Xtables-addons 3.8

Maxmind databases are no longer libre.

.gitignore

@@ -2,6 +2,7 @@
 *.la
 *.lo
 *.loT
+*.mod
 *.o
 .cache.mk
 .deps/

configure.ac

@@ -1,4 +1,4 @@
-AC_INIT([xtables-addons], [3.3])
+AC_INIT([xtables-addons], [3.8])
 AC_CONFIG_AUX_DIR([build-aux])
 AC_CONFIG_HEADERS([config.h])
 AC_CONFIG_MACRO_DIR([m4])
@@ -57,8 +57,10 @@ if test -n "$kbuilddir"; then
 		echo "WARNING: Version detection did not succeed. Continue at own luck.";
 	else
 		echo "$kmajor.$kminor.$kmicro.$kstable in $kbuilddir";
-		if test "$kmajor" -gt 5 -o "$kmajor" -eq 5 -a "$kminor" -gt 0; then
+		if test "$kmajor" -gt 5 -o "$kmajor" -eq 5 -a "$kminor" -gt 4; then
 			echo "WARNING: That kernel version is not officially supported yet. Continue at own luck.";
+		elif test "$kmajor" -eq 5 -a "$kminor" -ge 0; then
+			:
 		elif test "$kmajor" -eq 4 -a "$kminor" -ge 18; then
 			:
 		else

doc/changelog.txt

@@ -1,6 +1,35 @@
 
-HEAD
+v3.8 (2020-02-03)
-====
+=================
+- Support for Linux 5.5
+- xt_geoip_build now expects the DBIP format as input,
+  Maxmind is thrown out.
+
+
+v3.7 (2019-12-01)
+=================
+Fixes:
+- xt_geoip: fix in6_addr little-endian byte swapping
+
+
+v3.6 (2019-11-20)
+=================
+Enhancements:
+- support for up to Linux 5.4
+
+
+v3.5 (2019-09-10)
+=================
+Enhancements:
+- xt_DELUDE, xt_TARPIT: added additional code needed to work with
+  bridges from Linux 5.0 onwards.
+
+
+v3.4 (2019-09-06)
+=================
+Enhancements:
+- support for up to Linux 5.3
+- xt_PROTO module
 
 
 v3.3 (2019-03-07)

extensions/Kbuild

@@ -13,6 +13,7 @@ obj-${build_DNETMAP}     += xt_DNETMAP.o
 obj-${build_ECHO}        += xt_ECHO.o
 obj-${build_IPMARK}      += xt_IPMARK.o
 obj-${build_LOGMARK}     += xt_LOGMARK.o
+obj-${build_PROTO}       += xt_PROTO.o
 obj-${build_SYSRQ}       += xt_SYSRQ.o
 obj-${build_TARPIT}      += xt_TARPIT.o
 obj-${build_condition}   += xt_condition.o

extensions/Mbuild

@@ -8,6 +8,7 @@ obj-${build_DNETMAP}     += libxt_DNETMAP.so
 obj-${build_ECHO}        += libxt_ECHO.so
 obj-${build_IPMARK}      += libxt_IPMARK.so
 obj-${build_LOGMARK}     += libxt_LOGMARK.so
+obj-${build_PROTO}       += libxt_PROTO.so
 obj-${build_SYSRQ}       += libxt_SYSRQ.so
 obj-${build_TARPIT}      += libxt_TARPIT.so
 obj-${build_condition}   += libxt_condition.so

