Skip to contentSkip to conversation

netfilter: fix arptable_filter wrong hook registering

PATCH Applied Pablo Neira Ayuso 3 participants 15 messages Oct 16, 2008 – Oct 20, 2008

Subsystems (7)
Networking netfilter SELinux security module IPv4/IPv6 +3 more subsystems
lore
Share & tools
lore

Pablo Neira Ayuso

author maintainer
#0 lore raw

PATCH 1/1 netfilter: fix arptable_filter wrong hook registering

This patch replaces NFPROTO_ARP by NF_ARP in the hooks registered by arptable_filter, otherwise the arptables tool does not work. Thus, we use NF_ARP to register ARP hooks to match the NF_HOOK invocation in net/ipv4/arp.c and NFPROTO_ARP for internal xtables handling, ie. matches, targets and tables.

This patch also fixes the ARP mangling in the ipt_CLUSTERIP target.

Signed-off-by Pablo Neira Ayuso <[email protected]>

---

 net/ipv4/netfilter/arptable_filter.c |    6 +++---
 net/ipv4/netfilter/ipt_CLUSTERIP.c   |    2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)
net/ipv4/netfilter/arptable_filter.c +3 -3
index bee3d11..984d05d 100644
@@ -89,21 +89,21 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = {
 	{
 		.hook		= arpt_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= NFPROTO_ARP,
+		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_IN,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
 		.hook		= arpt_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= NFPROTO_ARP,
+		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_OUT,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
 		.hook		= arpt_forward_hook,
 		.owner		= THIS_MODULE,
-		.pf		= NFPROTO_ARP,
+		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_FORWARD,
 		.priority	= NF_IP_PRI_FILTER,
 	},
net/ipv4/netfilter/ipt_CLUSTERIP.c +1 -1
index 7ac1677..af8b1bb 100644
@@ -541,7 +541,7 @@ arp_mangle(unsigned int hook,
 
 static struct nf_hook_ops cip_arp_ops __read_mostly = {
 	.hook = arp_mangle,
-	.pf = NFPROTO_ARP,
+	.pf = NF_ARP,
 	.hooknum = NF_ARP_OUT,
 	.priority = -1
 };
#1 lore raw
Quoted 5 lines · Pablo Neira Ayuso

This patch replaces NFPROTO_ARP by NF_ARP in the hooks registered by arptable_filter, otherwise the arptables tool does not work. Thus, we use NF_ARP to register ARP hooks to match the NF_HOOK invocation in net/ipv4/arp.c and NFPROTO_ARP for internal xtables handling, ie. matches, targets and tables.

This does not fly. You are essentially trying to register arpt_in_hook for NFPROTO_UNSPEC, since NF_ARP == 0, and 0 == NFPROTO_UNSPEC.

Define "does not work". Do you mean arptables sees no packets? Perhaps the following helps?

commit 60318cc486d15253b5ffc39b662a329f7e8f73b4

Author: Jan Engelhardt <[email protected]>
Date:   Wed Oct 15 21:31:21 2008 -0400

netfilter: replace old NF_ARP calls with NFPROTO_ARP

(Supplements: ee999d8b9573df1b547aacdc6d79f86eb79c25cd)

NFPROTO_ARP actually has a different value from NF_ARP, so ensure all callers use the new value so that packets _do_ get delivered to the registered hooks.

Signed-off-by Jan Engelhardt <[email protected]>
---
 net/bridge/br_netfilter.c  |    2 +-
 net/ipv4/arp.c             |    4 ++--
 net/netfilter/xt_NFQUEUE.c |    2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)
net/bridge/br_netfilter.c +1 -1
index a4abed5..fa5cda4 100644
@@ -719,7 +719,7 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
 		return NF_ACCEPT;
 	}
 	*d = (struct net_device *)in;
-	NF_HOOK(NF_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
+	NF_HOOK(NFPROTO_ARP, NF_ARP_FORWARD, skb, (struct net_device *)in,
 		(struct net_device *)out, br_nf_forward_finish);
 
 	return NF_STOLEN;
net/ipv4/arp.c +2 -2
index b043eda..1a9dd66 100644
@@ -663,7 +663,7 @@ out:
 void arp_xmit(struct sk_buff *skb)
 {
 	/* Send it off, maybe filter it using firewalling first.  */
-	NF_HOOK(NF_ARP, NF_ARP_OUT, skb, NULL, skb->dev, dev_queue_xmit);
+	NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, skb, NULL, skb->dev, dev_queue_xmit);
 }
 
