[NETFILTER]: Convert ip_tables matches/targets to centralized error checking

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
index 1de8628..ef4be3d 100644 (file)
--- a/net/ipv4/netfilter/ip_nat_rule.c
+++ b/net/ipv4/netfilter/ip_nat_rule.c
@@ -181,23 +181,6 @@ static int ipt_snat_checkentry(const char *tablename,
                printk("SNAT: multiple ranges no longer supported\n");
                return 0;
        }
-
-       if (targinfosize != IPT_ALIGN(sizeof(struct ip_nat_multi_range_compat))) {
-               DEBUGP("SNAT: Target size %u wrong for %u ranges\n",
-                      targinfosize, mr->rangesize);
-               return 0;
-       }
-
-       /* Only allow these for NAT. */
-       if (strcmp(tablename, "nat") != 0) {
-               DEBUGP("SNAT: wrong table %s\n", tablename);
-               return 0;
-       }
-
-       if (hook_mask & ~(1 << NF_IP_POST_ROUTING)) {
-               DEBUGP("SNAT: hook mask 0x%x bad\n", hook_mask);
-               return 0;
-       }
        return 1;
 }
 
@@ -214,24 +197,6 @@ static int ipt_dnat_checkentry(const char *tablename,
                printk("DNAT: multiple ranges no longer supported\n");
                return 0;
        }
-
-       if (targinfosize != IPT_ALIGN(sizeof(struct ip_nat_multi_range_compat))) {
-               DEBUGP("DNAT: Target size %u wrong for %u ranges\n",
-                      targinfosize, mr->rangesize);
-               return 0;
-       }
-
-       /* Only allow these for NAT. */
-       if (strcmp(tablename, "nat") != 0) {
-               DEBUGP("DNAT: wrong table %s\n", tablename);
-               return 0;
-       }
-
-       if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))) {
-               DEBUGP("DNAT: hook mask 0x%x bad\n", hook_mask);
-               return 0;
-       }
-       
        return 1;
 }
 
@@ -299,12 +264,18 @@ int ip_nat_rule_find(struct sk_buff **pskb,
 static struct ipt_target ipt_snat_reg = {
        .name           = "SNAT",
        .target         = ipt_snat_target,
+       .targetsize     = sizeof(struct ip_nat_multi_range_compat),
+       .table          = "nat",
+       .hooks          = 1 << NF_IP_POST_ROUTING,
        .checkentry     = ipt_snat_checkentry,
 };
 
 static struct ipt_target ipt_dnat_reg = {
        .name           = "DNAT",
        .target         = ipt_dnat_target,
+       .targetsize     = sizeof(struct ip_nat_multi_range_compat),
+       .table          = "nat",
+       .hooks          = 1 << NF_IP_PRE_ROUTING,
        .checkentry     = ipt_dnat_checkentry,
 };
 

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index f884ca2..62f8d63 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -477,21 +477,12 @@ standard_check(const struct ipt_entry_target *t,
        struct ipt_standard_target *targ = (void *)t;
 
        /* Check standard info. */
-       if (t->u.target_size
-           != IPT_ALIGN(sizeof(struct ipt_standard_target))) {
-               duprintf("standard_check: target size %u != %u\n",
-                        t->u.target_size,
-                        IPT_ALIGN(sizeof(struct ipt_standard_target)));
-               return 0;
-       }
-
        if (targ->verdict >= 0
            && targ->verdict > max_offset - sizeof(struct ipt_entry)) {
                duprintf("ipt_standard_check: bad verdict (%i)\n",
                         targ->verdict);
                return 0;
        }
-
        if (targ->verdict < -NF_MAX_VERDICT - 1) {
                duprintf("ipt_standard_check: bad negative verdict (%i)\n",
                         targ->verdict);
@@ -1330,24 +1321,22 @@ icmp_checkentry(const char *tablename,
           unsigned int matchsize,
           unsigned int hook_mask)
 {
-       const struct ipt_ip *ip = info;
        const struct ipt_icmp *icmpinfo = matchinfo;
 
-       /* Must specify proto == ICMP, and no unknown invflags */
-       return ip->proto == IPPROTO_ICMP
-               && !(ip->invflags & IPT_INV_PROTO)
-               && matchsize == IPT_ALIGN(sizeof(struct ipt_icmp))
-               && !(icmpinfo->invflags & ~IPT_ICMP_INV);
+       /* Must specify no unknown invflags */
+       return !(icmpinfo->invflags & ~IPT_ICMP_INV);
 }
 
