crypto.desc, sg,
-	    (ret = crypto_shash_update(&crypto.desc, (const void *)&epoch_min, sizeof(epoch_min))) != 0 ||
+	      sizeof(ipsrc) + sizeof(epoch_min), result);
-	    (ret = crypto_shash_final(&crypto.desc, result)) != 0) {
+	if (ret != 0) {
-		printk("crypto_shash_update/final() failed ret=%d\n", ret);
+		printk("crypto_hash_digest() failed ret=%d\n", ret);
 		goto out;
 	}
 
@@ -791,6 +818,7 @@ has_secret(const unsigned char *secret, unsigned int secret_len, uint32_t ipsrc,
 	kfree(hexresult);
 	return fret;
 }
+#endif /* PK_CRYPTO */
 
 /**
  * If the peer pass the security policy.
@@ -813,11 +841,13 @@ pass_security(struct peer *peer, const struct xt_pknock_mtinfo *info,
 		pk_debug("DENIED (anti-spoof protection)", peer);
 		return false;
 	}
+#ifdef PK_CRYPTO
 	/* Check for OPEN secret */
 	if (has_secret(info->open_secret,
 					info->open_secret_len, peer->ip,
 					payload, payload_len))
 		return true;
+#endif
 
 	return false;
 }
@@ -909,6 +939,7 @@ static bool
 is_close_knock(const struct peer *peer, const struct xt_pknock_mtinfo *info,
 		const unsigned char *payload, unsigned int payload_len)
 {
+#ifdef PK_CRYPTO
 	/* Check for CLOSE secret. */
 	if (has_secret(info->close_secret,
 				info->close_secret_len, peer->ip,
@@ -917,6 +948,7 @@ is_close_knock(const struct peer *peer, const struct xt_pknock_mtinfo *info,
 		pk_debug("BLOCKED", peer);
 		return true;
 	}
+#endif
 	return false;
 }
 
@@ -951,8 +983,14 @@ static bool pknock_mt(const struct sk_buff *skb,
 
 	case IPPROTO_UDP:
 	case IPPROTO_UDPLITE:
+#ifdef PK_CRYPTO
 		hdr_len = (iph->ihl * 4) + sizeof(struct udphdr);
 		break;
+#else
+		pr_debug("UDP protocol not supported\n");
+		return false;
+#endif
+
 	default:
 		pr_debug("IP payload protocol is neither tcp nor udp.\n");
 		return false;
@@ -1041,6 +1079,12 @@ static int pknock_mt_check(const struct xt_mtchk_param *par)
 
 	if (!(info->option & XT_PKNOCK_NAME))
 		RETURN_ERR("You must specify --name option.\n");
+
+#ifndef PK_CRYPTO
+	if (info->option & (XT_PKNOCK_OPENSECRET | XT_PKNOCK_CLOSESECRET))
+		RETURN_ERR("No crypto support available; "
+			"cannot use opensecret/closescret\n");
+#endif
 	if (info->option & XT_PKNOCK_OPENSECRET && info->ports_count != 1)
 		RETURN_ERR("--opensecret must have just one knock port\n");
 	if (info->option & XT_PKNOCK_KNOCKPORT) {
@@ -1110,24 +1154,28 @@ static int __init xt_pknock_mt_init(void)
 
 	if (gc_expir_time < DEFAULT_GC_EXPIRATION_TIME)
 		gc_expir_time = DEFAULT_GC_EXPIRATION_TIME;
+#ifdef PK_CRYPTO
 	if (request_module(crypto.algo) < 0) {
 		printk(KERN_ERR PKNOCK "request_module('%s') error.\n",
                         crypto.algo);
 		return -ENXIO;
 	}
 
-	crypto.tfm = crypto_alloc_shash(crypto.algo, 0, 0);
+	crypto.tfm = crypto_alloc_hash(crypto.algo, 0, CRYPTO_ALG_ASYNC);
 	if (IS_ERR(crypto.tfm)) {
 		printk(KERN_ERR PKNOCK "failed to load transform for %s\n",
 						crypto.algo);
 		return PTR_ERR(crypto.tfm);
 	}
 
-	crypto.size = crypto_shash_digestsize(crypto.tfm);
+	crypto.size = crypto_hash_digestsize(crypto.tfm);
 	crypto.desc.tfm = crypto.tfm;
 	crypto.desc.flags = 0;
+#else
+	pr_info("No crypto support for < 2.6.19\n");
+#endif
 
-	pde = proc_mkdir("xt_pknock", init_net.proc_net);
+	pde = proc_mkdir("xt_pknock", init_net__proc_net);
 	if (pde == NULL) {
 		printk(KERN_ERR PKNOCK "proc_mkdir() error in _init().\n");
 		return -ENXIO;
@@ -1137,11 +1185,14 @@ static int __init xt_pknock_mt_init(void)
 
 static void __exit xt_pknock_mt_exit(void)
 {
-	remove_proc_entry("xt_pknock", init_net.proc_net);
+	remove_proc_entry("xt_pknock", init_net__proc_net);
 	xt_unregister_match(&xt_pknock_mt_reg);
 	kfree(rule_hashtable);
+
+#ifdef PK_CRYPTO
 	if (crypto.tfm != NULL)
-		crypto_free_shash(crypto.tfm);
+		crypto_free_hash(crypto.tfm);
+#endif
 }
 
 module_init(xt_pknock_mt_init);

extensions/xt_CHAOS.c

@@ -54,11 +54,33 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
 	const int fragoff       = ntohs(iph->frag_off) & IP_OFFSET;
 	typeof(xt_tarpit) destiny;
 	bool ret;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 22)
+	int hotdrop = false;
+#else
 	bool hotdrop = false;
+#endif
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+	ret = xm_tcp->match(skb, par->in, par->out, xm_tcp, &tcp_params,
+	                    fragoff, thoff, &hotdrop);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+	{
+		struct xt_match_param local_par = {
+			.in        = par->in,
+			.out       = par->out,
+			.match     = xm_tcp,
+			.matchinfo = &tcp_params,
+			.fragoff   = fragoff,
+			.thoff     = thoff,
+			.hotdrop   = &hotdrop,
+		};
+		ret = xm_tcp->match(skb, &local_par);
+	}
+#else
 	{
 		struct xt_action_param local_par;
-		local_par.state    = par->state;
+		local_par.in        = par->in,
+		local_par.out       = par->out,
 		local_par.match     = xm_tcp;
 		local_par.matchinfo = &tcp_params;
 		local_par.fragoff   = fragoff;
@@ -67,21 +89,45 @@ xt_chaos_total(struct sk_buff *skb, const struct xt_action_param *par)
 		ret = xm_tcp->match(skb, &local_par);
 		hotdrop = local_par.hotdrop;
 	}
-	if (!ret || hotdrop || (unsigned int)prandom_u32() > delude_percentage)
+#endif
+	if (!ret || hotdrop || (unsigned int)net_random() > delude_percentage)
 		return;
 
 	destiny = (info->variant == XTCHAOS_TARPIT) ? xt_tarpit : xt_delude;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+	destiny->target(&skb, par->in, par->out, par->hooknum, destiny, NULL, NULL);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+	destiny->target(&skb, par->in, par->out, par->hooknum, destiny, NULL);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+	destiny->target(skb, par->in, par->out, par->hooknum, destiny, NULL);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
 	{
-		struct xt_action_param local_par;
+		struct xt_target_param local_par = {
-		local_par.state    = par->state;
+			.in       = par->in,
-		local_par.target   = destiny;
+			.out      = par->out,
-		local_par.targinfo = par->targinfo;
+			.hooknum  = par->hooknum,
+			.target   = destiny,
+			.targinfo = par->targinfo,
+			.family   = par->family,
+		};
 		destiny->target(skb, &local_par);
 	}
+#else
+	{
+		struct xt_action_param local_par;
+		local_par.in       = par->in;
+		local_par.out      = par->out;
+		local_par.hooknum  = par->hooknum;
+		local_par.target   = destiny;
+		local_par.targinfo = par->targinfo;
+		local_par.family   = par->family;
+		destiny->target(skb, &local_par);
+	}
+#endif
 }
 
 static unsigned int
-chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)
+chaos_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	/*
 	 * Equivalent to:
@@ -92,19 +138,43 @@ chaos_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	 * -A chaos -j DROP;
 	 */
 	const struct xt_chaos_tginfo *info = par->targinfo;
+	struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 
-	if ((unsigned int)prandom_u32() <= reject_percentage) {
+	if ((unsigned int)net_random() <= reject_percentage) {
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 18)
+		return xt_reject->target(pskb, par->in, par->out, par->hooknum,
+		       xt_reject, &reject_params, NULL);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+		return xt_reject->target(pskb, par->in, par->out, par->hooknum,
+		       xt_reject, &reject_params);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 27)
+		return xt_reject->target(skb, par->in, par->out, par->hooknum,
+		       xt_reject, &reject_params);
+#elif LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 34)
+		struct xt_target_param local_par = {
+			.in       = par->in,
+			.out      = par->out,
+			.hooknum  = par->hooknum,
+			.target   = xt_reject,
+			.targinfo = &reject_params,
+		};
+		return xt_reject->target(skb, &local_par);
+#else
 		struct xt_action_param local_par;
-		local_par.state    = par->state;
+		local_par.in       = par->in;
+		local_par.out      = par->out;
+		local_par.hooknum  = par->hooknum;
 		local_par.target   = xt_reject;
 		local_par.targinfo = &reject_params;
 		return xt_reject->target(skb, &local_par);
+#endif
 	}
 
 	/* TARPIT/DELUDE may not be called from the OUTPUT chain */
-	if (iph->protocol == IPPROTO_TCP && info->variant != XTCHAOS_NORMAL &&
+	if (iph->protocol == IPPROTO_TCP &&
-	    par->state->hook != NF_INET_LOCAL_OUT)
+	    info->variant != XTCHAOS_NORMAL &&
+	    par->hooknum != NF_INET_LOCAL_OUT)
 		xt_chaos_total(skb, par);
 
 	return NF_DROP;

extensions/xt_CHECKSUM.c

@@ -0,0 +1,80 @@
+/*
+ * (C) 2002 by Harald Welte <laforge@netfilter.org>
+ * (C) 2010 Red Hat, Inc.
+ *
+ * Author: Michael S. Tsirkin <mst@redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/version.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+#	error ----------------------------------------------------------
+#	error This module has been merged into, and is available in the
+#	error mainline since Linux kernel v2.6.36. Please use that.
+#	error ----------------------------------------------------------
+#endif
+
+#include <linux/netfilter/x_tables.h>
+#include "xt_CHECKSUM.h"
+#include "compat_xtables.h"
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Michael S. Tsirkin <mst@redhat.com>");
+MODULE_DESCRIPTION("Xtables: checksum modification");
+MODULE_ALIAS("ipt_CHECKSUM");
+MODULE_ALIAS("ip6t_CHECKSUM");
+
+static unsigned int
+checksum_tg(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	struct sk_buff *skb = *pskb;
+
+	if (skb->ip_summed == CHECKSUM_PARTIAL)
+		skb_checksum_help(skb);
+
+	return XT_CONTINUE;
+}
+
+static int checksum_tg_check(const struct xt_tgchk_param *par)
+{
+	const struct xt_CHECKSUM_info *einfo = par->targinfo;
+
+	if (einfo->operation & ~XT_CHECKSUM_OP_FILL) {
+		pr_info("unsupported CHECKSUM operation %x\n", einfo->operation);
+		return -EINVAL;
+	}
+	if (!einfo->operation) {
+		pr_info("no CHECKSUM operation enabled\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+static struct xt_target checksum_tg_reg __read_mostly = {
+	.name       = "CHECKSUM",
+	.family     = NFPROTO_UNSPEC,
+	.target     = checksum_tg,
+	.targetsize = sizeof(struct xt_CHECKSUM_info),
+	.table      = "mangle",
+	.checkentry = checksum_tg_check,
+	.me         = THIS_MODULE,
+};
+
+static int __init checksum_tg_init(void)
+{
+	return xt_register_target(&checksum_tg_reg);
+}
+
+static void __exit checksum_tg_exit(void)
+{
+	xt_unregister_target(&checksum_tg_reg);
+}
+
+module_init(checksum_tg_init);
+module_exit(checksum_tg_exit);

extensions/xt_CHECKSUM.h

@@ -0,0 +1,18 @@
+/* Header file for iptables ipt_CHECKSUM target
+ *
+ * (C) 2002 by Harald Welte <laforge@gnumonks.org>
+ * (C) 2010 Red Hat Inc
+ * Author: Michael S. Tsirkin <mst@redhat.com>
+ *
+ * This software is distributed under GNU GPL v2, 1991
+*/
+#ifndef _IPT_CHECKSUM_TARGET_H
+#define _IPT_CHECKSUM_TARGET_H
+
+#define XT_CHECKSUM_OP_FILL	0x01	/* fill in checksum in IP header */
+
+struct xt_CHECKSUM_info {
+	__u8 operation;	/* bitset of operations */
+};
+
+#endif /* _IPT_CHECKSUM_TARGET_H */

extensions/xt_DELUDE.c

@@ -25,8 +25,7 @@
 #include "compat_xtables.h"
 #define PFX KBUILD_MODNAME ": "
 
-static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
+static void delude_send_reset(struct sk_buff *oldskb, unsigned int hook)
-    unsigned int hook)
 {
 	struct tcphdr _otcph, *tcph;
 	const struct tcphdr *oth;
@@ -79,7 +78,7 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
 	tcph->doff   = sizeof(struct tcphdr) / 4;
 