 /*

@@ -928,7 +928,7 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
 
 	memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
 
-	return NF_HOOK(NF_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
+	return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
 
 freeskb:
 	kfree_skb(skb);
net/netfilter/xt_NFQUEUE.c +1 -1
index 2cc1fff..f9977b3 100644
@@ -48,7 +48,7 @@ static struct xt_target nfqueue_tg_reg[] __read_mostly = {
 	},
 	{
 		.name		= "NFQUEUE",
-		.family		= NF_ARP,
+		.family		= NFPROTO_ARP,
 		.target		= nfqueue_tg,
 		.targetsize	= sizeof(struct xt_NFQ_info),
 		.me		= THIS_MODULE,
author maintainer
#2 lore raw
Quoted 11 lines · Jan Engelhardt
Quoted 5 lines · Pablo Neira Ayuso

This patch replaces NFPROTO_ARP by NF_ARP in the hooks registered by arptable_filter, otherwise the arptables tool does not work. Thus, we use NF_ARP to register ARP hooks to match the NF_HOOK invocation in net/ipv4/arp.c and NFPROTO_ARP for internal xtables handling, ie. matches, targets and tables.

This does not fly. You are essentially trying to register arpt_in_hook for NFPROTO_UNSPEC, since NF_ARP == 0, and 0 == NFPROTO_UNSPEC.

This flies like a Boeing(R) 777 buddy ;). As the NFPROTO_* thing is only internal used by xtables, not by the hooks. The hooks use the protocol family, and we've been using NF_ARP to 0 by now.

Quoted 1 line

Define "does not work". Do you mean arptables sees no packets?

arptables sees *no packet at all*.

The ARP mangling does not work. Try:

arptables -o eth0 -l 6 -I OUTPUT -j mangle --mangle-mac-s 00:15:58:28:5a:30

and tcpdump the arp request.

Quoted 1 line

Perhaps the following helps?

Yes, your patch will also work, but it introduces an inconsistency in the naming used to register hooks in the family field.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
#3 lore raw
Quoted 23 lines · Pablo Neira Ayuso
Quoted 11 lines · Jan Engelhardt
Quoted 5 lines · Pablo Neira Ayuso

This patch replaces NFPROTO_ARP by NF_ARP in the hooks registered by arptable_filter, otherwise the arptables tool does not work. Thus, we use NF_ARP to register ARP hooks to match the NF_HOOK invocation in net/ipv4/arp.c and NFPROTO_ARP for internal xtables handling, ie. matches, targets and tables.

This does not fly. You are essentially trying to register arpt_in_hook for NFPROTO_UNSPEC, since NF_ARP == 0, and 0 == NFPROTO_UNSPEC.

This flies like a Boeing(R) 777 buddy ;). As the NFPROTO_* thing is only internal used by xtables, not by the hooks. The hooks use the protocol family, and we've been using NF_ARP to 0 by now.

Quoted 1 line

Define "does not work". Do you mean arptables sees no packets?

arptables sees *no packet at all*.

The ARP mangling does not work. Try:

Quoted 8 lines

arptables -o eth0 -l 6 -I OUTPUT -j mangle --mangle-mac-s 00:15:58:28:5a:30

and tcpdump the arp request.

Quoted 1 line

Perhaps the following helps?

Yes, your patch will also work, but it introduces an inconsistency in the naming used to register hooks in the family field.

No, not really. Netfilter Hooks are supposed to register with
.pf = NFPROTO_FOO
instead of
.pf = PF_FOO
because the nf_hooks list itself is indexed by nfproto numbers, not PF numbers:

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;

(The fact that there's still PF_ in the source is merely historical, and as you see, PF_foo == NFPROTO_foo for that exact reason.)

author maintainer
#4 lore raw
Quoted 11 lines · Jan Engelhardt
Quoted 3 lines
Quoted 1 line

Perhaps the following helps?

Yes, your patch will also work, but it introduces an inconsistency in the naming used to register hooks in the family field.

No, not really. Netfilter Hooks are supposed to register with
.pf = NFPROTO_FOO
instead of
.pf = PF_FOO
because the nf_hooks list itself is indexed by nfproto numbers, not PF numbers:

Quoted 4 lines

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;

(The fact that there's still PF_ in the source is merely historical, and as you see, PF_foo == NFPROTO_foo for that exact reason.)

This makes sense, but then I think that a cleanup for all the NF_HOOK calls in the net code to use NFPROTO_* instead of the family would be interesting for consistency.