 /* The built-in targets: standard (NULL) and error. */
 static struct ipt_target ipt_standard_target = {
        .name           = IPT_STANDARD_TARGET,
+       .targetsize     = sizeof(int),
 };
 
 static struct ipt_target ipt_error_target = {
        .name           = IPT_ERROR_TARGET,
        .target         = ipt_error,
+       .targetsize     = IPT_FUNCTION_MAXNAMELEN,
 };
 
 static struct nf_sockopt_ops ipt_sockopts = {
@@ -1362,8 +1351,10 @@ static struct nf_sockopt_ops ipt_sockopts = {
 
 static struct ipt_match icmp_matchstruct = {
        .name           = "icmp",
-       .match          = &icmp_match,
-       .checkentry     = &icmp_checkentry,
+       .match          = icmp_match,
+       .matchsize      = sizeof(struct ipt_icmp),
+       .proto          = IPPROTO_ICMP,
+       .checkentry     = icmp_checkentry,
 };
 
 static int __init init(void)

diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index d9bc971..24f88dd 100644 (file)
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -389,13 +389,6 @@ checkentry(const char *tablename,
 
        struct clusterip_config *config;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_clusterip_tgt_info))) {
-               printk(KERN_WARNING "CLUSTERIP: targinfosize %u != %Zu\n",
-                      targinfosize,
-                      IPT_ALIGN(sizeof(struct ipt_clusterip_tgt_info)));
-               return 0;
-       }
-
        if (cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP &&
            cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT &&
            cipinfo->hash_mode != CLUSTERIP_HASHMODE_SIP_SPT_DPT) {
@@ -476,12 +469,13 @@ static void destroy(void *matchinfo, unsigned int matchinfosize)
        clusterip_config_put(cipinfo->config);
 }
 
-static struct ipt_target clusterip_tgt = { 
-       .name = "CLUSTERIP",
-       .target = &target, 
-       .checkentry = &checkentry, 
-       .destroy = &destroy,
-       .me = THIS_MODULE
+static struct ipt_target clusterip_tgt = {
+       .name           = "CLUSTERIP",
+       .target         = target,
+       .targetsize     = sizeof(struct ipt_clusterip_tgt_info),
+       .checkentry     = checkentry,
+       .destroy        = destroy,
+       .me             = THIS_MODULE
 };
 
 

diff --git a/net/ipv4/netfilter/ipt_DSCP.c b/net/ipv4/netfilter/ipt_DSCP.c
index 898cdf7..a202467 100644 (file)
--- a/net/ipv4/netfilter/ipt_DSCP.c
+++ b/net/ipv4/netfilter/ipt_DSCP.c
@@ -64,29 +64,18 @@ checkentry(const char *tablename,
 {
        const u_int8_t dscp = ((struct ipt_DSCP_info *)targinfo)->dscp;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_DSCP_info))) {
-               printk(KERN_WARNING "DSCP: targinfosize %u != %Zu\n",
-                      targinfosize,
-                      IPT_ALIGN(sizeof(struct ipt_DSCP_info)));
-               return 0;
-       }
-
-       if (strcmp(tablename, "mangle") != 0) {
-               printk(KERN_WARNING "DSCP: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
-               return 0;
-       }
-
        if ((dscp > IPT_DSCP_MAX)) {
                printk(KERN_WARNING "DSCP: dscp %x out of range\n", dscp);
                return 0;
        }
-
        return 1;
 }
 