 	/* DELUDE essential part */
-	if (oth->syn && !oth->ack && !oth->fin) {
+	if (oth->syn && !oth->ack && !oth->rst && !oth->fin) {
 		tcph->syn     = true;
 		tcph->seq     = 0;
 		tcph->ack     = true;
@@ -101,14 +100,20 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
 		}
 	}
 
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 20)
+	tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr), niph->saddr,
+	              niph->daddr, csum_partial((char *)tcph,
+	              sizeof(struct tcphdr), 0));
+#else
 	tcph->check = tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
 	              niph->daddr, csum_partial((char *)tcph,
 	              sizeof(struct tcphdr), 0));
+#endif
 
 	addr_type = RTN_UNSPEC;
 #ifdef CONFIG_BRIDGE_NETFILTER
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
-	    nskb->nf_bridge->physoutdev))
+	    nskb->nf_bridge->mask & BRNF_BRIDGED))
 #else
 	if (hook != NF_INET_FORWARD)
 #endif
@@ -117,7 +122,7 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
 	/* ip_route_me_harder expects skb->dst to be set */
 	skb_dst_set(nskb, dst_clone(skb_dst(oldskb)));
 
-	if (ip_route_me_harder(net, nskb, addr_type))
+	if (ip_route_me_harder(&nskb, addr_type))
 		goto free_nskb;
 	else
 		niph = ip_hdr(nskb);
@@ -131,7 +136,7 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
 
 	nf_ct_attach(nskb, oldskb);
 
-	ip_local_out(net, nskb->sk, nskb);
+	ip_local_out(nskb);
 	return;
 
  free_nskb:
@@ -139,14 +144,12 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
 }
 
 static unsigned int
-delude_tg(struct sk_buff *skb, const struct xt_action_param *par)
+delude_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
-	/*
+	/* WARNING: This code causes reentry within iptables.
-	 * Sending the reset causes reentrancy within iptables - and should not pose
+	   This means that the iptables jump stack is now crap.  We
-	 * a problem, as that is supported since Linux 2.6.35. But since we do not
+	   must return an absolute verdict. --RR */
-	 * actually want to have a connection open, we are still going to drop it.
+	delude_send_reset(*pskb, par->hooknum);
-	 */
-	delude_send_reset(par_net(par), skb, par->state->hook);
 	return NF_DROP;
 }
 

extensions/xt_DHCPMAC.c

@@ -34,9 +34,9 @@ static void ether_set(unsigned char *addr, const unsigned char *op,
 	unsigned int i;
 
 	for (i = 0; i < ETH_ALEN && mask > 0; ++i) {
-		lo_mask = (mask >= 8) ? 8 : mask;
+		lo_mask = mask % 8;
 		/* FF << 4 >> 4 = 0F */
-		lo_mask = (uint8_t)(~0U << lo_mask) >> lo_mask;
+		lo_mask = ~(uint8_t)0U << lo_mask >> lo_mask;
 		addr[i] &= lo_mask;
 		addr[i] |= op[i] & ~lo_mask;
 		if (mask >= 8)
@@ -55,9 +55,9 @@ static bool ether_cmp(const unsigned char *lh, const unsigned char *rh,
 #define ZMACHEX(s) s[0], s[1], s[2], s[3], s[4], s[5]
 
 	for (i = 0; i < ETH_ALEN && mask > 0; ++i) {
-		lo_mask = (mask >= 8) ? 8 : mask;
+		lo_mask = mask % 8;
 		/* ~(0xFF << 4 >> 4) = ~0x0F = 0xF0 */
-		lo_mask = ~((uint8_t)(~0U << lo_mask) >> lo_mask);
+		lo_mask = ~(~(uint8_t)0U << lo_mask >> lo_mask);
 		if ((lh[i] ^ rh[i]) & lo_mask)
 			return false;
 		if (mask >= 8)
@@ -89,14 +89,15 @@ dhcpmac_mt(const struct sk_buff *skb, struct xt_action_param *par)
 }
 
 static unsigned int
-dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
+dhcpmac_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	const struct dhcpmac_info *info = par->targinfo;
 	struct dhcp_message dhcpbuf, *dh;
 	struct udphdr udpbuf, *udph;
+	struct sk_buff *skb = *pskb;
 	unsigned int i;
 
-	if (!skb_make_writable(skb, 0))
+	if (!skb_make_writable(pskb, 0))
 		return NF_DROP;
 
 	udph = skb_header_pointer(skb, ip_hdrlen(skb),
@@ -110,12 +111,13 @@ dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		return NF_DROP;
 
 	for (i = 0; i < sizeof(dh->chaddr); i += 2)
-		csum_replace2(&udph->check, *(const __be16 *)(dh->chaddr + i), 0);
+		csum_replace2(&udph->check, *(const __be16 *)dh->chaddr, 0);
 
+	memset(dh->chaddr, 0, sizeof(dh->chaddr));
 	ether_set(dh->chaddr, info->addr, info->mask);
 
 	for (i = 0; i < sizeof(dh->chaddr); i += 2)
-		csum_replace2(&udph->check, 0, *(const __be16 *)(dh->chaddr + i));
+		csum_replace2(&udph->check, 0, *(const __be16 *)dh->chaddr);
 
 	return XT_CONTINUE;
 }

extensions/xt_DNETMAP.c

@@ -26,13 +26,17 @@
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv4.h>
 #include <linux/netfilter/x_tables.h>
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/uidgid.h>
 #include <linux/version.h>
+#include <net/netfilter/nf_nat_rule.h>
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34)
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
-#include <net/netfilter/nf_nat.h>
+#endif
+#if LINUX_VERSION_CODE < KERNEL_VERSION(3, 3, 0)
+#	include <net/netfilter/nf_nat.h>
+#else
+#	include <linux/netfilter/nf_nat.h>
+#endif
 #include "compat_xtables.h"
 #include "xt_DNETMAP.h"
 
@@ -80,8 +84,8 @@ struct dnetmap_entry {
 };
 
 struct dnetmap_prefix {
-	struct nf_nat_range prefix;
+	struct nf_nat_ipv4_multi_range_compat prefix;
-	char prefix_str[20];
+	char prefix_str[16];
 #ifdef CONFIG_PROC_FS
 	char proc_str_data[20];
 	char proc_str_stat[25];
@@ -105,19 +109,28 @@ struct dnetmap_net {
 	struct list_head *dnetmap_iphash;
 };
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34)
 static int dnetmap_net_id;
 static inline struct dnetmap_net *dnetmap_pernet(struct net *net)
 {
 	return net_generic(net, dnetmap_net_id);
 }
+#else
+struct dnetmap_net *dnetmap;
+#define dnetmap_pernet(x) dnetmap
+#endif
 
 static DEFINE_SPINLOCK(dnetmap_lock);
 static DEFINE_MUTEX(dnetmap_mutex);
 
 #ifdef CONFIG_PROC_FS
-static const struct file_operations dnetmap_tg_fops, dnetmap_stat_proc_fops;
+static const struct file_operations dnetmap_tg_fops;
 #endif
 
+static int dnetmap_stat_proc_read(char __user *buffer, char **start,
+				  off_t offset, int length, int *eof,
+				  void *data);
+
 static inline unsigned int dnetmap_entry_hash(const __be32 addr)
 {
 	return ntohl(addr) & (hash_size - 1);
@@ -166,7 +179,7 @@ dnetmap_addr_in_prefix(struct dnetmap_net *dnetmap_net, const __be32 addr,
 
 static struct dnetmap_prefix *
 dnetmap_prefix_lookup(struct dnetmap_net *dnetmap_net,
-		      const struct nf_nat_range *mr)
+		      const struct nf_nat_ipv4_multi_range_compat *mr)
 {
 	struct dnetmap_prefix *p;
 
@@ -245,7 +258,7 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(par->net);
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
-	const struct nf_nat_range *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
 	struct dnetmap_prefix *p;
 	struct dnetmap_entry *e;
 #ifdef CONFIG_PROC_FS
@@ -261,10 +274,14 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 		return ret;
 	}
 
-	if (!(mr->flags & NF_NAT_RANGE_MAP_IPS)) {
+	if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
 		pr_debug("DNETMAP:check: bad MAP_IPS.\n");
 		return -EINVAL;
 	}
+	if (mr->rangesize != 1) {
+		pr_debug("DNETMAP:check: bad rangesize %u.\n", mr->rangesize);
+		return -EINVAL;
+	}
 
 	mutex_lock(&dnetmap_mutex);
 	p = dnetmap_prefix_lookup(dnetmap_net, mr);
@@ -290,15 +307,15 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 	INIT_LIST_HEAD(&p->lru_list);
 	INIT_LIST_HEAD(&p->elist);
 
-	ip_min = ntohl(mr->min_addr.ip) + (whole_prefix == 0);
+	ip_min = ntohl(mr->range[0].min_ip) + (whole_prefix == 0);
-	ip_max = ntohl(mr->max_addr.ip) - (whole_prefix == 0);
+	ip_max = ntohl(mr->range[0].max_ip) - (whole_prefix == 0);
 
-	sprintf(p->prefix_str, NIPQUAD_FMT "/%u", NIPQUAD(mr->min_addr.ip),
+	sprintf(p->prefix_str, NIPQUAD_FMT "/%u", NIPQUAD(mr->range[0].min_ip),
 		33 - ffs(~(ip_min ^ ip_max)));
 #ifdef CONFIG_PROC_FS
-	sprintf(p->proc_str_data, NIPQUAD_FMT "_%u", NIPQUAD(mr->min_addr.ip),
+	sprintf(p->proc_str_data, NIPQUAD_FMT "_%u", NIPQUAD(mr->range[0].min_ip),
 		33 - ffs(~(ip_min ^ ip_max)));
-	sprintf(p->proc_str_stat, NIPQUAD_FMT "_%u_stat", NIPQUAD(mr->min_addr.ip),
+	sprintf(p->proc_str_stat, NIPQUAD_FMT "_%u_stat", NIPQUAD(mr->range[0].min_ip),
 		33 - ffs(~(ip_min ^ ip_max)));
 #endif
 	printk(KERN_INFO KBUILD_MODNAME ": new prefix %s\n", p->prefix_str);
@@ -327,20 +344,21 @@ static int dnetmap_tg_check(const struct xt_tgchk_param *par)
 		ret = -ENOMEM;
 		goto out;
 	}
-	proc_set_user(pde_data, make_kuid(&init_user_ns, proc_uid),
+	pde_data->uid = proc_uid;
-	              make_kgid(&init_user_ns, proc_gid));
+	pde_data->gid = proc_gid;
 
 	/* statistics */
-	pde_stat = proc_create_data(p->proc_str_stat, proc_perms,
+	pde_stat = create_proc_entry(p->proc_str_stat, proc_perms,
-		                    dnetmap_net->xt_dnetmap,
+				     dnetmap_net->xt_dnetmap);
-		                    &dnetmap_stat_proc_fops, p);
 	if (pde_stat == NULL) {
 		kfree(p);
 		ret = -ENOMEM;
 		goto out;
 	}
-	proc_set_user(pde_stat, make_kuid(&init_user_ns, proc_uid),
+	pde_stat->data = p;
-	              make_kgid(&init_user_ns, proc_gid));
+	pde_stat->read_proc = dnetmap_stat_proc_read;
+	pde_stat->uid = proc_uid;
+	pde_stat->gid = proc_gid;
 #endif
 
 	spin_lock_bh(&dnetmap_lock);
@@ -354,30 +372,30 @@ out:
 }
 
 static unsigned int
-dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
+dnetmap_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
-	struct net *net = dev_net(par->state->in ? par->state->in : par->state->out);
+	struct sk_buff *skb = *pskb;
+	struct net *net = dev_net(par->in ? par->in : par->out);
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
 	struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
 	__be32 prenat_ip, postnat_ip, prenat_ip_prev;
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
-	const struct nf_nat_range *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 18, 0)
+	struct nf_nat_ipv4_range newrange;
-	struct nf_nat_range2 newrange;
-#else
-	struct nf_nat_range newrange;
-#endif
 	struct dnetmap_entry *e;
 	struct dnetmap_prefix *p;
 	__s32 jttl;
-	unsigned int hooknum = par->state->hook;
+
+	NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING ||
+		     par->hooknum == NF_INET_LOCAL_OUT ||
+		     par->hooknum == NF_INET_PRE_ROUTING);
 	ct = nf_ct_get(skb, &ctinfo);
 
 	jttl = tginfo->flags & XT_DNETMAP_TTL ? tginfo->ttl * HZ : jtimeout;
 
 	/* in prerouting we try to map postnat-ip to prenat-ip */
-	if (hooknum == NF_INET_PRE_ROUTING) {
+	if (par->hooknum == NF_INET_PRE_ROUTING) {
 		postnat_ip = ip_hdr(skb)->daddr;
 
 		spin_lock_bh(&dnetmap_lock);
@@ -390,7 +408,7 @@ dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 		/* if prefix is specified, we check if
 		it matches lookedup entry */
 		if (tginfo->flags & XT_DNETMAP_PREFIX)
-			if (memcmp(mr, &e->prefix->prefix, sizeof(*mr)))
+			if (memcmp(mr, &e->prefix, sizeof(*mr)))
 				goto no_rev_map;
 		/* don't reset ttl if flag is set */
 		if (jttl >= 0 && (! (e->flags & XT_DNETMAP_STATIC) ) ) {
@@ -401,14 +419,15 @@ dnetmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
 
 		spin_unlock_bh(&dnetmap_lock);
 