BTW, I think that the last chunk of your patch should be a different one since it fixes NFQUEUE for arptables.

I don't mind about using your patch or mine, both works. Let's fix it, that's all. Patrick, I leave this up to you.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
#5 lore raw
In reply to Jan Engelhardt
Quoted 13 lines · Jan Engelhardt
Quoted 3 lines · Pablo Neira Ayuso
Quoted 1 line

Perhaps the following helps?

Yes, your patch will also work, but it introduces an inconsistency in the naming used to register hooks in the family field.

No, not really. Netfilter Hooks are supposed to register with
.pf = NFPROTO_FOO
instead of
.pf = PF_FOO
because the nf_hooks list itself is indexed by nfproto numbers, not PF numbers:

Quoted 4 lines

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;

(The fact that there's still PF_ in the source is merely historical, and as you see, PF_foo == NFPROTO_foo for that exact reason.)

I agree with Jan on this one, there doesn't seem to be a reason for not using the NFPROTO constants consistently.

author maintainer
#6 lore raw
Quoted 14 lines · Patrick McHardy
Quoted 13 lines · Jan Engelhardt
Quoted 3 lines · Pablo Neira Ayuso
Quoted 1 line

Perhaps the following helps?

Yes, your patch will also work, but it introduces an inconsistency in the naming used to register hooks in the family field.

No, not really. Netfilter Hooks are supposed to register with
.pf = NFPROTO_FOO
instead of
.pf = PF_FOO
because the nf_hooks list itself is indexed by nfproto numbers, not PF numbers:

Quoted 6 lines
Quoted 3 lines

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly; (The fact that there's still PF_ in the source is merely historical, and as you see, PF_foo == NFPROTO_foo for that exact reason.)

I agree with Jan on this one, there doesn't seem to be a reason for not using the NFPROTO constants consistently.

OK, then I think that it would make sense a minor cleanup for all the NF_HOOK to use NFPROTO_*? We can do this later.

BTW, why are we using NFPROTO_ARP to 3? Just a convention I guess.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
#7 lore raw
Quoted 14 lines · Pablo Neira Ayuso
Quoted 13 lines · Patrick McHardy
Quoted 12 lines · Jan Engelhardt
Quoted 3 lines · Pablo Neira Ayuso
Quoted 1 line

Perhaps the following helps?

Yes, your patch will also work, but it introduces an inconsistency in the naming used to register hooks in the family field.

No, not really. Netfilter Hooks are supposed to register with
.pf = NFPROTO_FOO
instead of
.pf = PF_FOO
because the nf_hooks list itself is indexed by nfproto numbers, not PF numbers:

Quoted 8 lines
Quoted 5 lines
Quoted 3 lines

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly; (The fact that there's still PF_ in the source is merely historical, and as you see, PF_foo == NFPROTO_foo for that exact reason.)

I agree with Jan on this one, there doesn't seem to be a reason for not using the NFPROTO constants consistently.

OK, then I think that it would make sense a minor cleanup for all the NF_HOOK to use NFPROTO_*? We can do this later.

Agreed. For now its only necessary for ARP though if I'm not mistaken.

Quoted 1 line

BTW, why are we using NFPROTO_ARP to 3? Just a convention I guess.

No specific reason AFAIK.

#8 lore raw
In reply to Pablo Neira Ayuso
Quoted 10 lines · Pablo Neira Ayuso
Quoted 7 lines
Quoted 4 lines

struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly; (The fact that there's still PF_ in the source is merely historical, and as you see, PF_foo == NFPROTO_foo for that exact reason.)

I agree with Jan on this one, there doesn't seem to be a reason for not using the NFPROTO constants consistently.

OK, then I think that it would make sense a minor cleanup for all the NF_HOOK to use NFPROTO_*? We can do this later.

Better now than later! Patch is coming as replies. The one I submitted earlier (
http://marc.info/?l=netfilter-devel&m=122412130603479&w=2 ) should remain separate IMO for it fixes a real bug that exists for a few revisions in the git tree, while the rest is just constant name conversion.

Quoted 1 line

BTW, why are we using NFPROTO_ARP to 3? Just a convention I guess.

The only requirement was that it not be 0 (because that maps to NFPROTO_UNSPEC which needs compat'ed to PF_UNSPEC - which is also 0). 3 was just a random choice, I picked it for its proximity to IPV4.