extensions/libxt_PROTO.c

@@ -0,0 +1,105 @@
+/*
+ * PROTO Target module
+ * This program is distributed under the terms of GNU GPL
+ */
+#include <stdio.h>
+#include <xtables.h>
+#include "xt_PROTO.h"
+
+enum {
+	O_PROTO_SET = 0,
+	O_PROTO_STOP_AT_FRAG = 1,
+	O_PROTO_STOP_AT_AUTH = 2,
+	F_PROTO_SET = 1 << O_PROTO_SET,
+	F_PROTO_STOP_AT_FRAG = 1 << O_PROTO_STOP_AT_FRAG,
+	F_PROTO_STOP_AT_AUTH = 1 << O_PROTO_STOP_AT_AUTH,
+};
+
+#define s struct xt_PROTO_info
+static const struct xt_option_entry PROTO_opts[] = {
+	{.name = "proto-set", .type = XTTYPE_UINT8, .id = O_PROTO_SET,
+	 .flags = XTOPT_PUT | XTOPT_MAND, XTOPT_POINTER(s, proto)},
+	{.name = "stop-at-frag", .type = XTTYPE_NONE, .id = O_PROTO_STOP_AT_FRAG},
+	{.name = "stop-at-auth", .type = XTTYPE_NONE, .id = O_PROTO_STOP_AT_AUTH},
+	XTOPT_TABLEEND,
+};
+#undef s
+
+static void PROTO_help(void)
+{
+	printf(
+"PROTO target options\n"
+"  --proto-set value		Set protocol to <value 0-255>\n"
+	);
+}
+
+static void PROTO_parse(struct xt_option_call *cb)
+{
+	struct xt_PROTO_info *info = cb->data;
+
+	xtables_option_parse(cb);
+	switch (cb->entry->id) {
+	case O_PROTO_SET:
+		info->mode |= 1 << XT_PROTO_SET;
+		break;
+	case O_PROTO_STOP_AT_FRAG:
+		info->mode |= 1 << XT_PROTO_STOP_AT_FRAG;
+		break;
+	case O_PROTO_STOP_AT_AUTH:
+		info->mode |= 1 << XT_PROTO_STOP_AT_AUTH;
+		break;
+	}
+}
+
+static void PROTO_check(struct xt_fcheck_call *cb)
+{
+	if (!(cb->xflags & F_PROTO_SET))
+		xtables_error(PARAMETER_PROBLEM,
+				"PROTO: You must specify the proto to be set");
+}
+
+static void PROTO_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_PROTO_info *info = (void *)target->data;
+
+	if (info->mode & (1 << XT_PROTO_SET))
+		printf(" --proto-set %u", info->proto);
+	if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
+		printf(" --stop-at-frag");
+	if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
+		printf(" --stop-at-auth");
+}
+
+static void PROTO_print(const void *ip, const struct xt_entry_target *target,
+                     int numeric)
+{
+	const struct xt_PROTO_info *info = (void *)target->data;
+
+	printf(" PROTO ");
+	if (info->mode & (1 << XT_PROTO_SET))
+		printf("set to %u", info->proto);
+	if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
+		printf(" stop-at-frag");
+	if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
+		printf(" stop-at-auth");
+}
+
+static struct xtables_target proto_tg_reg = {
+	.name 		= "PROTO",
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_UNSPEC,
+	.size		= XT_ALIGN(sizeof(struct xt_PROTO_info)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_PROTO_info)),
+	.help		= PROTO_help,
+	.print		= PROTO_print,
+	.save		= PROTO_save,
+	.x6_parse	= PROTO_parse,
+	.x6_fcheck	= PROTO_check,
+	.x6_options	= PROTO_opts,
+};
+
+static __attribute__((constructor)) void _init(void)
+{
+	xtables_register_target(&proto_tg_reg);
+
+}

extensions/libxt_PROTO.man

@@ -0,0 +1,30 @@
+.PP
+The PROTO target modifies the protocol number in IP packet header.
+.TP
+\fB\-\-proto-set\fP \fIproto_num\fP
+This option is mandatory. \fIproto_num\fP is the protocol number to which you want to
+modify the packets.
+.TP
+\fB\-\-stop-at-frag\fP
+This option is only valid for IPv6 rules. When specifying this option, the
+fragment extension header will be seen as a non-extension header.
+.TP
+\fB\-\-stop-at-auth\fP
+This option is only valid for IPv6 rules. When specifying this option, the
+authentication extension header will be seen as a non-extension header.
+.PP
+For IPv4 packets, the \fBProtocol\fP field is modified and the checksum is
+re-calculated.
+.PP
+For IPv6 packets, the scenario can be more complex due to the introduction of
+the extension headers mechanism. By default, the PROTO target will scan the IPv6
+packet, finding the last extension header and modify its \fBNext-header\fP field.
+Normally, the following headers will be seen as an extension header:
+\fINEXTHDR_HOP\fP,
+\fINEXTHDR_ROUTING\fP,
+\fINEXTHDR_FRAGMENT\fP,
+\fINEXTHDR_AUTH\fP,
+\fINEXTHDR_DEST\fP.
+.PP
+For fragmented packets, only the first fragment is processed and other fragments
+are not touched.