-		memset(&newrange, 0, sizeof(newrange));
+		newrange = ((struct nf_nat_ipv4_range) {
-		newrange.flags = mr->flags | NF_NAT_RANGE_MAP_IPS;
+			    mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
-		newrange.min_addr.ip = e->prenat_addr;
+			    e->prenat_addr, e->prenat_addr,
-		newrange.max_addr.ip = e->prenat_addr;
+			    mr->range[0].min, mr->range[0].max});
-		newrange.min_proto = mr->min_proto;
+
-		newrange.max_proto = mr->max_proto;
+		/* Hand modified range to generic setup. */
 		return nf_nat_setup_info(ct, &newrange,
-					 HOOK2MANIP(hooknum));
+					 HOOK2MANIP(par->hooknum));
+
 	}
 
 	prenat_ip = ip_hdr(skb)->saddr;
@@ -490,13 +509,14 @@ bind_new_prefix:
 
 	spin_unlock_bh(&dnetmap_lock);
 
-	memset(&newrange, 0, sizeof(newrange));
+	newrange = ((struct nf_nat_ipv4_range) {
-	newrange.flags = mr->flags | NF_NAT_RANGE_MAP_IPS;
+		    mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
-	newrange.min_addr.ip = postnat_ip;
+		    postnat_ip, postnat_ip,
-	newrange.max_addr.ip = postnat_ip;
+		    mr->range[0].min, mr->range[0].max});
-	newrange.min_proto = mr->min_proto;
+
-	newrange.max_proto = mr->max_proto;
+	/* Hand modified range to generic setup. */
-	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->state->hook));
+	return nf_nat_setup_info(ct, &newrange, HOOK2MANIP(par->hooknum));
+
 no_rev_map:
 no_free_ip:
 	spin_unlock_bh(&dnetmap_lock);
@@ -508,7 +528,7 @@ static void dnetmap_tg_destroy(const struct xt_tgdtor_param *par)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(par->net);
 	const struct xt_DNETMAP_tginfo *tginfo = par->targinfo;
-	const struct nf_nat_range *mr = &tginfo->prefix;
+	const struct nf_nat_ipv4_multi_range_compat *mr = &tginfo->prefix;
 	struct dnetmap_prefix *p;
 
 	if (!(tginfo->flags & XT_DNETMAP_PREFIX))
@@ -590,24 +610,27 @@ static const struct seq_operations dnetmap_seq_ops = {
 
 static int dnetmap_seq_open(struct inode *inode, struct file *file)
 {
+	struct proc_dir_entry *pde = PDE(inode);
 	struct dnetmap_iter_state *st;
 
 	st = __seq_open_private(file, &dnetmap_seq_ops, sizeof(*st));
 	if (st == NULL)
 		return -ENOMEM;
 
-	st->p = PDE_DATA(inode);
+	st->p = pde->data;
 	return 0;
 }
 
 static ssize_t
 dnetmap_tg_proc_write(struct file *file, const char __user *input,size_t size, loff_t *loff)
 {
-	struct dnetmap_prefix *p = PDE_DATA(file_inode(file));
+	const struct proc_dir_entry *pde = PDE(file->f_path.dentry->d_inode);
+	struct dnetmap_prefix *p = pde->data;
 	struct dnetmap_entry *e;
 	char buf[sizeof("+192.168.100.100:200.200.200.200")];
 	const char *c = buf;
 	const char *c2;
+	//union nf_inet_addr addr = {};
 	__be32 addr1,addr2;
 	bool add;
 	char str[25];
@@ -777,9 +800,11 @@ static const struct file_operations dnetmap_tg_fops = {
 };
 
 /* for statistics */
-static int dnetmap_stat_proc_show(struct seq_file *m, void *data)
+static int dnetmap_stat_proc_read(char __user *buffer, char **start,
+				  off_t offset, int length, int *eof,
+				  void *data)
 {
-	const struct dnetmap_prefix *p = m->private;
+	const struct dnetmap_prefix *p = data;
 	struct dnetmap_entry *e;
 	unsigned int used, used_static, all;
 	long int ttl, sum_ttl;
@@ -805,25 +830,16 @@ static int dnetmap_stat_proc_show(struct seq_file *m, void *data)
 	}
 
 	sum_ttl = used > 0 ? sum_ttl / (used * HZ) : 0;
-	seq_printf(m, "%u %u %u %ld %s\n", used, used_static, all, sum_ttl,(p->flags & XT_DNETMAP_PERSISTENT ? "persistent" : ""));
+	sprintf(buffer, "%u %u %u %ld %s\n", used, used_static, all, sum_ttl,(p->flags & XT_DNETMAP_PERSISTENT ? "persistent" : ""));
+
+	if (length >= strlen(buffer))
+		*eof = true;
 
 	spin_unlock_bh(&dnetmap_lock);
 
-	return 0;
+	return strlen(buffer);
 }
 
-static int dnetmap_stat_proc_open(struct inode *inode, struct file *file)
-{
-	return single_open(file, dnetmap_stat_proc_show, PDE_DATA(inode));
-}
-
-static const struct file_operations dnetmap_stat_proc_fops = {
-	.open    = dnetmap_stat_proc_open,
-	.read    = seq_read,
-	.llseek  = seq_lseek,
-	.release = single_release,
-};
-
 static int __net_init dnetmap_proc_net_init(struct net *net)
 {
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
@@ -836,7 +852,7 @@ static int __net_init dnetmap_proc_net_init(struct net *net)
 
 static void __net_exit dnetmap_proc_net_exit(struct net *net)
 {
-	remove_proc_entry("xt_DNETMAP", net->proc_net);
+	proc_net_remove(net, "xt_DNETMAP");
 }
 
 #else
@@ -855,6 +871,13 @@ static int __net_init dnetmap_net_init(struct net *net)
 	struct dnetmap_net *dnetmap_net = dnetmap_pernet(net);
 	int i;
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
+	dnetmap = kmalloc(sizeof(struct dnetmap_net),GFP_ATOMIC);
+	if (dnetmap == NULL)
+		return -ENOMEM;
+	dnetmap_net = dnetmap;
+#endif
+
 	dnetmap_net->dnetmap_iphash = kmalloc(sizeof(struct list_head) *
 					      hash_size * 2, GFP_ATOMIC);
 	if (dnetmap_net->dnetmap_iphash == NULL)
@@ -883,15 +906,20 @@ static void __net_exit dnetmap_net_exit(struct net *net)
 	mutex_unlock(&dnetmap_mutex);
 
 	kfree(dnetmap_net->dnetmap_iphash);
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 	kfree(dnetmap_net);
+#endif
+
 	dnetmap_proc_net_exit(net);
 }
 
 static struct pernet_operations dnetmap_net_ops = {
 	.init = dnetmap_net_init,
 	.exit = dnetmap_net_exit,
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 34)
 	.id   = &dnetmap_net_id,
 	.size = sizeof(struct dnetmap_net),
+#endif
 };
 
 static struct xt_target dnetmap_tg_reg __read_mostly = {

extensions/xt_DNETMAP.h

@@ -13,7 +13,7 @@ enum {
 };
 
 struct xt_DNETMAP_tginfo {
-	struct nf_nat_range prefix;
+	struct nf_nat_ipv4_multi_range_compat prefix;
 	__u8 flags;
 	__s32 ttl;
 };

extensions/xt_ECHO.c

@@ -24,8 +24,9 @@
 #include "compat_xtables.h"
 
 static unsigned int
-echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
+echo_tg6(struct sk_buff **poldskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *oldskb = *poldskb;
 	const struct udphdr *oldudp;
 	const struct ipv6hdr *oldip;
 	struct udphdr *newudp, oldudp_buf;
@@ -35,10 +36,10 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	void *payload;
 	struct flowi6 fl;
 	struct dst_entry *dst = NULL;
-	struct net *net = dev_net((par->state->in != NULL) ? par->state->in : par->state->out);
+	struct net *net = dev_net((par->in != NULL) ? par->in : par->out);
 
 	/* This allows us to do the copy operation in fewer lines of code. */
-	if (skb_linearize(oldskb) < 0)
+	if (skb_linearize(*poldskb) < 0)
 		return NF_DROP;
 
 	oldip  = ipv6_hdr(oldskb);
@@ -76,7 +77,6 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	payload  = skb_header_pointer(oldskb, par->thoff +
 	           sizeof(*oldudp), data_len, NULL);
 	memcpy(skb_put(newskb, data_len), payload, data_len);
-	newip->payload_len = htons(newskb->len);
 
 #if 0
 	/*
@@ -105,15 +105,19 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 	}
 
 	skb_dst_set(newskb, dst);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
 	newip->hop_limit = ip6_dst_hoplimit(skb_dst(newskb));
+#else
+	newip->hop_limit = dst_metric(skb_dst(newskb), RTAX_HOPLIMIT);
+#endif
 	newskb->ip_summed = CHECKSUM_NONE;
 
 	/* "Never happens" (?) */
 	if (newskb->len > dst_mtu(skb_dst(newskb)))
 		goto free_nskb;
 
-	nf_ct_attach(newskb, oldskb);
+	nf_ct_attach(newskb, *poldskb);
-	ip6_local_out(par_net(par), newskb->sk, newskb);
+	ip6_local_out(newskb);
 	return NF_DROP;
 
  free_nskb:
@@ -122,8 +126,9 @@ echo_tg6(struct sk_buff *oldskb, const struct xt_action_param *par)
 }
 
 static unsigned int
-echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
+echo_tg4(struct sk_buff **poldskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *oldskb = *poldskb;
 	const struct udphdr *oldudp;
 	const struct iphdr *oldip;
 	struct udphdr *newudp, oldudp_buf;
@@ -133,7 +138,7 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	void *payload;
 
 	/* This allows us to do the copy operation in fewer lines of code. */
-	if (skb_linearize(oldskb) < 0)
+	if (skb_linearize(*poldskb) < 0)
 		return NF_DROP;
 
 	oldip  = ip_hdr(oldskb);
@@ -157,8 +162,8 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	newip->version  = oldip->version;
 	newip->ihl      = sizeof(*newip) / 4;
 	newip->tos      = oldip->tos;
-	newip->id       = oldip->id;
+	newip->id       = 0;
-	newip->frag_off = 0;
+	newip->frag_off = htons(IP_DF);
 	newip->protocol = oldip->protocol;
 	newip->check    = 0;
 	newip->saddr    = oldip->daddr;
@@ -174,7 +179,6 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	payload  = skb_header_pointer(oldskb, par->thoff +
 	           sizeof(*oldudp), data_len, NULL);
 	memcpy(skb_put(newskb, data_len), payload, data_len);
-	newip->tot_len = htons(newskb->len);
 
 #if 0
 	/*
@@ -192,18 +196,22 @@ echo_tg4(struct sk_buff *oldskb, const struct xt_action_param *par)
 	/* ip_route_me_harder expects the skb's dst to be set */
 	skb_dst_set(newskb, dst_clone(skb_dst(oldskb)));
 
-	if (ip_route_me_harder(par_net(par), newskb, RTN_UNSPEC) != 0)
+	if (ip_route_me_harder(&newskb, RTN_UNSPEC) != 0)
 		goto free_nskb;
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
 	newip->ttl = ip4_dst_hoplimit(skb_dst(newskb));
+#else
+	newip->ttl = dst_metric(skb_dst(newskb), RTAX_HOPLIMIT);
+#endif
 	newskb->ip_summed = CHECKSUM_NONE;
 
 	/* "Never happens" (?) */
 	if (newskb->len > dst_mtu(skb_dst(newskb)))
 		goto free_nskb;
 
-	nf_ct_attach(newskb, oldskb);
+	nf_ct_attach(newskb, *poldskb);
-	ip_local_out(par_net(par), newskb->sk, newskb);
+	ip_local_out(newskb);
 	return NF_DROP;
 
  free_nskb:

extensions/xt_IPMARK.c

@@ -25,9 +25,10 @@ MODULE_ALIAS("ipt_IPMARK");
 MODULE_ALIAS("ip6t_IPMARK");
 
 static unsigned int
-ipmark_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+ipmark_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	const struct xt_ipmark_tginfo *ipmarkinfo = par->targinfo;
+	const struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 	__u32 mark;
 