#9 lore raw

netfilter: use NFPROTO_* constants in NF_HOOK callsites

commit cc3e81cbbc8a6977cfe614286de16020f9efa3c6

Author: Jan Engelhardt <[email protected]>
Date:   Fri Oct 17 10:02:30 2008 -0400

netfilter: use NFPROTO_* constants in NF_HOOK callsites

Signed-off-by Jan Engelhardt <[email protected]>
---
 net/bridge/br_forward.c                 |    6 ++--
 net/bridge/br_input.c                   |    6 ++--
 net/bridge/br_netfilter.c               |   14 ++++++------
 net/bridge/br_stp_bpdu.c                |    2 +-
 net/decnet/dn_neigh.c                   |    9 +++++--
 net/decnet/dn_nsp_in.c                  |    3 +-
 net/decnet/dn_route.c                   |   27 ++++++++++++++++------
 net/ipv4/ip_forward.c                   |    4 +-
 net/ipv4/ip_input.c                     |    4 +-
 net/ipv4/ip_output.c                    |    8 +++---
 net/ipv4/ipmr.c                         |    2 +-
 net/ipv4/raw.c                          |    4 +-
 net/ipv4/xfrm4_input.c                  |    2 +-
 net/ipv6/ip6_input.c                    |    4 +-
 net/ipv6/ip6_output.c                   |   12 +++++-----
 net/ipv6/ip6mr.c                        |    2 +-
 net/ipv6/mcast.c                        |    4 +-
 net/ipv6/ndisc.c                        |    4 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c |    2 +-
 net/ipv6/raw.c                          |    4 +-
 net/ipv6/xfrm6_input.c                  |    2 +-
 net/ipv6/xfrm6_output.c                 |    4 +-
 net/netfilter/ipvs/ip_vs_xmit.c         |   16 ++++++------
 23 files changed, 80 insertions(+), 65 deletions(-)
net/bridge/br_forward.c +3 -3
index bdd9cce..a69e565 100644
@@ -51,7 +51,7 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
 
 int br_forward_finish(struct sk_buff *skb)
 {
-	return NF_HOOK(PF_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
+	return NF_HOOK(NFPROTO_BRIDGE, NF_BR_POST_ROUTING, skb, NULL, skb->dev,
 		       br_dev_queue_push_xmit);
 
 }

@@ -59,7 +59,7 @@ int br_forward_finish(struct sk_buff *skb)
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
 	skb->dev = to->dev;
-	NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 			br_forward_finish);
 }
 

@@ -71,7 +71,7 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 	skb->dev = to->dev;
 	skb_forward_csum(skb);
 
-	NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
+	NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, indev, skb->dev,
 			br_forward_finish);
 }
net/bridge/br_input.c +3 -3
index 30b8877..9eba95b 100644
@@ -30,7 +30,7 @@ static void br_pass_frame_up(struct net_bridge *br, struct sk_buff *skb)
 	indev = skb->dev;
 	skb->dev = brdev;
 
-	NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
+	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, indev, NULL,
 		netif_receive_skb);
 }
 

@@ -134,7 +134,7 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
 		if (skb->protocol == htons(ETH_P_PAUSE))
 			goto drop;
 
-		if (NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
+		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, skb, skb->dev,
 			    NULL, br_handle_local_finish))
 			return NULL;	/* frame consumed by filter */
 		else

@@ -154,7 +154,7 @@ struct sk_buff *br_handle_frame(struct net_bridge_port *p, struct sk_buff *skb)
 		if (!compare_ether_addr(p->br->dev->dev_addr, dest))
 			skb->pkt_type = PACKET_HOST;
 
-		NF_HOOK(PF_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
+		NF_HOOK(NFPROTO_BRIDGE, NF_BR_PRE_ROUTING, skb, skb->dev, NULL,
 			br_handle_frame_finish);
 		break;
 	default:
net/bridge/br_netfilter.c +7 -7
index fa5cda4..13e8cb3 100644
@@ -519,7 +519,7 @@ static unsigned int br_nf_pre_routing_ipv6(unsigned int hook,
 	if (!setup_pre_routing(skb))
 		return NF_DROP;
 
-	NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
 		br_nf_pre_routing_finish_ipv6);
 
 	return NF_STOLEN;

@@ -592,7 +592,7 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff *skb,
 		return NF_DROP;
 	store_orig_dstaddr(skb);
 
-	NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+	NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
 		br_nf_pre_routing_finish);
 
 	return NF_STOLEN;