extensions/libxt_geoip.c

@@ -50,26 +50,6 @@ static struct option geoip_opts[] = {
 };
 
 #if __BYTE_ORDER == __LITTLE_ENDIAN
-static void geoip_swap_le16(uint16_t *buf)
-{
-	unsigned char *p = (void *)buf;
-	uint16_t n= p[0] + (p[1] << 8);
-	p[0] = (n >> 8) & 0xff;
-	p[1] = n & 0xff;
-}
-
-static void geoip_swap_in6(struct in6_addr *in6)
-{
-	geoip_swap_le16(&in6->s6_addr16[0]);
-	geoip_swap_le16(&in6->s6_addr16[1]);
-	geoip_swap_le16(&in6->s6_addr16[2]);
-	geoip_swap_le16(&in6->s6_addr16[3]);
-	geoip_swap_le16(&in6->s6_addr16[4]);
-	geoip_swap_le16(&in6->s6_addr16[5]);
-	geoip_swap_le16(&in6->s6_addr16[6]);
-	geoip_swap_le16(&in6->s6_addr16[7]);
-}
-
 static void geoip_swap_le32(uint32_t *buf)
 {
 	unsigned char *p = (void *)buf;
@@ -79,6 +59,14 @@ static void geoip_swap_le32(uint32_t *buf)
 	p[2] = (n >> 8) & 0xff;
 	p[3] = n & 0xff;
 }
+
+static void geoip_swap_in6(struct in6_addr *in6)
+{
+	geoip_swap_le32(&in6->s6_addr32[0]);
+	geoip_swap_le32(&in6->s6_addr32[1]);
+	geoip_swap_le32(&in6->s6_addr32[2]);
+	geoip_swap_le32(&in6->s6_addr32[3]);
+}
 #endif
 
 static void *

extensions/pknock/xt_pknock.c

@@ -1125,7 +1125,6 @@ static int __init xt_pknock_mt_init(void)
 
 	crypto.size = crypto_shash_digestsize(crypto.tfm);
 	crypto.desc.tfm = crypto.tfm;
-	crypto.desc.flags = 0;
 
 	pde = proc_mkdir("xt_pknock", init_net.proc_net);
 	if (pde == NULL) {

extensions/xt_DELUDE.c

@@ -107,8 +107,13 @@ static void delude_send_reset(struct net *net, struct sk_buff *oldskb,
 
 	addr_type = RTN_UNSPEC;
 #ifdef CONFIG_BRIDGE_NETFILTER
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+	if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
+	    ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
+#else
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
 	    nskb->nf_bridge->physoutdev))
+#endif
 #else
 	if (hook != NF_INET_FORWARD)
 #endif

extensions/xt_DHCPMAC.c

@@ -96,7 +96,8 @@ dhcpmac_tg(struct sk_buff *skb, const struct xt_action_param *par)
 	struct udphdr udpbuf, *udph;
 	unsigned int i;
 
-	if (!skb_make_writable(skb, 0))
+	if (skb_ensure_writable(skb, ip_hdrlen(skb) + sizeof(udpbuf) +
+				     sizeof(dhcpbuf)))
 		return NF_DROP;
 