@@ -60,9 +61,10 @@ static __u32 ipmark_from_ip6(const struct in6_addr *a, unsigned int s)
 }
 
 static unsigned int
-ipmark_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+ipmark_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 {
 	const struct xt_ipmark_tginfo *info = par->targinfo;
+	const struct sk_buff *skb = *pskb;
 	const struct ipv6hdr *iph = ipv6_hdr(skb);
 	__u32 mark;
 

extensions/xt_LOGMARK.c

@@ -52,24 +52,20 @@ static void logmark_ct(const struct nf_conn *ct, enum ip_conntrack_info ctinfo)
 		printk("EXPECTED");
 		prev = true;
 	}
-	if (ct->status & IPS_SEEN_REPLY) {
+	if (ct->status & IPS_SEEN_REPLY)
-		printk("%s""SEEN_REPLY", prev ? "," : "");
+		printk("%s""SEEN_REPLY", prev++ ? "," : "");
-		prev = true;
+	if (ct->status & IPS_ASSURED)
-	}
+		printk("%s""ASSURED", prev++ ? "," : "");
-	if (ct->status & IPS_ASSURED) {
+	if (ct->status & IPS_CONFIRMED)
-		printk("%s""ASSURED", prev ? "," : "");
+		printk("%s""CONFIRMED", prev++ ? "," : "");
-		prev = true;
+	printk(" lifetime=%lus",
-	}
+	       (jiffies - ct->timeout.expires) / HZ);
-	if (ct->status & IPS_CONFIRMED) {
-		printk("%s""CONFIRMED", prev ? "," : "");
-		prev = true;
-	}
-	printk(" lifetime=%lus", nf_ct_expires(ct) / HZ);
 }
 
 static unsigned int
-logmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
+logmark_tg(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *skb = *pskb;
 	const struct xt_logmark_tginfo *info = par->targinfo;
 	const struct nf_conn *ct;
 	enum ip_conntrack_info ctinfo;
@@ -77,13 +73,20 @@ logmark_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	printk("<%u>%.*s""iif=%d hook=%s nfmark=0x%x "
 	       "secmark=0x%x classify=0x%x",
 	       info->level, (unsigned int)sizeof(info->prefix), info->prefix,
-	       skb_ifindex(skb), hook_names[par->state->hook],
+	       skb_ifindex(skb), hook_names[par->hooknum],
 	       skb_nfmark(skb), skb_secmark(skb), skb->priority);
 
 	ct = nf_ct_get(skb, &ctinfo);
 	printk(" ctdir=%s", dir_names[ctinfo >= IP_CT_IS_REPLY]);
 	if (ct == NULL)
 		printk(" ct=NULL ctmark=NULL ctstate=INVALID ctstatus=NONE");
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
+	else if (nf_ct_is_untracked(ct))
+		printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
+#else
+	else if (ct == &nf_conntrack_untracked)
+		printk(" ct=UNTRACKED ctmark=NULL ctstate=UNTRACKED ctstatus=NONE");
+#endif
 	else
 		logmark_ct(ct, ctinfo);
 

extensions/xt_SYSRQ.c

@@ -1,6 +1,6 @@
 /*
  *	"SYSRQ" target extension for Xtables
- *	Copyright Jan Engelhardt, 2016
+ *	Copyright © Jan Engelhardt, 2008 - 2010
  *
  *	Based upon the ipt_SYSRQ idea by Marek Zalem <marek [at] terminus sk>
  *
@@ -21,12 +21,13 @@
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter/x_tables.h>
-#include <crypto/hash.h>
+#include <linux/crypto.h>
+#include <linux/scatterlist.h>
 #include <net/ip.h>
-#include <net/ipv6.h>
 #include "compat_xtables.h"
 
-#if defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19) && \
+    (defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE))
 #	define WITH_CRYPTO 1
 #endif
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
@@ -49,7 +50,7 @@ MODULE_PARM_DESC(seqno, "sequence number for remote sysrq");
 MODULE_PARM_DESC(debug, "debugging: 0=off, 1=on");
 
 #ifdef WITH_CRYPTO
-static struct crypto_shash *sysrq_tfm;
+static struct crypto_hash *sysrq_tfm;
 static int sysrq_digest_size;
 static unsigned char *sysrq_digest_password;
 static unsigned char *sysrq_digest;
@@ -74,7 +75,8 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 {
 	const char *data = pdata;
 	int i, n;
-	struct shash_desc desc;
+	struct scatterlist sg[2];
+	struct hash_desc desc;
 	int ret;
 	long new_seqno = 0;
 
@@ -115,15 +117,17 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 
 	desc.tfm   = sysrq_tfm;
 	desc.flags = 0;
-	ret = crypto_shash_init(&desc);
+	ret = crypto_hash_init(&desc);
 	if (ret != 0)
 		goto hash_fail;
-	if (crypto_shash_update(&desc, data, n) != 0)
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
-		goto hash_fail;
+	sg_init_table(sg, 2);
-	if (crypto_shash_update(&desc, sysrq_digest_password,
+#endif
-	    strlen(sysrq_digest_password)) != 0)
+	sg_set_buf(&sg[0], data, n);
-		goto hash_fail;
+	i = strlen(sysrq_digest_password);
-	if (crypto_shash_final(&desc, sysrq_digest) != 0)
+	sg_set_buf(&sg[1], sysrq_digest_password, i);
+	ret = crypto_hash_digest(&desc, sg, n + i, sysrq_digest);
+	if (ret != 0)
 		goto hash_fail;
 
 	for (i = 0; i < sysrq_digest_size; ++i) {
@@ -150,7 +154,13 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 	sysrq_seqno = new_seqno;
 	for (i = 0; i < len && data[i] != ','; ++i) {
 		printk(KERN_INFO KBUILD_MODNAME ": SysRq %c\n", data[i]);
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
 		handle_sysrq(data[i]);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+		handle_sysrq(data[i], NULL);
+#else
+		handle_sysrq(data[i], NULL, NULL);
+#endif
 	}
 	return NF_ACCEPT;
 
@@ -181,14 +191,21 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 		return NF_DROP;
 	}
 
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 36)
 	handle_sysrq(c);
+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 19)
+	handle_sysrq(c, NULL);
+#else
+	handle_sysrq(c, NULL, NULL);
+#endif
 	return NF_ACCEPT;
 }
 #endif
 
 static unsigned int
-sysrq_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+sysrq_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	struct sk_buff *skb = *pskb;
 	const struct iphdr *iph;
 	const struct udphdr *udph;
 	uint16_t len;
@@ -217,8 +234,9 @@ sysrq_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 
 #ifdef WITH_IPV6
 static unsigned int
-sysrq_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+sysrq_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	struct sk_buff *skb = *pskb;
 	const struct ipv6hdr *iph;
 	const struct udphdr *udph;
 	unsigned short frag_off;
@@ -301,7 +319,7 @@ static void sysrq_crypto_exit(void)
 {
 #ifdef WITH_CRYPTO
 	if (sysrq_tfm)
-		crypto_free_shash(sysrq_tfm);
+		crypto_free_hash(sysrq_tfm);
 	if (sysrq_digest)
 		kfree(sysrq_digest);
 	if (sysrq_hexdigest)
@@ -317,7 +335,7 @@ static int __init sysrq_crypto_init(void)
 	struct timeval now;
 	int ret;
 
-	sysrq_tfm = crypto_alloc_shash(sysrq_hash, 0, 0);
+	sysrq_tfm = crypto_alloc_hash(sysrq_hash, 0, CRYPTO_ALG_ASYNC);
 	if (IS_ERR(sysrq_tfm)) {
 		printk(KERN_WARNING KBUILD_MODNAME
 			": Error: Could not find or load %s hash\n",
@@ -326,7 +344,7 @@ static int __init sysrq_crypto_init(void)
 		sysrq_tfm = NULL;
 		goto fail;
 	}
-	sysrq_digest_size = crypto_shash_digestsize(sysrq_tfm);
+	sysrq_digest_size = crypto_hash_digestsize(sysrq_tfm);
 	sysrq_digest = kmalloc(sysrq_digest_size, GFP_KERNEL);
 	ret = -ENOMEM;
 	if (sysrq_digest == NULL)
@@ -346,9 +364,8 @@ static int __init sysrq_crypto_init(void)
  fail:
 	sysrq_crypto_exit();
 	return ret;
-#else
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 19)
-	printk(KERN_WARNING "Kernel was compiled without crypto, "
+	printk(KERN_WARNING "xt_SYSRQ does not provide crypto for < 2.6.19\n");
-	       "so xt_SYSRQ won't use crypto.\n");
 #endif
 	return -EINVAL;
 }
@@ -369,7 +386,7 @@ static void __exit sysrq_tg_exit(void)
 module_init(sysrq_tg_init);
 module_exit(sysrq_tg_exit);
 MODULE_DESCRIPTION("Xtables: triggering SYSRQ remotely");
-MODULE_AUTHOR("Jan Engelhardt");
+MODULE_AUTHOR("Jan Engelhardt ");
 MODULE_AUTHOR("John Haxby <john.haxby@oracle.com");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("ipt_SYSRQ");

extensions/xt_TARPIT.c

@@ -79,7 +79,7 @@ static bool xttarpit_tarpit(struct tcphdr *tcph, const struct tcphdr *oth)
 #if 0
 	/* Rate-limit replies to !SYN,ACKs */
 	if (!oth->syn && oth->ack)
-		if (!xrlim_allow(&ort->dst, HZ))
+		if (!xrlim_allow(rt_dst(ort), HZ))
 			return false;
 #endif
 
@@ -107,8 +107,8 @@ static bool xttarpit_honeypot(struct tcphdr *tcph, const struct tcphdr *oth,
 		tcph->syn     = true;
 		tcph->ack     = true;
 		tcph->window  = oth->window &
-			((prandom_u32() & 0x1f) - 0xf);
+			((net_random() & 0x1f) - 0xf);
-		tcph->seq     = htonl(prandom_u32() & ~oth->seq);
+		tcph->seq     = htonl(net_random() & ~oth->seq);
 		tcph->ack_seq = htonl(ntohl(oth->seq) + oth->syn);
 	}
 
@@ -117,7 +117,7 @@ static bool xttarpit_honeypot(struct tcphdr *tcph, const struct tcphdr *oth,
 		tcph->syn     = false;
 		tcph->ack     = true;
 		tcph->window  = oth->window &
-			((prandom_u32() & 0x1f) - 0xf);
+			((net_random() & 0x1f) - 0xf);
 		tcph->ack_seq = payload > 100 ?
 			htonl(ntohl(oth->seq) + payload) :
 			oth->seq;
@@ -170,8 +170,8 @@ static bool tarpit_generic(struct tcphdr *tcph, const struct tcphdr *oth,
 	return true;
 }
 
-static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
+static void tarpit_tcp4(struct sk_buff *oldskb, unsigned int hook,
-    unsigned int hook, unsigned int mode)
+    unsigned int mode)
 {
 	struct tcphdr _otcph, *tcph;
 	const struct tcphdr *oth;
@@ -208,9 +208,13 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 	nf_reset(nskb);
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
 	skb_shinfo(nskb)->gso_size = 0;
 	skb_shinfo(nskb)->gso_segs = 0;
 	skb_shinfo(nskb)->gso_type = 0;
+#endif
+
 	oldhdr = ip_hdr(oldskb);
 	tcph = (struct tcphdr *)(skb_network_header(nskb) + ip_hdrlen(nskb));
 
@@ -237,9 +241,15 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 
 	/* Adjust TCP checksum */
 	tcph->check = 0;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 20)
+	tcph->check = tcp_v4_check(tcph, sizeof(struct tcphdr), niph->saddr,
+	              niph->daddr, csum_partial((char *)tcph,
+	              sizeof(struct tcphdr), 0));
+#else
 	tcph->check = tcp_v4_check(sizeof(struct tcphdr), niph->saddr,
 	              niph->daddr, csum_partial((char *)tcph,
 	              sizeof(struct tcphdr), 0));
+#endif
 
 	/* Set DF, id = 0 */
 	niph->frag_off = htons(IP_DF);
@@ -250,13 +260,13 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 
 #ifdef CONFIG_BRIDGE_NETFILTER
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
-	    nskb->nf_bridge->physoutdev != NULL))
+	    nskb->nf_bridge->mask & BRNF_BRIDGED))
 #else
 	if (hook != NF_INET_FORWARD)
 #endif
 		addr_type = RTN_LOCAL;
 
-	if (ip_route_me_harder(net, nskb, addr_type))
+	if (ip_route_me_harder(&nskb, addr_type))
 		goto free_nskb;
 	else
 		niph = ip_hdr(nskb);
@@ -267,7 +277,11 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 	if (mode == XTTARPIT_HONEYPOT)
 		niph->ttl = 128;
 	else
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
 		niph->ttl = ip4_dst_hoplimit(skb_dst(nskb));
+#else
+		niph->ttl = dst_metric(skb_dst(nskb), RTAX_HOPLIMIT);
+#endif
 
 	/* Adjust IP checksum */
 	niph->check = 0;
@@ -278,7 +292,8 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 		goto free_nskb;
 
 	nf_ct_attach(nskb, oldskb);
-	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
+
+	NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, nskb, NULL,
 		skb_dst(nskb)->dev, dst_output);
 	return;
 
@@ -287,8 +302,8 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 }
 
 #ifdef WITH_IPV6
-static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
+static void tarpit_tcp6(struct sk_buff *oldskb, unsigned int hook,
-    unsigned int hook, unsigned int mode)
+    unsigned int mode)
 {
 	struct sk_buff *nskb;
 	struct tcphdr *tcph, oth;
@@ -344,9 +359,13 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 	nf_reset(nskb);
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 18)
 	skb_shinfo(nskb)->gso_size = 0;
 	skb_shinfo(nskb)->gso_segs = 0;
 	skb_shinfo(nskb)->gso_type = 0;
+#endif
+
 	skb_put(nskb, sizeof(struct ipv6hdr));
 	ip6h = ipv6_hdr(nskb);
 	*(__be32 *)ip6h =  htonl(0x60000000 | (tclass << 20));
@@ -358,7 +377,11 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 	if (mode == XTTARPIT_HONEYPOT) {
 		ip6h->hop_limit = 128;
 	} else {
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 38)
 		ip6h->hop_limit = ip6_dst_hoplimit(skb_dst(nskb));
+#else
+		ip6h->hop_limit = dst_metric(skb_dst(nskb), RTAX_HOPLIMIT);
+#endif
 	}
 
 	tcph = (struct tcphdr *)(skb_network_header(nskb) +
@@ -386,13 +409,14 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 	              IPPROTO_TCP,
 	              csum_partial(tcph, sizeof(struct tcphdr), 0));
 
-	if (ip6_route_me_harder(net, nskb))
+	if (ip6_route_me_harder(nskb))
 		goto free_nskb;
 
 	nskb->ip_summed = CHECKSUM_NONE;
 
 	nf_ct_attach(nskb, oldskb);
-	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, nskb->sk, nskb, NULL,
+
+	NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, nskb, NULL,
 	        skb_dst(nskb)->dev, dst_output);
 	return;
 