@@ -673,9 +673,9 @@ static unsigned int br_nf_forward_ip(unsigned int hook, struct sk_buff *skb,
 
 	if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
 	    IS_PPPOE_IP(skb))
-		pf = PF_INET;
+		pf = NFPROTO_IPV4;
 	else
-		pf = PF_INET6;
+		pf = NFPROTO_IPV6;
 
 	nf_bridge_pull_encap_header(skb);
 

@@ -768,7 +768,7 @@ static unsigned int br_nf_local_out(unsigned int hook, struct sk_buff *skb,
 	}
 	nf_bridge_push_encap_header(skb);
 
-	NF_HOOK(PF_BRIDGE, NF_BR_FORWARD, skb, realindev, skb->dev,
+	NF_HOOK(NFPROTO_BRIDGE, NF_BR_FORWARD, skb, realindev, skb->dev,
 		br_forward_finish);
 	return NF_STOLEN;
 }

@@ -815,9 +815,9 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff *skb,
 
 	if (skb->protocol == htons(ETH_P_IP) || IS_VLAN_IP(skb) ||
 	    IS_PPPOE_IP(skb))
-		pf = PF_INET;
+		pf = NFPROTO_IPV4;
 	else
-		pf = PF_INET6;
+		pf = NFPROTO_IPV6;
 
 #ifdef CONFIG_NETFILTER_DEBUG
 	if (skb->dst == NULL) {
net/bridge/br_stp_bpdu.c +1 -1
index 81ae40b..11b0157 100644
@@ -49,7 +49,7 @@ static void br_send_bpdu(struct net_bridge_port *p,
 
 	llc_mac_hdr_init(skb, p->dev->dev_addr, p->br->group_addr);
 
-	NF_HOOK(PF_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
+	NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
 		dev_queue_xmit);
 }
net/decnet/dn_neigh.c +6 -3
index 1ca13b1..3ded3d5 100644
@@ -265,7 +265,8 @@ static int dn_long_output(struct sk_buff *skb)
 
 	skb_reset_network_header(skb);
 
-	return NF_HOOK(PF_DECnet, NF_DN_POST_ROUTING, skb, NULL, neigh->dev, dn_neigh_output_packet);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_POST_ROUTING, skb, NULL,
+	       neigh->dev, dn_neigh_output_packet);
 }
 
 static int dn_short_output(struct sk_buff *skb)

@@ -304,7 +305,8 @@ static int dn_short_output(struct sk_buff *skb)
 
 	skb_reset_network_header(skb);
 
-	return NF_HOOK(PF_DECnet, NF_DN_POST_ROUTING, skb, NULL, neigh->dev, dn_neigh_output_packet);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_POST_ROUTING, skb, NULL,
+	       neigh->dev, dn_neigh_output_packet);
 }
 
 /*

@@ -346,7 +348,8 @@ static int dn_phase3_output(struct sk_buff *skb)
 
 	skb_reset_network_header(skb);
 
-	return NF_HOOK(PF_DECnet, NF_DN_POST_ROUTING, skb, NULL, neigh->dev, dn_neigh_output_packet);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_POST_ROUTING, skb, NULL,
+	       neigh->dev, dn_neigh_output_packet);
 }
 
 /*
net/decnet/dn_nsp_in.c +2 -1
index 4074a6e..40b9cdf 100644
@@ -816,7 +816,8 @@ free_out:
 
 int dn_nsp_rx(struct sk_buff *skb)
 {
-	return NF_HOOK(PF_DECnet, NF_DN_LOCAL_IN, skb, skb->dev, NULL, dn_nsp_rx_packet);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_LOCAL_IN, skb, skb->dev, NULL,
+	       dn_nsp_rx_packet);
 }
 
 /*
net/decnet/dn_route.c +19 -8
index 821bd1c..7b28758 100644
@@ -522,7 +522,8 @@ static int dn_route_rx_long(struct sk_buff *skb)
 	ptr++;
 	cb->hops = *ptr++; /* Visit Count */
 
-	return NF_HOOK(PF_DECnet, NF_DN_PRE_ROUTING, skb, skb->dev, NULL, dn_route_rx_packet);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_PRE_ROUTING, skb, skb->dev, NULL,
+	       dn_route_rx_packet);
 
 drop_it:
 	kfree_skb(skb);

@@ -548,7 +549,8 @@ static int dn_route_rx_short(struct sk_buff *skb)
 	ptr += 2;
 	cb->hops = *ptr & 0x3f;
 
-	return NF_HOOK(PF_DECnet, NF_DN_PRE_ROUTING, skb, skb->dev, NULL, dn_route_rx_packet);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_PRE_ROUTING, skb, skb->dev, NULL,
+	       dn_route_rx_packet);
 
 drop_it:
 	kfree_skb(skb);