 static struct ipt_target ipt_dscp_reg = {
        .name           = "DSCP",
        .target         = target,
+       .targetsize     = sizeof(struct ipt_DSCP_info),
+       .table          = "mangle",
        .checkentry     = checkentry,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index 7064454..1bf1a40 100644 (file)
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -121,18 +121,6 @@ checkentry(const char *tablename,
        const struct ipt_ECN_info *einfo = (struct ipt_ECN_info *)targinfo;
        const struct ipt_entry *e = e_void;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_ECN_info))) {
-               printk(KERN_WARNING "ECN: targinfosize %u != %Zu\n",
-                      targinfosize,
-                      IPT_ALIGN(sizeof(struct ipt_ECN_info)));
-               return 0;
-       }
-
-       if (strcmp(tablename, "mangle") != 0) {
-               printk(KERN_WARNING "ECN: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
-               return 0;
-       }
-
        if (einfo->operation & IPT_ECN_OP_MASK) {
                printk(KERN_WARNING "ECN: unsupported ECN operation %x\n",
                        einfo->operation);
@@ -143,20 +131,20 @@ checkentry(const char *tablename,
                        einfo->ip_ect);
                return 0;
        }
-
        if ((einfo->operation & (IPT_ECN_OP_SET_ECE|IPT_ECN_OP_SET_CWR))
            && (e->ip.proto != IPPROTO_TCP || (e->ip.invflags & IPT_INV_PROTO))) {
                printk(KERN_WARNING "ECN: cannot use TCP operations on a "
                       "non-tcp rule\n");
                return 0;
        }
-
        return 1;
 }
 
 static struct ipt_target ipt_ecn_reg = {
        .name           = "ECN",
        .target         = target,
+       .targetsize     = sizeof(struct ipt_ECN_info),
+       .table          = "mangle",
        .checkentry     = checkentry,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index cc27545..f2c7a93 100644 (file)
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -443,29 +443,22 @@ static int ipt_log_checkentry(const char *tablename,
 {
        const struct ipt_log_info *loginfo = targinfo;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_log_info))) {
-               DEBUGP("LOG: targinfosize %u != %u\n",
-                      targinfosize, IPT_ALIGN(sizeof(struct ipt_log_info)));
-               return 0;
-       }
-
        if (loginfo->level >= 8) {
                DEBUGP("LOG: level %u >= 8\n", loginfo->level);
                return 0;
        }
-
        if (loginfo->prefix[sizeof(loginfo->prefix)-1] != '\0') {
                DEBUGP("LOG: prefix term %i\n",
                       loginfo->prefix[sizeof(loginfo->prefix)-1]);
                return 0;
        }
-
        return 1;
 }
 
 static struct ipt_target ipt_log_reg = {
        .name           = "LOG",
        .target         = ipt_log_target,
+       .targetsize     = sizeof(struct ipt_log_info),
        .checkentry     = ipt_log_checkentry,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 12c56d3..df5ea08 100644 (file)
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -47,19 +47,6 @@ masquerade_check(const char *tablename,
 {
        const struct ip_nat_multi_range_compat *mr = targinfo;
 
-       if (strcmp(tablename, "nat") != 0) {
-               DEBUGP("masquerade_check: bad table `%s'.\n", tablename);
-               return 0;
-       }
-       if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
-               DEBUGP("masquerade_check: size %u != %u.\n",
-                      targinfosize, sizeof(*mr));
-               return 0;
-       }
-       if (hook_mask & ~(1 << NF_IP_POST_ROUTING)) {
-               DEBUGP("masquerade_check: bad hooks %x.\n", hook_mask);
-               return 0;
-       }
        if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
                DEBUGP("masquerade_check: bad MAP_IPS.\n");
                return 0;
@@ -179,6 +166,9 @@ static struct notifier_block masq_inet_notifier = {
 static struct ipt_target masquerade = {
        .name           = "MASQUERADE",
        .target         = masquerade_target,
+       .targetsize     = sizeof(struct ip_nat_multi_range_compat),
+       .table          = "nat",
+       .hooks          = 1 << NF_IP_POST_ROUTING,
        .checkentry     = masquerade_check,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index b074467..836d67e 100644 (file)
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -38,19 +38,6 @@ check(const char *tablename,
 {
        const struct ip_nat_multi_range_compat *mr = targinfo;
 