@@ -402,8 +426,9 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 #endif
 
 static unsigned int
-tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
+tarpit_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *skb = *pskb;
 	const struct iphdr *iph = ip_hdr(skb);
 	const struct rtable *rt = skb_rtable(skb);
 	const struct xt_tarpit_tginfo *info = par->targinfo;
@@ -431,14 +456,16 @@ tarpit_tg4(struct sk_buff *skb, const struct xt_action_param *par)
 	/* We are not interested in fragments */
 	if (iph->frag_off & htons(IP_OFFSET))
 		return NF_DROP;
-	tarpit_tcp4(par_net(par), skb, par->state->hook, info->variant);
+
+	tarpit_tcp4(*pskb, par->hooknum, info->variant);
 	return NF_DROP;
 }
 
 #ifdef WITH_IPV6
 static unsigned int
-tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+tarpit_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
 {
+	const struct sk_buff *skb = *pskb;
 	const struct ipv6hdr *iph = ipv6_hdr(skb);
 	const struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
 	const struct xt_tarpit_tginfo *info = par->targinfo;
@@ -472,7 +499,8 @@ tarpit_tg6(struct sk_buff *skb, const struct xt_action_param *par)
 		pr_debug("addr is not unicast.\n");
 		return NF_DROP;
 	}
-	tarpit_tcp6(par_net(par), skb, par->state->hook, info->variant);
+
+	tarpit_tcp6(*pskb, par->hooknum, info->variant);
 	return NF_DROP;
 }
 #endif

extensions/xt_TEE.c

@@ -0,0 +1,299 @@
+/*
+ *	"TEE" target extension for Xtables
+ *	Copyright © Sebastian Claßen <sebastian.classen [at] freenet de>, 2007
+ *	Jan Engelhardt <jengelh [at] medozas de>, 2007 - 2008
+ *
+ *	based on ipt_ROUTE.c from Cédric de Launois
+ *	<delaunois [at] info ucl ac be>
+ *
+ *	This program is free software; you can redistribute it and/or
+ *	modify it under the terms of the GNU General Public License
+ *	version 2, as published by the Free Software Foundation.
+ */
+#include <linux/ip.h>
+#include <linux/module.h>
+#include <linux/route.h>
+#include <linux/skbuff.h>
+#include <linux/version.h>
+#include <net/checksum.h>
+#include <net/icmp.h>
+#include <net/ip.h>
+#include <net/ip6_route.h>
+#include <net/route.h>
+#include <linux/netfilter/x_tables.h>
+
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
+#	error ----------------------------------------------------------
+#	error This module has been merged into, and is available in the
+#	error mainline since Linux kernel v2.6.35. Please use that.
+#	error ----------------------------------------------------------
+#endif
+
+#if defined(CONFIG_NF_CONNTRACK) || defined(CONFIG_NF_CONNTRACK_MODULE)
+#	define WITH_CONNTRACK 1
+#	include <net/netfilter/nf_conntrack.h>
+#endif
+#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
+#	define WITH_IPV6 1
+#endif
+
+#include "compat_xtables.h"
+#include "xt_TEE.h"
+
+static bool tee_active[NR_CPUS];
+static const union nf_inet_addr tee_zero_address;
+
+static bool
+tee_tg_route4(struct sk_buff *skb, const struct xt_tee_tginfo *info)
+{
+	const struct iphdr *iph = ip_hdr(skb);
+	struct rtable *rt;
+	struct flowi fl;
+
+	memset(&fl, 0, sizeof(fl));
+	fl.nl_u.ip4_u.daddr = info->gw.ip;
+	fl.nl_u.ip4_u.tos   = RT_TOS(iph->tos);
+	fl.nl_u.ip4_u.scope = RT_SCOPE_UNIVERSE;
+
+	if (ip_route_output_key(&init_net, &rt, &fl) != 0)
+		return false;
+
+	dst_release(skb_dst(skb));
+	skb_dst_set(skb, rt_dst(rt));
+	skb->dev      = rt_dst(rt)->dev;
+	skb->protocol = htons(ETH_P_IP);
+	return true;
+}
+
+static inline bool dev_hh_avail(const struct net_device *dev)
+{
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 23)
+	return dev->hard_header != NULL;
+#else
+	return dev->header_ops != NULL;
+#endif
+}
+
+/*
+ * Stolen from ip_finish_output2
+ * PRE : skb->dev is set to the device we are leaving by
+ *       skb->dst is not NULL
+ * POST: the packet is sent with the link layer header pushed
+ *       the packet is destroyed
+ */
+static void tee_tg_send(struct sk_buff *skb)
+{
+	const struct dst_entry *dst  = skb_dst(skb);
+	const struct net_device *dev = dst->dev;
+	unsigned int hh_len = LL_RESERVED_SPACE(dev);
+
+	/* Be paranoid, rather than too clever. */
+	if (unlikely(skb_headroom(skb) < hh_len && dev_hh_avail(dev))) {
+		struct sk_buff *skb2;
+
+		skb2 = skb_realloc_headroom(skb, LL_RESERVED_SPACE(dev));
+		if (skb2 == NULL) {
+			kfree_skb(skb);
+			return;
+		}
+		if (skb->sk != NULL)
+			skb_set_owner_w(skb2, skb->sk);
+		kfree_skb(skb);
+		skb = skb2;
+	}
+
+	if (dst->hh != NULL)
+		neigh_hh_output(dst->hh, skb);
+	else if (dst->neighbour != NULL)
+		dst->neighbour->output(skb);
+	else
+		kfree_skb(skb);
+}
+
+static unsigned int
+tee_tg4(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	const struct xt_tee_tginfo *info = par->targinfo;
+	struct sk_buff *skb = *pskb;
+	struct iphdr *iph;
+	unsigned int cpu = smp_processor_id();
+
+	if (tee_active[cpu])
+		return XT_CONTINUE;
+	/*
+	 * Copy the skb, and route the copy. Will later return %XT_CONTINUE for
+	 * the original skb, which should continue on its way as if nothing has
+	 * happened. The copy should be independently delivered to the TEE
+	 * --gateway.
+	 */
+	skb = pskb_copy(skb, GFP_ATOMIC);
+	if (skb == NULL)
+		return XT_CONTINUE;
+	/*
+	 * If we are in PREROUTING/INPUT, the checksum must be recalculated
+	 * since the length could have changed as a result of defragmentation.
+	 *
+	 * We also decrease the TTL to mitigate potential TEE loops
+	 * between two hosts.
+	 *
+	 * Set %IP_DF so that the original source is notified of a potentially
+	 * decreased MTU on the clone route. IPv6 does this too.
+	 */
+	iph = ip_hdr(skb);
+	iph->frag_off |= htons(IP_DF);
+	if (par->hooknum == NF_INET_PRE_ROUTING ||
+	    par->hooknum == NF_INET_LOCAL_IN)
+		--iph->ttl;
+	ip_send_check(iph);
+
+#ifdef WITH_CONNTRACK
+	/*
+	 * Tell conntrack to forget this packet. It may have side effects to
+	 * see the same packet twice, as for example, accounting the original
+	 * connection for the cloned packet.
+	 */
+	nf_conntrack_put(skb->nfct);
+	skb->nfct     = &nf_conntrack_untracked.ct_general;
+	skb->nfctinfo = IP_CT_NEW;
+	nf_conntrack_get(skb->nfct);
+#endif
+
+	/*
+	 * Normally, we would just use ip_local_out. Because iph->check is
+	 * already correct, we could take a shortcut and call dst_output
+	 * [forwards to ip_output] directly. ip_output however will invoke
+	 * Netfilter hooks and cause reentrancy. So we skip that too and go
+	 * directly to ip_finish_output. Since we should not do XFRM, control
+	 * passes to ip_finish_output2. That function is not exported, so it is
+	 * copied here as tee_ip_direct_send.
+	 *
+	 * We do no XFRM on the cloned packet on purpose! The choice of
+	 * iptables match options will control whether the raw packet or the
+	 * transformed version is cloned.
+	 *
+	 * Also on purpose, no fragmentation is done, to preserve the
+	 * packet as best as possible.
+	 */
+	if (tee_tg_route4(skb, info)) {
+		tee_active[cpu] = true;
+		tee_tg_send(skb);
+		tee_active[cpu] = false;
+	} else {
+		kfree_skb(skb);
+	}
+	return XT_CONTINUE;
+}
+
+#ifdef WITH_IPV6
+static bool
+tee_tg_route6(struct sk_buff *skb, const struct xt_tee_tginfo *info)
+{
+	const struct ipv6hdr *iph = ipv6_hdr(skb);
+	struct dst_entry *dst;
+	struct flowi fl;
+
+	memset(&fl, 0, sizeof(fl));
+	fl.nl_u.ip6_u.daddr = info->gw.in6;
+	fl.nl_u.ip6_u.flowlabel = ((iph->flow_lbl[0] & 0xF) << 16) |
+		(iph->flow_lbl[1] << 8) | iph->flow_lbl[2];
+
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 25)
+	dst = ip6_route_output(NULL, &fl);
+#else
+	dst = ip6_route_output(dev_net(skb->dev), NULL, &fl);
+#endif
+	if (dst == NULL)
+		return false;
+
+	dst_release(skb_dst(skb));
+	skb_dst_set(skb, dst);
+	skb->dev      = dst->dev;
+	skb->protocol = htons(ETH_P_IPV6);
+	return true;
+}
+
+static unsigned int
+tee_tg6(struct sk_buff **pskb, const struct xt_action_param *par)
+{
+	const struct xt_tee_tginfo *info = par->targinfo;
+	struct sk_buff *skb = *pskb;
+	unsigned int cpu = smp_processor_id();
+
+	if (tee_active[cpu])
+		return XT_CONTINUE;
+	skb = pskb_copy(skb, GFP_ATOMIC);
+	if (skb == NULL)
+		return XT_CONTINUE;
+
+#ifdef WITH_CONNTRACK
+	nf_conntrack_put(skb->nfct);
+	skb->nfct     = &nf_conntrack_untracked.ct_general;
+	skb->nfctinfo = IP_CT_NEW;
+	nf_conntrack_get(skb->nfct);
+#endif
+	if (par->hooknum == NF_INET_PRE_ROUTING ||
+	    par->hooknum == NF_INET_LOCAL_IN) {
+		struct ipv6hdr *iph = ipv6_hdr(skb);
+		--iph->hop_limit;
+	}
+	if (tee_tg_route6(skb, info)) {
+		tee_active[cpu] = true;
+		tee_tg_send(skb);
+		tee_active[cpu] = false;
+	} else {
+		kfree_skb(skb);
+	}
+	return XT_CONTINUE;
+}
+#endif /* WITH_IPV6 */
+
+static int tee_tg_check(const struct xt_tgchk_param *par)
+{
+	const struct xt_tee_tginfo *info = par->targinfo;
+
+	/* 0.0.0.0 and :: not allowed */
+	return (memcmp(&info->gw, &tee_zero_address,
+	       sizeof(tee_zero_address)) == 0) ? -EINVAL : 0;
+}
+
+static struct xt_target tee_tg_reg[] __read_mostly = {
+	{
+		.name       = "TEE",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.target     = tee_tg4,
+		.targetsize = sizeof(struct xt_tee_tginfo),
+		.checkentry = tee_tg_check,
+		.me         = THIS_MODULE,
+	},
+#ifdef WITH_IPV6
+	{
+		.name       = "TEE",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.target     = tee_tg6,
+		.targetsize = sizeof(struct xt_tee_tginfo),
+		.checkentry = tee_tg_check,
+		.me         = THIS_MODULE,
+	},
+#endif
+};
+
+static int __init tee_tg_init(void)
+{
+	return xt_register_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
+}
+
+static void __exit tee_tg_exit(void)
+{
+	xt_unregister_targets(tee_tg_reg, ARRAY_SIZE(tee_tg_reg));
+}
+
+module_init(tee_tg_init);
+module_exit(tee_tg_exit);
+MODULE_AUTHOR("Sebastian Claßen <sebastian.classen@freenet.ag>");
+MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
+MODULE_DESCRIPTION("Xtables: Reroute packet copy");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_TEE");
+MODULE_ALIAS("ip6t_TEE");

extensions/xt_TEE.h

@@ -0,0 +1,8 @@
+#ifndef _XT_TEE_TARGET_H
+#define _XT_TEE_TARGET_H
+
+struct xt_tee_tginfo {
+	union nf_inet_addr gw;
+};
+
+#endif /* _XT_TEE_TARGET_H */

extensions/xt_condition.c

@@ -7,7 +7,6 @@
  *	Authors:
  *	Stephane Ouellette <ouellettes [at] videotron ca>, 2002-10-22
  *	Massimiliano Hofer <max [at] nucleus it>, 2006-05-15
- *	Grzegorz Kuczyński <grzegorz.kuczynski [at] koba pl>, 2017-02-27
  *
  *	This program is free software; you can redistribute it and/or modify it
  *	under the terms of the GNU General Public License; either version 2
@@ -22,8 +21,6 @@
 #include <linux/version.h>
 #include <linux/netfilter/x_tables.h>
 #include <asm/uaccess.h>
-#include <net/net_namespace.h>
-#include <net/netns/generic.h>
 #include "xt_condition.h"
 #include "compat_xtables.h"
 
@@ -55,44 +52,31 @@ struct condition_variable {
 	struct proc_dir_entry *status_proc;
 	unsigned int refcount;
 	bool enabled;
-	char name[sizeof(((struct xt_condition_mtinfo *)NULL)->name)];
 };
 
 /* proc_lock is a user context only semaphore used for write access */
 /*           to the conditions' list.                               */
 static DEFINE_MUTEX(proc_lock);
 
-struct condition_net {
+static LIST_HEAD(conditions_list);
-	struct list_head conditions_list;
+static struct proc_dir_entry *proc_net_condition;
-	struct proc_dir_entry *proc_net_condition;
-	bool after_clear;
-};
 