@@ -650,16 +652,23 @@ int dn_route_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type
 
 		switch(flags & DN_RT_CNTL_MSK) {
 			case DN_RT_PKT_HELO:
-				return NF_HOOK(PF_DECnet, NF_DN_HELLO, skb, skb->dev, NULL, dn_route_ptp_hello);
+				return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
+				       skb, skb->dev, NULL,
+				       dn_route_ptp_hello);
 
 			case DN_RT_PKT_L1RT:
 			case DN_RT_PKT_L2RT:
-				return NF_HOOK(PF_DECnet, NF_DN_ROUTE, skb, skb->dev, NULL, dn_route_discard);
+				return NF_HOOK(NFPROTO_DECNET, NF_DN_ROUTE,
+				       skb, skb->dev, NULL, dn_route_discard);
 			case DN_RT_PKT_ERTH:
-				return NF_HOOK(PF_DECnet, NF_DN_HELLO, skb, skb->dev, NULL, dn_neigh_router_hello);
+				return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
+				       skb, skb->dev, NULL,
+				       dn_neigh_router_hello);
 
 			case DN_RT_PKT_EEDH:
-				return NF_HOOK(PF_DECnet, NF_DN_HELLO, skb, skb->dev, NULL, dn_neigh_endnode_hello);
+				return NF_HOOK(NFPROTO_DECNET, NF_DN_HELLO,
+				       skb, skb->dev, NULL,
+				       dn_neigh_endnode_hello);
 		}
 	} else {
 		if (dn->parms.state != DN_DEV_S_RU)

@@ -708,7 +717,8 @@ static int dn_output(struct sk_buff *skb)
 	cb->rt_flags |= DN_RT_F_IE;
 	cb->hops = 0;
 
-	return NF_HOOK(PF_DECnet, NF_DN_LOCAL_OUT, skb, NULL, dev, neigh->output);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_LOCAL_OUT, skb, NULL, dev,
+	       neigh->output);
 
 error:
 	if (net_ratelimit())

@@ -757,7 +767,8 @@ static int dn_forward(struct sk_buff *skb)
 	if (rt->rt_flags & RTCF_DOREDIRECT)
 		cb->rt_flags |= DN_RT_F_IE;
 
-	return NF_HOOK(PF_DECnet, NF_DN_FORWARD, skb, dev, skb->dev, neigh->output);
+	return NF_HOOK(NFPROTO_DECNET, NF_DN_FORWARD, skb, dev, skb->dev,
+	       neigh->output);
 
 drop:
 	kfree_skb(skb);
net/ipv4/ip_forward.c +2 -2
index 450016b..31afcfd 100644
@@ -111,8 +111,8 @@ int ip_forward(struct sk_buff *skb)
 
 	skb->priority = rt_tos2priority(iph->tos);
 
-	return NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, rt->u.dst.dev,
-		       ip_forward_finish);
+	return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, skb, skb->dev,
+	       rt->u.dst.dev, ip_forward_finish);
 
 sr_failed:
 	/*
net/ipv4/ip_input.c +2 -2
index 861978a..791360c 100644
@@ -257,7 +257,7 @@ int ip_local_deliver(struct sk_buff *skb)
 			return 0;
 	}
 
-	return NF_HOOK(PF_INET, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
+	return NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
 		       ip_local_deliver_finish);
 }
 

@@ -431,7 +431,7 @@ int ip_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt,
 	/* Remove any debris in the socket control block */
 	memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
 
-	return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL,
+	return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, dev, NULL,
 		       ip_rcv_finish);
 
 inhdr_error:
net/ipv4/ip_output.c +4 -4
index d2a8f8b..798b91c 100644
@@ -269,8 +269,8 @@ int ip_mc_output(struct sk_buff *skb)
 		) {
 			struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
 			if (newskb)
-				NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb,
-					NULL, newskb->dev,
+				NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING,
+					newskb, NULL, newskb->dev,
 					ip_dev_loopback_xmit);
 		}
 