-       if (strcmp(tablename, "nat") != 0) {
-               DEBUGP(MODULENAME":check: bad table `%s'.\n", tablename);
-               return 0;
-       }
-       if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
-               DEBUGP(MODULENAME":check: size %u.\n", targinfosize);
-               return 0;
-       }
-       if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING) |
-                         (1 << NF_IP_LOCAL_OUT))) {
-               DEBUGP(MODULENAME":check: bad hooks %x.\n", hook_mask);
-               return 0;
-       }
        if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
                DEBUGP(MODULENAME":check: bad MAP_IPS.\n");
                return 0;
@@ -101,6 +88,10 @@ target(struct sk_buff **pskb,
 static struct ipt_target target_module = { 
        .name           = MODULENAME,
        .target         = target, 
+       .targetsize     = sizeof(struct ip_nat_multi_range_compat),
+       .table          = "nat",
+       .hooks          = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_POST_ROUTING) |
+                         (1 << NF_IP_LOCAL_OUT),
        .checkentry     = check,
        .me             = THIS_MODULE 
 };

diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 140be51..cc165e0 100644 (file)
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -40,18 +40,6 @@ redirect_check(const char *tablename,
 {
        const struct ip_nat_multi_range_compat *mr = targinfo;
 
-       if (strcmp(tablename, "nat") != 0) {
-               DEBUGP("redirect_check: bad table `%s'.\n", table);
-               return 0;
-       }
-       if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
-               DEBUGP("redirect_check: size %u.\n", targinfosize);
-               return 0;
-       }
-       if (hook_mask & ~((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))) {
-               DEBUGP("redirect_check: bad hooks %x.\n", hook_mask);
-               return 0;
-       }
        if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
                DEBUGP("redirect_check: bad MAP_IPS.\n");
                return 0;
@@ -115,6 +103,9 @@ redirect_target(struct sk_buff **pskb,
 static struct ipt_target redirect_reg = {
        .name           = "REDIRECT",
        .target         = redirect_target,
+       .targetsize     = sizeof(struct ip_nat_multi_range_compat),
+       .table          = "nat",
+       .hooks          = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT),
        .checkentry     = redirect_check,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 3eb47aa..ddd6bd1 100644 (file)
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -290,23 +290,6 @@ static int check(const char *tablename,
        const struct ipt_reject_info *rejinfo = targinfo;
        const struct ipt_entry *e = e_void;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_reject_info))) {
-               DEBUGP("REJECT: targinfosize %u != 0\n", targinfosize);
-               return 0;
-       }
-
-       /* Only allow these for packet filtering. */
-       if (strcmp(tablename, "filter") != 0) {
-               DEBUGP("REJECT: bad table `%s'.\n", tablename);
-               return 0;
-       }
-       if ((hook_mask & ~((1 << NF_IP_LOCAL_IN)
-                          | (1 << NF_IP_FORWARD)
-                          | (1 << NF_IP_LOCAL_OUT))) != 0) {
-               DEBUGP("REJECT: bad hook mask %X\n", hook_mask);
-               return 0;
-       }
-
        if (rejinfo->with == IPT_ICMP_ECHOREPLY) {
                printk("REJECT: ECHOREPLY no longer supported.\n");
                return 0;
@@ -318,13 +301,16 @@ static int check(const char *tablename,
                        return 0;
                }
        }
-
        return 1;
 }
 
 static struct ipt_target ipt_reject_reg = {
        .name           = "REJECT",
        .target         = reject,
+       .targetsize     = sizeof(struct ipt_reject_info),
+       .table          = "filter",
+       .hooks          = (1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) |
+                         (1 << NF_IP_LOCAL_OUT),
        .checkentry     = check,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_SAME.c b/net/ipv4/netfilter/ipt_SAME.c
index a22de59..8743c3a 100644 (file)
--- a/net/ipv4/netfilter/ipt_SAME.c
+++ b/net/ipv4/netfilter/ipt_SAME.c
@@ -59,18 +59,6 @@ same_check(const char *tablename,
 
        mr->ipnum = 0;
 
-       if (strcmp(tablename, "nat") != 0) {
-               DEBUGP("same_check: bad table `%s'.\n", tablename);
-               return 0;
-       }
-       if (targinfosize != IPT_ALIGN(sizeof(*mr))) {
-               DEBUGP("same_check: size %u.\n", targinfosize);
-               return 0;
-       }
-       if (hook_mask & ~(1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING)) {
-               DEBUGP("same_check: bad hooks %x.\n", hook_mask);
-               return 0;
-       }
        if (mr->rangesize < 1) {
                DEBUGP("same_check: need at least one dest range.\n");
                return 0;
@@ -191,6 +179,9 @@ same_target(struct sk_buff **pskb,
 static struct ipt_target same_reg = { 
        .name           = "SAME",
        .target         = same_target,
+       .targetsize     = sizeof(struct ipt_same_info),
+       .table          = "nat",
+       .hooks          = (1 << NF_IP_PRE_ROUTING | 1 << NF_IP_POST_ROUTING),
        .checkentry     = same_check,
        .destroy        = same_destroy,
        .me             = THIS_MODULE,