-static int condition_net_id;
+static int condition_proc_read(char __user *buffer, char **start, off_t offset,
-
+                               int length, int *eof, void *data)
-static inline struct condition_net *condition_pernet(struct net *net)
 {
-	return net_generic(net, condition_net_id);
+	const struct condition_variable *var = data;
+
+	buffer[0] = var->enabled ? '1' : '0';
+	buffer[1] = '\n';
+	if (length >= 2)
+		*eof = true;
+	return 2;
 }
 
-static int condition_proc_show(struct seq_file *m, void *data)
+static int condition_proc_write(struct file *file, const char __user *buffer,
+                                unsigned long length, void *data)
 {
-	const struct condition_variable *var = m->private;
+	struct condition_variable *var = data;
-
-	seq_printf(m, var->enabled ? "1\n" : "0\n");
-	return 0;
-}
-
-static int condition_proc_open(struct inode *inode, struct file *file)
-{
-	return single_open(file, condition_proc_show, PDE_DATA(inode));
-}
-
-static ssize_t
-condition_proc_write(struct file *file, const char __user *buffer,
-                     size_t length, loff_t *loff)
-{
-	struct condition_variable *var = PDE_DATA(file_inode(file));
 	char newval;
 
 	if (length > 0) {
@@ -111,14 +95,6 @@ condition_proc_write(struct file *file, const char __user *buffer,
 	return length;
 }
 
-static const struct file_operations condition_proc_fops = {
-	.open    = condition_proc_open,
-	.read    = seq_read,
-	.llseek  = seq_lseek,
-	.write   = condition_proc_write,
-	.release = single_release,
-};
-
 static bool
 condition_mt(const struct sk_buff *skb, struct xt_action_param *par)
 {
@@ -132,7 +108,6 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 {
 	struct xt_condition_mtinfo *info = par->matchinfo;
 	struct condition_variable *var;
-	struct condition_net *condition_net = condition_pernet(par->net);
 
 	/* Forbid certain names */
 	if (*info->name == '\0' || *info->name == '.' ||
@@ -148,8 +123,8 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 	 * or increase the reference counter.
 	 */
 	mutex_lock(&proc_lock);
-	list_for_each_entry(var, &condition_net->conditions_list, list) {
+	list_for_each_entry(var, &conditions_list, list) {
-		if (strcmp(info->name, var->name) == 0) {
+		if (strcmp(info->name, var->status_proc->name) == 0) {
 			var->refcount++;
 			mutex_unlock(&proc_lock);
 			info->condvar = var;
@@ -164,23 +139,27 @@ static int condition_mt_check(const struct xt_mtchk_param *par)
 		return -ENOMEM;
 	}
 
-	memcpy(var->name, info->name, sizeof(info->name));
 	/* Create the condition variable's proc file entry. */
-	var->status_proc = proc_create_data(info->name, condition_list_perms,
+	var->status_proc = create_proc_entry(info->name, condition_list_perms,
-	                   condition_net->proc_net_condition, &condition_proc_fops, var);
+	                   proc_net_condition);
 	if (var->status_proc == NULL) {
 		kfree(var);
 		mutex_unlock(&proc_lock);
 		return -ENOMEM;
 	}
 
-	proc_set_user(var->status_proc,
-	              make_kuid(&init_user_ns, condition_uid_perms),
-	              make_kgid(&init_user_ns, condition_gid_perms));
 	var->refcount = 1;
 	var->enabled  = false;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)
+	var->status_proc->owner = THIS_MODULE;
+#endif
+	var->status_proc->data  = var;
 	wmb();
-	list_add(&var->list, &condition_net->conditions_list);
+	var->status_proc->read_proc  = condition_proc_read;
+	var->status_proc->write_proc = condition_proc_write;
+	list_add(&var->list, &conditions_list);
+	var->status_proc->uid = condition_uid_perms;
+	var->status_proc->gid = condition_gid_perms;
 	mutex_unlock(&proc_lock);
 	info->condvar = var;
 	return 0;
@@ -190,15 +169,11 @@ static void condition_mt_destroy(const struct xt_mtdtor_param *par)
 {
 	const struct xt_condition_mtinfo *info = par->matchinfo;
 	struct condition_variable *var = info->condvar;
-	struct condition_net *cnet = condition_pernet(par->net);
-
-	if (cnet->after_clear)
-		return;
 
 	mutex_lock(&proc_lock);
 	if (--var->refcount == 0) {
 		list_del(&var->list);
-		remove_proc_entry(var->name, cnet->proc_net_condition);
+		remove_proc_entry(var->status_proc->name, proc_net_condition);
 		mutex_unlock(&proc_lock);
 		kfree(var);
 		return;
@@ -231,54 +206,18 @@ static struct xt_match condition_mt_reg[] __read_mostly = {
 
 static const char *const dir_name = "nf_condition";
 
-static int __net_init condition_net_init(struct net *net)
-{
-	struct condition_net *condition_net = condition_pernet(net);
-	INIT_LIST_HEAD(&condition_net->conditions_list);
-	condition_net->proc_net_condition = proc_mkdir(dir_name, net->proc_net);
-	if (condition_net->proc_net_condition == NULL)
-		return -EACCES;
-	condition_net->after_clear = 0;
-	return 0;
-}
-
-static void __net_exit condition_net_exit(struct net *net)
-{
-	struct condition_net *condition_net = condition_pernet(net);
-	struct list_head *pos, *q;
-	struct condition_variable *var = NULL;
-
-	remove_proc_subtree(dir_name, net->proc_net);
-	mutex_lock(&proc_lock);
-	list_for_each_safe(pos, q, &condition_net->conditions_list) {
-		var = list_entry(pos, struct condition_variable, list);
-		list_del(pos);
-		kfree(var);
-	}
-	mutex_unlock(&proc_lock);
-	condition_net->after_clear = true;
-}
-
-static struct pernet_operations condition_net_ops = {
-	.init   = condition_net_init,
-	.exit   = condition_net_exit,
-	.id     = &condition_net_id,
-	.size   = sizeof(struct condition_net),
-};
-
-
 static int __init condition_mt_init(void)
 {
 	int ret;
 
 	mutex_init(&proc_lock);
-	ret = register_pernet_subsys(&condition_net_ops);
+	proc_net_condition = proc_mkdir(dir_name, init_net__proc_net);
-	if (ret != 0)
+	if (proc_net_condition == NULL)
-		return ret;
+		return -EACCES;
 
 	ret = xt_register_matches(condition_mt_reg, ARRAY_SIZE(condition_mt_reg));
 	if (ret < 0) {
-		unregister_pernet_subsys(&condition_net_ops);
+		remove_proc_entry(dir_name, init_net__proc_net);
 		return ret;
 	}
 
@@ -288,7 +227,7 @@ static int __init condition_mt_init(void)
 static void __exit condition_mt_exit(void)
 {
 	xt_unregister_matches(condition_mt_reg, ARRAY_SIZE(condition_mt_reg));
-	unregister_pernet_subsys(&condition_net_ops);
+	remove_proc_entry(dir_name, init_net__proc_net);
 }
 
 module_init(condition_mt_init);

extensions/xt_geoip.c

@@ -75,8 +75,7 @@ geoip_add_node(const struct geoip_country_user __user *umem_ptr,
 
 	if (copy_from_user(&umem, umem_ptr, sizeof(umem)) != 0)
 		return ERR_PTR(-EFAULT);
-	if (umem.count > SIZE_MAX / geoproto_size[proto])
+
-		return ERR_PTR(-E2BIG);
 	p = kmalloc(sizeof(struct geoip_country_kernel), GFP_KERNEL);
 	if (p == NULL)
 		return ERR_PTR(-ENOMEM);
@@ -84,18 +83,10 @@ geoip_add_node(const struct geoip_country_user __user *umem_ptr,
 	p->count   = umem.count;
 	p->cc      = umem.cc;
 	size = p->count * geoproto_size[proto];
-	if (size == 0) {
+	subnet = vmalloc(size);
-		/*
+	if (subnet == NULL) {
-		 * Believe it or not, vmalloc prints a warning to dmesg for
+		ret = -ENOMEM;
-		 * zero-sized allocations :-/
+		goto free_p;
-		 */
-		subnet = NULL;
-	} else {
-		subnet = vmalloc(size);
-		if (subnet == NULL) {
-			ret = -ENOMEM;
-			goto free_p;
-		}
 	}
 	if (copy_from_user(subnet,
 	    (const void __user *)(unsigned long)umem.subnets, size) != 0) {

extensions/xt_iface.c

@@ -45,10 +45,14 @@ static const struct net_device *iface_get(const struct xt_iface_mtinfo *info,
     const struct xt_action_param *par, struct net_device **put)
 {
 	if (info->flags & XT_IFACE_DEV_IN)
-		return par->state->in;
+		return par->in;
 	else if (info->flags & XT_IFACE_DEV_OUT)
-		return par->state->out;
+		return par->out;
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 24)
 	return *put = dev_get_by_name(&init_net, info->ifname);
+#else
+	return *put = dev_get_by_name(info->ifname);
+#endif
 }
 
 static bool iface_flagtest(unsigned int devflags, unsigned int flags,

extensions/xt_ipp2p.c

@@ -511,7 +511,7 @@ search_bittorrent(const unsigned char *payload, const unsigned int plen)
 		 * but *must have* one (or more) of strings listed below (true for scrape and announce)
 		 */
 		if (memcmp(payload, "GET /", 5) == 0) {
-			if (HX_memmem(payload, plen, "info_hash=", 10) != NULL)
+			if (HX_memmem(payload, plen, "info_hash=", 9) != NULL)
 				return IPP2P_BIT * 100 + 1;
 			if (HX_memmem(payload, plen, "peer_id=", 8) != NULL)
 				return IPP2P_BIT * 100 + 2;

extensions/xt_lscan.c

@@ -204,7 +204,7 @@ lscan_mt(const struct sk_buff *skb, struct xt_action_param *par)
 		unsigned int n;
 
 		n = lscan_mt_full(ctdata->mark & connmark_mask, ctstate,
-		    par->state->in == init_net.loopback_dev, tcph,
+		    par->in == init_net__loopback_dev, tcph,
 		    skb->len - par->thoff - 4 * tcph->doff);
 
 		ctdata->mark = (ctdata->mark & ~connmark_mask) | n;

extensions/xt_psd.c

@@ -45,12 +45,12 @@ MODULE_ALIAS("ip6t_psd");
 
 /*
  * Keep track of up to LIST_SIZE source addresses, using a hash table of
- * PSD_HASH_SIZE entries for faster lookups, but limiting hash collisions to
+ * HASH_SIZE entries for faster lookups, but limiting hash collisions to
  * HASH_MAX source addresses per the same hash value.
  */
 #define LIST_SIZE			0x100
 #define HASH_LOG			9
-#define PSD_HASH_SIZE			(1 << HASH_LOG)
+#define HASH_SIZE			(1 << HASH_LOG)
 #define HASH_MAX			0x10
 
 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
@@ -108,7 +108,7 @@ struct host6 {
 static struct {
 	spinlock_t lock;
 	struct host4 list[LIST_SIZE];
-	struct host *hash[PSD_HASH_SIZE];
+	struct host *hash[HASH_SIZE];
 	int index;
 } state;
 
@@ -143,12 +143,13 @@ static bool state6_alloc_mem(void)
 	if (state6.list == NULL)
 		return false;
 	memset(state6.list, 0, LIST_SIZE * sizeof(struct host6));
-	state6.hash = vmalloc(PSD_HASH_SIZE * sizeof(struct host *));
+
+	state6.hash = vmalloc(HASH_SIZE * sizeof(struct host*));
 	if (state6.hash == NULL) {
 		vfree(state6.list);
 		return false;
 	}
-	memset(state6.hash, 0, PSD_HASH_SIZE * sizeof(struct host *));
+	memset(state6.hash, 0, HASH_SIZE * sizeof(struct host *));
 	return true;
 }
 #endif
@@ -166,7 +167,8 @@ static unsigned int hashfunc(__be32 addr)
 	do {
 		hash ^= value;
 	} while ((value >>= HASH_LOG) != 0);
-	return hash & (PSD_HASH_SIZE - 1);
+
+	return hash & (HASH_SIZE - 1);
 }
 
 static inline unsigned int hashfunc6(const struct in6_addr *addr)

extensions/xt_quota2.c

@@ -13,17 +13,11 @@
  */
 #include <linux/list.h>
 #include <linux/module.h>
-#include <linux/nsproxy.h>
 #include <linux/proc_fs.h>
-#include <linux/seq_file.h>
 #include <linux/skbuff.h>
 #include <linux/spinlock.h>
-#include <linux/uidgid.h>
 #include <linux/version.h>
 #include <asm/atomic.h>
-#include <net/net_namespace.h>
-#include <net/netns/generic.h>
-#include <net/dst.h>
 
 #include <linux/netfilter/x_tables.h>
 #include "xt_quota2.h"
@@ -41,19 +35,10 @@ struct xt_quota_counter {
 	struct proc_dir_entry *procfs_entry;
 };
 
-struct quota2_net {
+static LIST_HEAD(counter_list);
-	struct list_head counter_list;
-	struct proc_dir_entry *proc_xt_quota;
-};
-
-static int quota2_net_id;
-static inline struct quota2_net *quota2_pernet(struct net *net)
-{
-	return net_generic(net, quota2_net_id);
-}
-
 static DEFINE_SPINLOCK(counter_list_lock);
 
+static struct proc_dir_entry *proc_xt_quota;
 static unsigned int quota_list_perms = S_IRUGO | S_IWUSR;
 static unsigned int quota_list_uid   = 0;
 static unsigned int quota_list_gid   = 0;
@@ -61,27 +46,23 @@ module_param_named(perms, quota_list_perms, uint, S_IRUGO | S_IWUSR);
 module_param_named(uid, quota_list_uid, uint, S_IRUGO | S_IWUSR);
 module_param_named(gid, quota_list_gid, uint, S_IRUGO | S_IWUSR);
 