@@ -285,8 +285,8 @@ int ip_mc_output(struct sk_buff *skb)
 	if (rt->rt_flags&RTCF_BROADCAST) {
 		struct sk_buff *newskb = skb_clone(skb, GFP_ATOMIC);
 		if (newskb)
-			NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb, NULL,
-				newskb->dev, ip_dev_loopback_xmit);
+			NF_HOOK(NFPROTO_IPV4, NF_INET_POST_ROUTING, newskb,
+				NULL, newskb->dev, ip_dev_loopback_xmit);
 	}
 
 	return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
net/ipv4/ipmr.c +1 -1
index b42e082..5c0389a 100644
@@ -1282,7 +1282,7 @@ static void ipmr_queue_xmit(struct sk_buff *skb, struct mfc_cache *c, int vifi)
 	 * not mrouter) cannot join to more than one interface - it will
 	 * result in receiving multiple packets.
 	 */
-	NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, dev,
+	NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, skb, skb->dev, dev,
 		ipmr_forward_finish);
 	return;
net/ipv4/raw.c +2 -2
index cd97574..c5e36ce 100644
@@ -372,8 +372,8 @@ static int raw_send_hdrinc(struct sock *sk, void *from, size_t length,
 		icmp_out_count(net, ((struct icmphdr *)
 			skb_transport_header(skb))->type);
 
-	err = NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
-		      dst_output);
+	err = NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_OUT, skb, NULL,
+	      rt->u.dst.dev, dst_output);
 	if (err > 0)
 		err = inet->recverr ? net_xmit_errno(err) : 0;
 	if (err)
net/ipv4/xfrm4_input.c +1 -1
index 390dcb1..63b21ff 100644
@@ -60,7 +60,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
 	iph->tot_len = htons(skb->len);
 	ip_send_check(iph);
 
-	NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+	NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
 		xfrm4_rcv_encap_finish);
 	return 0;
 }
net/ipv6/ip6_input.c +2 -2
index 936f489..6cb5ac9 100644
@@ -140,7 +140,7 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
 	rcu_read_unlock();
 
-	return NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, dev, NULL,
+	return NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, dev, NULL,
 		       ip6_rcv_finish);
 err:
 	IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INHDRERRORS);

@@ -235,7 +235,7 @@ discard:
 
 int ip6_input(struct sk_buff *skb)
 {
-	return NF_HOOK(PF_INET6, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
+	return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_IN, skb, skb->dev, NULL,
 		       ip6_input_finish);
 }
net/ipv6/ip6_output.c +6 -6
index c77db0b..51f446d 100644
@@ -146,8 +146,8 @@ static int ip6_output2(struct sk_buff *skb)
 			   is not supported in any case.
 			 */
 			if (newskb)
-				NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, newskb,
-					NULL, newskb->dev,
+				NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING,
+					newskb, NULL, newskb->dev,
 					ip6_dev_loopback_xmit);
 
 			if (ipv6_hdr(skb)->hop_limit == 0) {

@@ -161,7 +161,7 @@ static int ip6_output2(struct sk_buff *skb)
 		IP6_INC_STATS(dev_net(dev), idev, IPSTATS_MIB_OUTMCASTPKTS);
 	}
 
-	return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
+	return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL, skb->dev,
 		       ip6_output_finish);
 }
 

@@ -276,8 +276,8 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
 	if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
 		IP6_INC_STATS(net, ip6_dst_idev(skb->dst),
 			      IPSTATS_MIB_OUTREQUESTS);
-		return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
-				dst_output);
+		return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
+		       dst->dev, dst_output);
 	}
 
 	if (net_ratelimit())

@@ -549,7 +549,7 @@ int ip6_forward(struct sk_buff *skb)
 	hdr->hop_limit--;
 
 	IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
-	return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
+	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
 		       ip6_forward_finish);
 
 error:
net/ipv6/ip6mr.c +1 -1
index 182f8a1..ee6d871 100644
@@ -1457,7 +1457,7 @@ static int ip6mr_forward2(struct sk_buff *skb, struct mfc6_cache *c, int vifi)
 
 	IP6CB(skb)->flags |= IP6SKB_FORWARDED;
 
-	return NF_HOOK(PF_INET6, NF_INET_FORWARD, skb, skb->dev, dev,
+	return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dev,
 		       ip6mr_forward2_finish);
 
 out_free:
net/ipv6/mcast.c +2 -2
index d7b3c6d..0afbdfa 100644
@@ -1470,7 +1470,7 @@ static void mld_sendpack(struct sk_buff *skb)
 	if (err)
 		goto err_out;
 
-	err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
+	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
 		      dst_output);
 out:
 	if (!err) {

@@ -1835,7 +1835,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 	if (err)
 		goto err_out;
 
-	err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
+	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
 		      dst_output);
 out:
 	if (!err) {
net/ipv6/ndisc.c +2 -2
index 840b157..9ba9db9 100644
@@ -518,7 +518,7 @@ static void __ndisc_send(struct net_device *dev,
 	idev = in6_dev_get(dst->dev);
 	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
 