 	udph = skb_header_pointer(skb, ip_hdrlen(skb),

extensions/xt_PROTO.c

@@ -0,0 +1,156 @@
+/*
+ * Protocol modification target for IP tables
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <net/ipv6.h>
+#include <net/checksum.h>
+#include <linux/netfilter/x_tables.h>
+#include "xt_PROTO.h"
+
+MODULE_AUTHOR("Shanker Wang <i@innull.com>");
+MODULE_DESCRIPTION("Xtables: Protocol field modification target");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+proto_tg(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	struct iphdr *iph;
+	const struct xt_PROTO_info *info = par->targinfo;
+	int new_proto;
+
+	if (skb_ensure_writable(skb, skb->len))
+		return NF_DROP;
+
+	iph = ip_hdr(skb);
+	new_proto = iph->protocol;
+	if (info->mode & (1 << XT_PROTO_SET))
+		new_proto = info->proto;
+	if (new_proto != iph->protocol) {
+		csum_replace2(&iph->check, htons(iph->protocol & 0xff),
+		              htons(new_proto & 0xff));
+		iph->protocol = new_proto;
+	}
+
+	return XT_CONTINUE;
+}
+
+static unsigned int
+proto_tg6(struct sk_buff *skb, const struct xt_action_param *par)
+{
+	struct ipv6hdr *ip6h;
+	const struct xt_PROTO_info *info = par->targinfo;
+	u8 *nexthdr;
+	unsigned int hdr_offset;
+	__be16 *fp;
+
+	if (skb_ensure_writable(skb, skb->len))
+		return NF_DROP;
+
+	ip6h = ipv6_hdr(skb);
+	nexthdr = &ip6h->nexthdr;
+	hdr_offset = sizeof(struct ipv6hdr);
+
+	for (;;) {
+		struct ipv6_opt_hdr _opthdr, *opthp;
+		unsigned int hdrlen;
+		unsigned short _frag_off;
+		if (!ipv6_ext_hdr(*nexthdr) || *nexthdr == NEXTHDR_NONE)
+			break;
+		opthp = skb_header_pointer(skb, skb_network_offset(skb) + hdr_offset, sizeof(_opthdr), &_opthdr);
+		if (!opthp)
+			return NF_DROP;
+		if (*nexthdr == NEXTHDR_FRAGMENT) {
+			if (info->mode & (1 << XT_PROTO_STOP_AT_FRAG))
+				break;
+			fp = skb_header_pointer(skb, skb_network_offset(skb) +
+			     hdr_offset + offsetof(struct frag_hdr, frag_off),
+			     sizeof(_frag_off), &_frag_off);
+			if (!fp)
+				return NF_DROP;
+			_frag_off = ntohs(*fp) & ~0x7;
+			if (_frag_off) { // if the packet is not the first fragment
+				if (!ipv6_ext_hdr(opthp->nexthdr) || opthp->nexthdr == NEXTHDR_NONE ||
+				    (info->mode & (1 << XT_PROTO_STOP_AT_AUTH) && opthp->nexthdr == NEXTHDR_AUTH)) {
+					nexthdr = &((struct ipv6_opt_hdr *)(skb_network_header(skb) + hdr_offset))->nexthdr;
+					break;
+				} else {
+					return XT_CONTINUE;
+				}
+			}
+			hdrlen = 8;
+		} else if(*nexthdr == NEXTHDR_AUTH) {
+			if (info->mode & (1 << XT_PROTO_STOP_AT_AUTH))
+				break;
+			hdrlen = (opthp->hdrlen + 2) << 2;
+		} else {
+			hdrlen = ipv6_optlen(opthp);
+		}
+		nexthdr = &((struct ipv6_opt_hdr *)(skb_network_header(skb) + hdr_offset))->nexthdr;
+		hdr_offset += hdrlen;
+	}
+	
+	if (info->mode & (1 << XT_PROTO_SET))
+		*nexthdr = info->proto;
+	return XT_CONTINUE;
+}
+
+static int proto_tg_check(const struct xt_tgchk_param *par)
+{
+	const struct xt_PROTO_info *info = par->targinfo;
+
+	if ((info->mode & (1 << XT_PROTO_SET)) == 0) {
+		pr_info_ratelimited("Did not specify any proto to set\n");
+		return -EINVAL;
+	}
+	if (par->family != NFPROTO_IPV6 && (info->mode & ((1 << XT_PROTO_STOP_AT_FRAG) | (1 << XT_PROTO_STOP_AT_AUTH))) != 0) {
+		pr_info_ratelimited("Must not specify stop-at-frag and stop-at-auth on non-ipv6 targets\n");
+		return -EPROTOTYPE;
+	}
+	return 0;
+}
+
+static struct xt_target proto_tg_reg[] __read_mostly = {
+	{
+		.name       = "PROTO",
+		.revision   = 0,
+		.family     = NFPROTO_IPV4,
+		.target     = proto_tg,
+		.targetsize = sizeof(struct xt_PROTO_info),
+		.table      = "mangle",
+		.checkentry = proto_tg_check,
+		.me         = THIS_MODULE,
+	},
+	{
+		.name       = "PROTO",
+		.revision   = 0,
+		.family     = NFPROTO_IPV6,
+		.target     = proto_tg6,
+		.targetsize = sizeof(struct xt_PROTO_info),
+		.table      = "mangle",
+		.checkentry = proto_tg_check,
+		.me         = THIS_MODULE,
+	},
+};
+
+static int __init proto_tg_init(void)
+{
+	return xt_register_targets(proto_tg_reg, ARRAY_SIZE(proto_tg_reg));
+}
+
+static void __exit proto_tg_exit(void)
+{
+	xt_unregister_targets(proto_tg_reg, ARRAY_SIZE(proto_tg_reg));
+}
+
+module_init(proto_tg_init);
+module_exit(proto_tg_exit);
+MODULE_ALIAS("ipt_PROTO");
+MODULE_ALIAS("ip6t_PROTO");