-static int quota_proc_show(struct seq_file *m, void *data)
+static int quota_proc_read(char *page, char **start, off_t offset,
+                           int count, int *eof, void *data)
 {
-	struct xt_quota_counter *e = m->private;
+	struct xt_quota_counter *e = data;
+	int ret;
 
 	spin_lock_bh(&e->lock);
-	seq_printf(m, "%llu\n", e->quota);
+	ret = snprintf(page, PAGE_SIZE, "%llu\n", e->quota);
 	spin_unlock_bh(&e->lock);
-	return 0;
+	return ret;
 }
 
-static int quota_proc_open(struct inode *inode, struct file *file)
+static int quota_proc_write(struct file *file, const char __user *input,
+                            unsigned long size, void *data)
 {
-	return single_open(file, quota_proc_show, PDE_DATA(inode));
+	struct xt_quota_counter *e = data;
-}
+	char buf[sizeof("18446744073709551616")];
-
-static ssize_t
-quota_proc_write(struct file *file, const char __user *input,
-                 size_t size, loff_t *loff)
-{
-	struct xt_quota_counter *e = PDE_DATA(file_inode(file));
-	char buf[sizeof("+-18446744073709551616")];
 
 	if (size > sizeof(buf))
 		size = sizeof(buf);
@@ -91,40 +72,12 @@ quota_proc_write(struct file *file, const char __user *input,
 	if (size < sizeof(buf))
 		buf[size] = '\0';
 
-	if (*buf == '+') {
+	spin_lock_bh(&e->lock);
-		int64_t temp = simple_strtoll(buf + 1, NULL, 0);
+	e->quota = simple_strtoull(buf, NULL, 0);
-		spin_lock_bh(&e->lock);
+	spin_unlock_bh(&e->lock);
-		/* Do not let quota become negative if @tmp is very negative */
-		if (temp > 0 || -temp < e->quota)
-			e->quota += temp;
-		else
-			e->quota = 0;
-		spin_unlock_bh(&e->lock);
-	} else if (*buf == '-') {
-		int64_t temp = simple_strtoll(buf + 1, NULL, 0);
-		spin_lock_bh(&e->lock);
-		/* Do not let quota become negative if @tmp is very big */
-		if (temp < 0 || temp < e->quota)
-			e->quota -= temp;
-		else
-			e->quota = 0;
-		spin_unlock_bh(&e->lock);
-	} else {
-		spin_lock_bh(&e->lock);
-		e->quota = simple_strtoull(buf, NULL, 0);
-		spin_unlock_bh(&e->lock);
-	}
 	return size;
 }
 
-static const struct file_operations quota_proc_fops = {
-	.open    = quota_proc_open,
-	.read    = seq_read,
-	.llseek  = seq_lseek,
-	.write   = quota_proc_write,
-	.release = single_release,
-};
-
 static struct xt_quota_counter *
 q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
 {
@@ -152,17 +105,16 @@ q2_new_counter(const struct xt_quota_mtinfo2 *q, bool anon)
  * @name:	name of counter
  */
 static struct xt_quota_counter *
-q2_get_counter(struct net *net, const struct xt_quota_mtinfo2 *q)
+q2_get_counter(const struct xt_quota_mtinfo2 *q)
 {
 	struct proc_dir_entry *p;
 	struct xt_quota_counter *e;
-	struct quota2_net *quota2_net = quota2_pernet(net);
 
 	if (*q->name == '\0')
 		return q2_new_counter(q, true);
 
 	spin_lock_bh(&counter_list_lock);
-	list_for_each_entry(e, &quota2_net->counter_list, list)
+	list_for_each_entry(e, &counter_list, list)
 		if (strcmp(e->name, q->name) == 0) {
 			atomic_inc(&e->ref);
 			spin_unlock_bh(&counter_list_lock);
@@ -173,16 +125,20 @@ q2_get_counter(struct net *net, const struct xt_quota_mtinfo2 *q)
 	if (e == NULL)
 		goto out;
 
-	p = proc_create_data(e->name, quota_list_perms,
+	p = e->procfs_entry = create_proc_entry(e->name, quota_list_perms,
-	                     quota2_net->proc_xt_quota,
+	                      proc_xt_quota);
-	                     &quota_proc_fops, e);
 	if (p == NULL || IS_ERR(p))
 		goto out;
 
-	e->procfs_entry = p;
+#if LINUX_VERSION_CODE <= KERNEL_VERSION(2, 6, 29)
-	proc_set_user(p, make_kuid(&init_user_ns, quota_list_uid),
+	p->owner        = THIS_MODULE;
-	              make_kgid(&init_user_ns, quota_list_gid));
+#endif
-	list_add_tail(&e->list, &quota2_net->counter_list);
+	p->data         = e;
+	p->read_proc    = quota_proc_read;
+	p->write_proc   = quota_proc_write;
+	p->uid          = quota_list_uid;
+	p->gid          = quota_list_gid;
+	list_add_tail(&e->list, &counter_list);
 	spin_unlock_bh(&counter_list_lock);
 	return e;
 
@@ -205,7 +161,7 @@ static int quota_mt2_check(const struct xt_mtchk_param *par)
 		return -EINVAL;
 	}
 
-	q->master = q2_get_counter(par->net, q);
+	q->master = q2_get_counter(q);
 	if (q->master == NULL) {
 		printk(KERN_ERR "xt_quota.3: memory alloc failure\n");
 		return -ENOMEM;
@@ -218,7 +174,6 @@ static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
 {
 	struct xt_quota_mtinfo2 *q = par->matchinfo;
 	struct xt_quota_counter *e = q->master;
-	struct quota2_net *quota2_net = quota2_pernet(par->net);
 
 	if (*q->name == '\0') {
 		kfree(e);
@@ -232,7 +187,7 @@ static void quota_mt2_destroy(const struct xt_mtdtor_param *par)
 	}
 
 	list_del(&e->list);
-	remove_proc_entry(e->name, quota2_net->proc_xt_quota);
+	remove_proc_entry(e->name, proc_xt_quota);
 	spin_unlock_bh(&counter_list_lock);
 	kfree(e);
 }
@@ -294,60 +249,24 @@ static struct xt_match quota_mt2_reg[] __read_mostly = {
 	},
 };
 
-static int __net_init quota2_net_init(struct net *net)
-{
-	struct quota2_net *quota2_net = quota2_pernet(net);
-	INIT_LIST_HEAD(&quota2_net->counter_list);
-
-	quota2_net->proc_xt_quota = proc_mkdir("xt_quota", net->proc_net);
-	if (quota2_net->proc_xt_quota == NULL)
-		return -EACCES;
-	return 0;
-}
-
-static void __net_exit quota2_net_exit(struct net *net)
-{
-	struct quota2_net *quota2_net = quota2_pernet(net);
-	struct xt_quota_counter *e = NULL;
-	struct list_head *pos, *q;
-
-	remove_proc_entry("xt_quota", net->proc_net);
-
-	/* destroy counter_list while freeing it's content */
-	spin_lock_bh(&counter_list_lock);
-	list_for_each_safe(pos, q, &quota2_net->counter_list) {
-		e = list_entry(pos, struct xt_quota_counter, list);
-		list_del(pos);
-		kfree(e);
-	}
-	spin_unlock_bh(&counter_list_lock);
-}
-
-static struct pernet_operations quota2_net_ops = {
-	.init   = quota2_net_init,
-	.exit   = quota2_net_exit,
-	.id     = &quota2_net_id,
-	.size   = sizeof(struct quota2_net),
-};
-
 static int __init quota_mt2_init(void)
 {
 	int ret;
-	ret = register_pernet_subsys(&quota2_net_ops);
+
-	if (ret < 0)
+	proc_xt_quota = proc_mkdir("xt_quota", init_net__proc_net);
-		return ret;
+	if (proc_xt_quota == NULL)
+		return -EACCES;
 
 	ret = xt_register_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
 	if (ret < 0)
-		unregister_pernet_subsys(&quota2_net_ops);
+		remove_proc_entry("xt_quota", init_net__proc_net);
-
 	return ret;
 }
 
 static void __exit quota_mt2_exit(void)
 {
 	xt_unregister_matches(quota_mt2_reg, ARRAY_SIZE(quota_mt2_reg));
-	unregister_pernet_subsys(&quota2_net_ops);
+	remove_proc_entry("xt_quota", init_net__proc_net);
 }
 
 module_init(quota_mt2_init);

geoip/xt_geoip_build

@@ -1,13 +1,10 @@
 #!/usr/bin/perl
 #
-#	Converter for MaxMind (GeoLite2) CSV database to binary, for xt_geoip
+#	Converter for MaxMind CSV database to binary, for xt_geoip
-#	Copyright Jan Engelhardt, 2008-2011
+#	Copyright © Jan Engelhardt, 2008-2011
-#	Copyright Philip Prindeville, 2018
 #
 use Getopt::Long;
-use Net::CIDR::Lite;
+use IO::Handle;
-use Socket qw(AF_INET AF_INET6 inet_pton);
-use warnings;
 use Text::CSV_XS; # or trade for Text::CSV
 use strict;
 
@@ -16,201 +13,52 @@ my $csv = Text::CSV_XS->new({
 	binary => 1,
 	eol => $/,
 }); # or Text::CSV
-my $source_dir = ".";
 my $target_dir = ".";
 
 &Getopt::Long::Configure(qw(bundling));
 &GetOptions(
 	"D=s" => \$target_dir,
-	"S=s" => \$source_dir,
 );
 
-if (!-d $source_dir) {
-	print STDERR "Source directory \"$source_dir\" does not exist.\n";
-	exit 1;
-}
 if (!-d $target_dir) {
-	print STDERR "Target directory \"$target_dir\" does not exist.\n";
+	print STDERR "Target directory $target_dir does not exist.\n";
 	exit 1;
 }
+foreach (qw(LE BE)) {
+	my $dir = "$target_dir/$_";
+	if (!-e $dir && !mkdir($dir)) {
+		print STDERR "Could not mkdir $dir: $!\n";
+		exit 1;
+	}
+}
 
-my %countryId;
-my %countryName;
-&loadCountries();
 &dump(&collect());
 
-sub loadCountries
-{
-	sub id; sub cc; sub long; sub ct; sub cn;
-
-	%countryId = ();
-	%countryName = ();
-
-	my $file = "$source_dir/GeoLite2-Country-Locations-en.csv";
-	open(my $fh, '<', $file) || die "Couldn't open list country names\n";
-
-	# first line is headers
-	my $row = $csv->getline($fh);
-
-	my %header = map { ($row->[$_], $_); } (0..$#{$row});
-
-	my %pairs = (
-		country_iso_code => 'ISO Country Code',
-		geoname_id => 'ID',
-		country_name => 'Country Name',
-		continent_code => 'Continent Code',
-		continent_name => 'Continent Name',
-	);
-
-	# verify that the columns we need are present
-	map { die "Table has no $pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
-
-	my %remapping = (
-		id => 'geoname_id',
-		cc => 'country_iso_code',
-		long => 'country_name',
-		ct => 'continent_code',
-		cn => 'continent_name',
-	);
-
-	# now create a function which returns the value of that column #
-	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
-
-	while (my $row = $csv->getline($fh)) {
-		if ($row->[cc] eq '' && $row->[long] eq '') {
-			$countryId{$row->[id]} = $row->[ct];
-			$countryName{$row->[ct]} = $row->[cn];
-		} else {
-			$countryId{$row->[id]} = $row->[cc];
-			$countryName{$row->[cc]} = $row->[long];
-		}
-	}
-
-	$countryName{A1} = 'Anonymous Proxy';
-	$countryName{A2} = 'Satellite Provider';
-	$countryName{O1} = 'Other Country';
-
-	close($fh);
-
-	# clean up the namespace
-	undef &id; undef &cc; undef &long; undef &ct; undef &cn;
-}
-
-sub lookupCountry
-{
-	my ($id, $rid, $proxy, $sat) = @_;
-
-	if ($proxy) {
-		return 'A1';
-	} elsif ($sat) {
-		return 'A2';
-	}
-	$id ||= $rid;
-	if ($id eq '') {
-		return 'O1';
-	}
-	die "Unknown id: $id line $.\n" unless (exists $countryId{$id});
-	return $countryId{$id};
-}
-
 sub collect
 {
-	my ($file, $fh, $row);
+	my %country;
-	my (%country, %header);
-
-	sub net; sub id; sub rid; sub proxy; sub sat;
-
-	my %pairs = (
-		network => 'Network',
-		registered_country_geoname_id => 'Registered Country ID',
-		geoname_id => 'Country ID',
-		is_anonymous_proxy => 'Anonymous Proxy',
-		is_satellite_provider => 'Satellite',
-	);
-
-	foreach (sort keys %countryName) {
-		$country{$_} = {
-			name => $countryName{$_},
-			pool_v4 => Net::CIDR::Lite->new(),
-			pool_v6 => Net::CIDR::Lite->new(),
-		};
-	}
-
-	$file = "$source_dir/GeoLite2-Country-Blocks-IPv4.csv";
-	open($fh, '<', $file) || die "Can't open IPv4 database\n";
-
-	# first line is headers
-	$row = $csv->getline($fh);
-
-	%header = map { ($row->[$_], $_); } (0..$#{$row});
-
-	# verify that the columns we need are present
-	map { die "Table has no %pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
-
-	my %remapping = (
-		net => 'network',
-		id => 'geoname_id',
-		rid => 'registered_country_geoname_id',
-		proxy => 'is_anonymous_proxy',
-		sat => 'is_satellite_provider',
-	);
-
-	# now create a function which returns the value of that column #
-	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
-
-	while ($row = $csv->getline($fh)) {
-		my ($cc, $cidr);
-
-		$cc = lookupCountry($row->[id], $row->[rid], $row->[proxy], $row->[sat]);
-		$cidr = $row->[net];
-		$country{$cc}->{pool_v4}->add($cidr);
 