diff --git a/net/ipv4/netfilter/ipt_TCPMSS.c b/net/ipv4/netfilter/ipt_TCPMSS.c
index c122841..4be6e2b 100644 (file)
--- a/net/ipv4/netfilter/ipt_TCPMSS.c
+++ b/net/ipv4/netfilter/ipt_TCPMSS.c
@@ -218,13 +218,6 @@ ipt_tcpmss_checkentry(const char *tablename,
        const struct ipt_tcpmss_info *tcpmssinfo = targinfo;
        const struct ipt_entry *e = e_void;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_tcpmss_info))) {
-               DEBUGP("ipt_tcpmss_checkentry: targinfosize %u != %u\n",
-                      targinfosize, IPT_ALIGN(sizeof(struct ipt_tcpmss_info)));
-               return 0;
-       }
-
-
        if((tcpmssinfo->mss == IPT_TCPMSS_CLAMP_PMTU) && 
                        ((hook_mask & ~((1 << NF_IP_FORWARD)
                                | (1 << NF_IP_LOCAL_OUT)
@@ -233,11 +226,8 @@ ipt_tcpmss_checkentry(const char *tablename,
                return 0;
        }
 
-       if (e->ip.proto == IPPROTO_TCP
-           && !(e->ip.invflags & IPT_INV_PROTO)
-           && IPT_MATCH_ITERATE(e, find_syn_match))
+       if (IPT_MATCH_ITERATE(e, find_syn_match))
                return 1;
-
        printk("TCPMSS: Only works on TCP SYN packets\n");
        return 0;
 }
@@ -245,6 +235,8 @@ ipt_tcpmss_checkentry(const char *tablename,
 static struct ipt_target ipt_tcpmss_reg = {
        .name           = "TCPMSS",
        .target         = ipt_tcpmss_target,
+       .targetsize     = sizeof(struct ipt_tcpmss_info),
+       .proto          = IPPROTO_TCP,
        .checkentry     = ipt_tcpmss_checkentry,
        .me             = THIS_MODULE,
 };

diff --git a/net/ipv4/netfilter/ipt_TOS.c b/net/ipv4/netfilter/ipt_TOS.c
index 3a44a56..6568e3e 100644 (file)
--- a/net/ipv4/netfilter/ipt_TOS.c
+++ b/net/ipv4/netfilter/ipt_TOS.c
@@ -59,18 +59,6 @@ checkentry(const char *tablename,
 {
        const u_int8_t tos = ((struct ipt_tos_target_info *)targinfo)->tos;
 
-       if (targinfosize != IPT_ALIGN(sizeof(struct ipt_tos_target_info))) {
-               printk(KERN_WARNING "TOS: targinfosize %u != %Zu\n",
-                      targinfosize,
-                      IPT_ALIGN(sizeof(struct ipt_tos_target_info)));
-               return 0;
-       }
-
-       if (strcmp(tablename, "mangle") != 0) {
-               printk(KERN_WARNING "TOS: can only be called from \"mangle\" table, not \"%s\"\n", tablename);
-               return 0;
-       }
-
        if (tos != IPTOS_LOWDELAY
            && tos != IPTOS_THROUGHPUT
            && tos != IPTOS_RELIABILITY
@@ -79,13 +67,14 @@ checkentry(const char *tablename,
                printk(KERN_WARNING "TOS: bad tos value %#x\n", tos);
                return 0;
        }
-
        return 1;
 }
 
 static struct ipt_target ipt_tos_reg = {
        .name           = "TOS",
        .target         = target,
+       .targetsize     = sizeof(struct ipt_tos_target_info),
+       .table          = "mangle",
        .checkentry     = checkentry,
        .me             = THIS_MODULE,
 };

diff --cc net/ipv4/netfilter/ipt_TTL.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_ULOG.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_addrtype.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_ah.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_dscp.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_ecn.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_esp.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_hashlimit.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_iprange.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_multiport.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_owner.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_policy.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_recent.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_tos.c
Simple merge

diff --cc net/ipv4/netfilter/ipt_ttl.c
Simple merge