extensions/xt_PROTO.h

@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/* Protocol modification module for IP tables */
+
+#ifndef _XT_PROTO_H
+#define _XT_PROTO_H
+
+#include <linux/types.h>
+
+enum {
+	XT_PROTO_SET = 0,
+	XT_PROTO_STOP_AT_FRAG = 1,
+	XT_PROTO_STOP_AT_AUTH = 2
+};
+
+struct xt_PROTO_info {
+	__u8	mode;
+	__u8	proto;
+};
+
+#endif

extensions/xt_SYSRQ.c

@@ -114,7 +114,6 @@ static unsigned int sysrq_tg(const void *pdata, uint16_t len)
 	}
 
 	desc.tfm   = sysrq_tfm;
-	desc.flags = 0;
 	ret = crypto_shash_init(&desc);
 	if (ret != 0)
 		goto hash_fail;

extensions/xt_TARPIT.c

@@ -205,7 +205,11 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 		return;
 
 	/* This packet will not be the same as the other: clear nf fields */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
+	nf_reset_ct(nskb);
+#else
 	nf_reset(nskb);
+#endif
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
 	skb_shinfo(nskb)->gso_size = 0;
@@ -249,8 +253,13 @@ static void tarpit_tcp4(struct net *net, struct sk_buff *oldskb,
 		niph->id = ~oldhdr->id + 1;
 
 #ifdef CONFIG_BRIDGE_NETFILTER
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 0, 0)
+	if (hook != NF_INET_FORWARD || ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF) != NULL &&
+	    ((struct nf_bridge_info *)skb_ext_find(nskb, SKB_EXT_BRIDGE_NF))->physoutdev))
+#else
 	if (hook != NF_INET_FORWARD || (nskb->nf_bridge != NULL &&
 	    nskb->nf_bridge->physoutdev != NULL))
+#endif
 #else
 	if (hook != NF_INET_FORWARD)
 #endif
@@ -341,7 +350,11 @@ static void tarpit_tcp6(struct net *net, struct sk_buff *oldskb,
 	}
 
 	/* This packet will not be the same as the other: clear nf fields */
+#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 4, 0)
+	nf_reset_ct(nskb);
+#else
 	nf_reset(nskb);
+#endif
 	skb_nfmark(nskb) = 0;
 	skb_init_secmark(nskb);
 	skb_shinfo(nskb)->gso_size = 0;

geoip/xt_geoip_build

@@ -1,8 +1,9 @@
 #!/usr/bin/perl
 #
-#	Converter for MaxMind (GeoLite2) CSV database to binary, for xt_geoip
+#	Converter for DBIP (Country Lite) CSV database to binary, for xt_geoip
 #	Copyright Jan Engelhardt, 2008-2011
 #	Copyright Philip Prindeville, 2018
+#	Copyright Arjen de Korte, 2020
 #
 use Getopt::Long;
 use Net::CIDR::Lite;
@@ -34,136 +35,33 @@ if (!-d $target_dir) {
 	exit 1;
 }
 