+	while (my $row = $csv->getline(*ARGV)) {
+		if (!defined($country{$row->[4]})) {
+			$country{$row->[4]} = {
+				name => $row->[5],
+				pool_v4 => [],
+				pool_v6 => [],
+			};
+		}
+		my $c = $country{$row->[4]};
+		if ($row->[0] =~ /:/) {
+			push(@{$c->{pool_v6}},
+			     [&ip6_pack($row->[0]), &ip6_pack($row->[1])]);
+		} else {
+			push(@{$c->{pool_v4}}, [$row->[2], $row->[3]]);
+		}
 		if ($. % 4096 == 0) {
 			print STDERR "\r\e[2K$. entries";
 		}
 	}
 
 	print STDERR "\r\e[2K$. entries total\n";
-
-	close($fh);
-
-	# clean up the namespace
-	undef &net; undef &id; undef &rid; undef &proxy; undef &sat;
-
-	$file = "$source_dir/GeoLite2-Country-Blocks-IPv6.csv";
-	open($fh, '<', $file) || die "Can't open IPv6 database\n";
-
-	# first line is headers
-	$row = $csv->getline($fh);
-
-	%header = map { ($row->[$_], $_); } (0..$#{$row});
-
-	# verify that the columns we need are present
-	map { die "Table has no %pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
-
-	# unlikely the IPv6 table has different columns, but just to be sure
-	# create a function which returns the value of that column #
-	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
-
-	while ($row = $csv->getline($fh)) {
-		my ($cc, $cidr);
-
-		$cc = lookupCountry($row->[id], $row->[rid], $row->[proxy], $row->[sat]);
-		$cidr = $row->[net];
-		$country{$cc}->{pool_v6}->add($cidr);
-
-		if ($. % 4096 == 0) {
-			print STDERR "\r\e[2K$. entries";
-		}
-	}
-
-	print STDERR "\r\e[2K$. entries total\n";
-
-	close($fh);
-
-	# clean up the namespace
-	undef &net; undef &id; undef &rid; undef &proxy; undef &sat;
-
 	return \%country;
 }
 
@@ -218,7 +66,7 @@ sub dump
 {
 	my $country = shift @_;
 
-	foreach my $iso_code (sort keys %{$country}) {
+	foreach my $iso_code (sort keys %$country) {
 		&dump_one($iso_code, $country->{$iso_code});
 	}
 }
@@ -226,40 +74,68 @@ sub dump
 sub dump_one
 {
 	my($iso_code, $country) = @_;
-	my @ranges;
+	my($file, $fh_le, $fh_be);
 
-	@ranges = $country->{pool_v4}->list_range();
+	printf "%5u IPv6 ranges for %s %s\n",
+		scalar(@{$country->{pool_v6}}),
+		$iso_code, $country->{name};
 
-	writeCountry($iso_code, $country->{name}, AF_INET, @ranges);
+	$file = "$target_dir/LE/".uc($iso_code).".iv6";
-
+	if (!open($fh_le, "> $file")) {
-	@ranges = $country->{pool_v6}->list_range();
-
-	writeCountry($iso_code, $country->{name}, AF_INET6, @ranges);
-}
-
-sub writeCountry
-{
-	my ($iso_code, $name, $family, @ranges) = @_;
-	my $fh;
-
-	printf "%5u IPv%s ranges for %s %s\n",
-		scalar(@ranges),
-		($family == AF_INET ? '4' : '6'),
-		$iso_code, $name;
-
-	my $file = "$target_dir/".uc($iso_code).".iv".($family == AF_INET ? '4' : '6');
-	if (!open($fh, '>', $file)) {
 		print STDERR "Error opening $file: $!\n";
 		exit 1;
 	}
-
+	$file = "$target_dir/BE/".uc($iso_code).".iv6";
-	binmode($fh);
+	if (!open($fh_be, "> $file")) {
-
+		print STDERR "Error opening $file: $!\n";
-	foreach my $range (@ranges) {
+		exit 1;
-		my ($start, $end) = split('-', $range);
-		$start = inet_pton($family, $start);
-		$end = inet_pton($family, $end);
-		print $fh $start, $end;
 	}
-	close $fh;
+	foreach my $range (@{$country->{pool_v6}}) {
+		print $fh_be $range->[0], $range->[1];
+		print $fh_le &ip6_swap($range->[0]), &ip6_swap($range->[1]);
+	}
+	close $fh_le;
+	close $fh_be;
+
+	printf "%5u IPv4 ranges for %s %s\n",
+		scalar(@{$country->{pool_v4}}),
+		$iso_code, $country->{name};
+
+	$file = "$target_dir/LE/".uc($iso_code).".iv4";
+	if (!open($fh_le, "> $file")) {
+		print STDERR "Error opening $file: $!\n";
+		exit 1;
+	}
+	$file = "$target_dir/BE/".uc($iso_code).".iv4";
+	if (!open($fh_be, "> $file")) {
+		print STDERR "Error opening $file: $!\n";
+		exit 1;
+	}
+	foreach my $range (@{$country->{pool_v4}}) {
+		print $fh_le pack("VV", $range->[0], $range->[1]);
+		print $fh_be pack("NN", $range->[0], $range->[1]);
+	}
+	close $fh_le;
+	close $fh_be;
+}
+
+sub ip6_pack
+{
+	my $addr = shift @_;
+	$addr =~ s{::}{:!:};
+	my @addr = split(/:/, $addr);
+	my @e = (0) x 8;
+	foreach (@addr) {
+		if ($_ eq "!") {
+			$_ = join(':', @e[0..(8-scalar(@addr))]);
+		}
+	}
+	@addr = split(/:/, join(':', @addr));
+	$_ = hex($_) foreach @addr;
+	return pack("n*", @addr);
+}
+
+sub ip6_swap
+{
+	return pack("V*", unpack("N*", shift @_));
 }

geoip/xt_geoip_build.1

@@ -5,7 +5,7 @@ xt_geoip_build \(em convert GeoIP.csv to packed format for xt_geoip
 .SH Syntax
 .PP
 \fI/usr/libexec/xt_geoip/\fP\fBxt_geoip_build\fP [\fB\-D\fP
-\fItarget_dir\fP] [\fB\-S\fP \fIsource_dir\fP]
+\fItarget_dir\fP] [\fIfile\fP...]
 .SH Description
 .PP
 xt_geoip_build is used to build packed raw representations of the range
@@ -16,24 +16,20 @@ required to be loaded into memory. The ranges in the packed database files are
 also ordered, as xt_geoip relies on this property for its bisection approach to
 work.
 .PP
+Input is processed from the listed files, or if none is given, from stdin.
+.PP
 Since the script is usually installed to the libexec directory of the
 xtables-addons package and this is outside $PATH (on purpose), invoking the
 script requires it to be called with a path.
 .PP Options
 .TP
 \fB\-D\fP \fItarget_dir\fP
-Specifies the target directory into which the files are to be put. Defaults to ".".
+Specify a target directory into which the files are to be put.
-.TP
-\fB\-S\fP \fIsource_dir\fP
-Specifies the source directory from which to read the three files by the name
-of \fBGeoLite2\-Country\-Blocks\-IPv4.csv\fP,
-\fBGeoLite2\-Country\-Blocks\-IPv6.csv\fP and
-\fBGeoLite2\-Country\-Locations\-en.csv\fP. Defaults to ".".
 .SH Application
 .PP
 Shell commands to build the databases and put them to where they are expected:
 .PP
-xt_geoip_build \-D /usr/share/xt_geoip
+xt_geoip_build -D /usr/share/xt_geoip
 .SH See also
 .PP
 xt_geoip_dl(1)

geoip/xt_geoip_dl

@@ -1,7 +1,8 @@
 #!/bin/sh
 
-rm -rf GeoLite2-Country-CSV_*
+rm -f GeoIPv6.csv{,.gz} GeoIPCountryCSV.zip GeoIPCountryWhois.csv;
-
+wget \
-wget -q http://geolite.maxmind.com/download/geoip/database/GeoLite2-Country-CSV.zip
+	http://geolite.maxmind.com/download/geoip/database/GeoIPv6.csv.gz \
-unzip -q GeoLite2-Country-CSV.zip
+	http://geolite.maxmind.com/download/geoip/database/GeoIPCountryCSV.zip;
-rm -f GeoLite2-Country-CSV.zip
+gzip -d GeoIPv6.csv.gz;
+unzip GeoIPCountryCSV.zip;

geoip/xt_geoip_fetch

@@ -1,93 +0,0 @@
-#!/usr/bin/perl
-#
-#	Utility to query GeoIP database
-#	Copyright Philip Prindeville, 2018
-#
-use Getopt::Long;
-use Socket qw(AF_INET AF_INET6 inet_ntop);
-use warnings;
-use strict;
-
-sub AF_INET_SIZE() { 4 }
-sub AF_INET6_SIZE() { 16 }
-
-my $target_dir = ".";
-my $ipv4 = 0;
-my $ipv6 = 0;
-
-&Getopt::Long::Configure(qw(bundling));
-&GetOptions(
-	"D=s" => \$target_dir,
-	"4"   => \$ipv4,
-	"6"   => \$ipv6,
-);
-
-if (!-d $target_dir) {
-	print STDERR "Target directory $target_dir does not exit.\n";
-	exit 1;
-}
-
-# if neither specified, assume both
-if (! $ipv4 && ! $ipv6) {
-	$ipv4 = $ipv6 = 1;
-}
-
-foreach my $cc (@ARGV) {
-	if ($cc !~ m/^([a-z]{2}|a[12]|o1)$/i) {
-		print STDERR "Invalid country code '$cc'\n";
-		exit 1;
-	}
-
-	my $file = $target_dir . '/' . uc($cc) . '.iv4';
-
-	if (! -f $file) {
-		printf STDERR "Can't find data for country '$cc'\n";
-		exit 1;
-	}
-
-	my ($contents, $buffer, $bytes, $fh);
-
-	if ($ipv4) {
-		open($fh, '<', $file) || die "Couldn't open file for '$cc'\n";
-
-		binmode($fh);
-
-		while (($bytes = read($fh, $buffer, AF_INET_SIZE * 2)) == AF_INET_SIZE * 2) {
-			my $start = inet_ntop(AF_INET, substr($buffer, 0, AF_INET_SIZE));
-			my $end = inet_ntop(AF_INET, substr($buffer, AF_INET_SIZE));
-			print $start, '-', $end, "\n";
-		}
-		close($fh);
-		if (! defined $bytes) {
-			printf STDERR "Error reading file for '$cc'\n";
-			exit 1;
-		} elsif ($bytes != 0) {
-			printf STDERR "Short read on file for '$cc'\n";
-			exit 1;
-		}
-	}
-
-	substr($file, -1) = '6';
-
-	if ($ipv6) {
-		open($fh, '<', $file) || die "Couldn't open file for '$cc'\n";
-
-		binmode($fh);
-
-		while (($bytes = read($fh, $buffer, AF_INET6_SIZE * 2)) == AF_INET6_SIZE * 2) {
-			my $start = inet_ntop(AF_INET6, substr($buffer, 0, AF_INET6_SIZE));
-			my $end = inet_ntop(AF_INET6, substr($buffer, AF_INET6_SIZE));
-			print $start, '-', $end, "\n";
-		}
-		close($fh);
-		if (! defined $bytes) {
-			printf STDERR "Error reading file for '$cc'\n";
-			exit 1;
-		} elsif ($bytes != 0) {
-			printf STDERR "Short read on file for '$cc'\n";
-			exit 1;
-		}
-	}
-}
-
-exit 0;

include/linux/netfilter/nf_nat.h

@@ -22,12 +22,4 @@ struct nf_nat_ipv4_multi_range_compat {
 	struct nf_nat_ipv4_range	range[1];
 };
 
-struct nf_nat_range {
-	unsigned int			flags;
-	union nf_inet_addr		min_addr;
-	union nf_inet_addr		max_addr;
-	union nf_conntrack_man_proto	min_proto;
-	union nf_conntrack_man_proto	max_proto;
-};
-
 #endif /* _NETFILTER_NF_NAT_H */

mconfig

@@ -2,6 +2,7 @@
 #
 build_ACCOUNT=m
 build_CHAOS=m
+build_CHECKSUM=
 build_DELUDE=m
 build_DHCPMAC=m
 build_DNETMAP=m
@@ -10,6 +11,7 @@ build_IPMARK=m
 build_LOGMARK=m
 build_SYSRQ=m
 build_TARPIT=m
+build_TEE=
 build_condition=m
 build_fuzzy=m
 build_geoip=m

xtables-addons.8.in

@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "Retro" "" "v3.2 (2018-09-07)"
+.TH xtables-addons 8 "v1.47.1 (2012-10-15)" "" "v1.47.1 (2012-10-15)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets
@@ -6,8 +6,7 @@ Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Matches
 .\" @MATCHES@
 .SH "See also"
-\fBiptables\fP(8), \fBip6tables\fP(8), \fBiptables-extensions\fP(8),
+\fBiptables\fP(8), \fBip6tables\fP(8), \fBiptaccount\fP(8)
-\fBiptaccount\fP(8)
 .PP
 For developers, the book "Writing Netfilter modules" at
 http://inai.de/documents/Netfilter_Modules.pdf provides detailed