-my %countryId;
-my %countryName;
-&loadCountries();
 &dump(&collect());
 
-sub loadCountries
-{
-	sub id; sub cc; sub long; sub ct; sub cn;
-
-	%countryId = ();
-	%countryName = ();
-
-	my $file = "$source_dir/GeoLite2-Country-Locations-en.csv";
-	open(my $fh, '<', $file) || die "Couldn't open list country names\n";
-
-	# first line is headers
-	my $row = $csv->getline($fh);
-
-	my %header = map { ($row->[$_], $_); } (0..$#{$row});
-
-	my %pairs = (
-		country_iso_code => 'ISO Country Code',
-		geoname_id => 'ID',
-		country_name => 'Country Name',
-		continent_code => 'Continent Code',
-		continent_name => 'Continent Name',
-	);
-
-	# verify that the columns we need are present
-	map { die "Table has no $pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
-
-	my %remapping = (
-		id => 'geoname_id',
-		cc => 'country_iso_code',
-		long => 'country_name',
-		ct => 'continent_code',
-		cn => 'continent_name',
-	);
-
-	# now create a function which returns the value of that column #
-	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
-
-	while (my $row = $csv->getline($fh)) {
-		if ($row->[cc] eq '' && $row->[long] eq '') {
-			$countryId{$row->[id]} = $row->[ct];
-			$countryName{$row->[ct]} = $row->[cn];
-		} else {
-			$countryId{$row->[id]} = $row->[cc];
-			$countryName{$row->[cc]} = $row->[long];
-		}
-	}
-
-	$countryName{A1} = 'Anonymous Proxy';
-	$countryName{A2} = 'Satellite Provider';
-	$countryName{O1} = 'Other Country';
-
-	close($fh);
-
-	# clean up the namespace
-	undef &id; undef &cc; undef &long; undef &ct; undef &cn;
-}
-
-sub lookupCountry
-{
-	my ($id, $rid, $proxy, $sat) = @_;
-
-	if ($proxy) {
-		return 'A1';
-	} elsif ($sat) {
-		return 'A2';
-	}
-	$id ||= $rid;
-	if ($id eq '') {
-		return 'O1';
-	}
-	die "Unknown id: $id line $.\n" unless (exists $countryId{$id});
-	return $countryId{$id};
-}
-
 sub collect
 {
 	my ($file, $fh, $row);
-	my (%country, %header);
+	my (%country);
 
-	sub net; sub id; sub rid; sub proxy; sub sat;
+	$file = "$source_dir/dbip-country-lite.csv";
-
+	open($fh, '<', $file) || die "Can't open DBIP database\n";
-	my %pairs = (
-		network => 'Network',
-		registered_country_geoname_id => 'Registered Country ID',
-		geoname_id => 'Country ID',
-		is_anonymous_proxy => 'Anonymous Proxy',
-		is_satellite_provider => 'Satellite',
-	);
-
-	foreach (sort keys %countryName) {
-		$country{$_} = {
-			name => $countryName{$_},
-			pool_v4 => Net::CIDR::Lite->new(),
-			pool_v6 => Net::CIDR::Lite->new(),
-		};
-	}
-
-	$file = "$source_dir/GeoLite2-Country-Blocks-IPv4.csv";
-	open($fh, '<', $file) || die "Can't open IPv4 database\n";
-
-	# first line is headers
-	$row = $csv->getline($fh);
-
-	%header = map { ($row->[$_], $_); } (0..$#{$row});
-
-	# verify that the columns we need are present
-	map { die "Table has no %pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
-
-	my %remapping = (
-		net => 'network',
-		id => 'geoname_id',
-		rid => 'registered_country_geoname_id',
-		proxy => 'is_anonymous_proxy',
-		sat => 'is_satellite_provider',
-	);
-
-	# now create a function which returns the value of that column #
-	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
 
 	while ($row = $csv->getline($fh)) {
-		my ($cc, $cidr);
+		my ($cc, $range);
 
-		$cc = lookupCountry($row->[id], $row->[rid], $row->[proxy], $row->[sat]);
+		$cc = $row->[2];
-		$cidr = $row->[net];
+		$range = $row->[0] . "-" . $row->[1];
-		$country{$cc}->{pool_v4}->add($cidr);
+
+		if (!exists($country{$cc})) {
+			$country{$cc} = { pool_v4 => Net::CIDR::Lite->new(), pool_v6 => Net::CIDR::Lite->new() };
+		}
+
+		if (index($range, '.') > 0) {
+			$country{$cc}->{pool_v4}->add_range($range);
+		}
+
+		if (index($range, ':') > 0) {
+			$country{$cc}->{pool_v6}->add_range($range);
+		}
 
 		if ($. % 4096 == 0) {
 			print STDERR "\r\e[2K$. entries";
@@ -174,43 +72,6 @@ sub collect
 
 	close($fh);
 
-	# clean up the namespace
-	undef &net; undef &id; undef &rid; undef &proxy; undef &sat;
-
-	$file = "$source_dir/GeoLite2-Country-Blocks-IPv6.csv";
-	open($fh, '<', $file) || die "Can't open IPv6 database\n";
-
-	# first line is headers
-	$row = $csv->getline($fh);
-
-	%header = map { ($row->[$_], $_); } (0..$#{$row});
-
-	# verify that the columns we need are present
-	map { die "Table has no %pairs{$_} column\n" unless (exists $header{$_}); } keys %pairs;
-
-	# unlikely the IPv6 table has different columns, but just to be sure
-	# create a function which returns the value of that column #
-	map { eval "sub $_ () { \$header{\$remapping{$_}}; }" ; } keys %remapping;
-
-	while ($row = $csv->getline($fh)) {
-		my ($cc, $cidr);
-
-		$cc = lookupCountry($row->[id], $row->[rid], $row->[proxy], $row->[sat]);
-		$cidr = $row->[net];
-		$country{$cc}->{pool_v6}->add($cidr);
-
-		if ($. % 4096 == 0) {
-			print STDERR "\r\e[2K$. entries";
-		}
-	}
-
-	print STDERR "\r\e[2K$. entries total\n";
-
-	close($fh);
-
-	# clean up the namespace
-	undef &net; undef &id; undef &rid; undef &proxy; undef &sat;
-
 	return \%country;
 }
 
@@ -230,22 +91,22 @@ sub dump_one
 
 	@ranges = $country->{pool_v4}->list_range();
 
-	writeCountry($iso_code, $country->{name}, AF_INET, @ranges);
+	writeCountry($iso_code, AF_INET, @ranges);
 
 	@ranges = $country->{pool_v6}->list_range();
 
-	writeCountry($iso_code, $country->{name}, AF_INET6, @ranges);
+	writeCountry($iso_code, AF_INET6, @ranges);
 }
 
 sub writeCountry
 {
-	my ($iso_code, $name, $family, @ranges) = @_;
+	my ($iso_code, $family, @ranges) = @_;
 	my $fh;
 
-	printf "%5u IPv%s ranges for %s %s\n",
+	printf "%5u IPv%s ranges for %s\n",
 		scalar(@ranges),
 		($family == AF_INET ? '4' : '6'),
-		$iso_code, $name;
+		$iso_code;
 
 	my $file = "$target_dir/".uc($iso_code).".iv".($family == AF_INET ? '4' : '6');
 	if (!open($fh, '>', $file)) {

mconfig

@@ -8,6 +8,7 @@ build_DNETMAP=m
 build_ECHO=m
 build_IPMARK=m
 build_LOGMARK=m
+build_PROTO=m
 build_SYSRQ=m
 build_TARPIT=m
 build_condition=m

xtables-addons.8.in

@@ -1,4 +1,4 @@
-.TH xtables-addons 8 "" "" "v3.3 (2019-03-07)"
+.TH xtables-addons 8 "" "" "v3.8 (2020-02-01)"
 .SH Name
 Xtables-addons \(em additional extensions for iptables, ip6tables, etc.
 .SH Targets