-	err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
+	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
 		      dst_output);
 	if (!err) {
 		ICMP6MSGOUT_INC_STATS(net, idev, type);

@@ -1582,7 +1582,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 	buff->dst = dst;
 	idev = in6_dev_get(dst->dev);
 	IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTREQUESTS);
-	err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
+	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
 		      dst_output);
 	if (!err) {
 		ICMP6MSGOUT_INC_STATS(net, idev, NDISC_REDIRECT);
net/ipv6/netfilter/nf_conntrack_reasm.c +1 -1
index 9967ac7..afa1d4b 100644
@@ -652,7 +652,7 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb,
 		s2 = s->next;
 		s->next = NULL;
 
-		NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn,
+		NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, s, in, out, okfn,
 			       NF_IP6_PRI_CONNTRACK_DEFRAG + 1);
 		s = s2;
 	}
net/ipv6/raw.c +2 -2
index 2ba04d4..c918c9b 100644
@@ -639,8 +639,8 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
 		goto error_fault;
 
 	IP6_INC_STATS(sock_net(sk), rt->rt6i_idev, IPSTATS_MIB_OUTREQUESTS);
-	err = NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
-		      dst_output);
+	err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
+	      rt->u.dst.dev, dst_output);
 	if (err > 0)
 		err = np->recverr ? net_xmit_errno(err) : 0;
 	if (err)
net/ipv6/xfrm6_input.c +1 -1
index a71c7dd..7330b1d 100644
@@ -42,7 +42,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async)
 	ipv6_hdr(skb)->payload_len = htons(skb->len);
 	__skb_push(skb, skb->data - skb_network_header(skb));
 
-	NF_HOOK(PF_INET6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
+	NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,
 		ip6_rcv_finish);
 	return -1;
 }
net/ipv6/xfrm6_output.c +2 -2
index 0af823c..29dc224 100644
@@ -89,6 +89,6 @@ static int xfrm6_output_finish(struct sk_buff *skb)
 
 int xfrm6_output(struct sk_buff *skb)
 {
-	return NF_HOOK(PF_INET6, NF_INET_POST_ROUTING, skb, NULL, skb->dst->dev,
-		       xfrm6_output_finish);
+	return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
+	       skb->dst->dev, xfrm6_output_finish);
 }
net/netfilter/ipvs/ip_vs_xmit.c +8 -8
index 02ddc2b..e17c145 100644
@@ -268,7 +268,7 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV4, skb, rt);
 
 	LeaveFunction(10);
 	return NF_STOLEN;

@@ -332,7 +332,7 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET6, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV6, skb, rt);
 
 	LeaveFunction(10);
 	return NF_STOLEN;

@@ -408,7 +408,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV4, skb, rt);
 
 	LeaveFunction(10);
 	return NF_STOLEN;

@@ -484,7 +484,7 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET6, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV6, skb, rt);
 
 	LeaveFunction(10);
 	return NF_STOLEN;

@@ -782,7 +782,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV4, skb, rt);
 
 	LeaveFunction(10);
 	return NF_STOLEN;

@@ -835,7 +835,7 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET6, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV6, skb, rt);
 
 	LeaveFunction(10);
 	return NF_STOLEN;

@@ -909,7 +909,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV4, skb, rt);
 
 	rc = NF_STOLEN;
 	goto out;

@@ -984,7 +984,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 	/* Another hack: avoid icmp_send in ip_fragment */
 	skb->local_df = 1;
 
-	IP_VS_XMIT(PF_INET6, skb, rt);
+	IP_VS_XMIT(NFPROTO_IPV6, skb, rt);
 
 	rc = NF_STOLEN;
 	goto out;
#10 lore raw

Re: netfilter: use NFPROTO_* constants in NF_HOOK callsites

Quoted 5 lines · Jan Engelhardt

commit cc3e81cbbc8a6977cfe614286de16020f9efa3c6

Author: Jan Engelhardt <[email protected]>
Date:   Fri Oct 17 10:02:30 2008 -0400

netfilter: use NFPROTO_* constants in NF_HOOK callsites

This is missing arp, the only place that would qualify as bugfix. Please resubmit and add a changelog that explains that is actually fixes something.

#11 lore raw

Re: netfilter: use NFPROTO_* constants in NF_HOOK callsites

Quoted 10 lines · Patrick McHardy
Quoted 5 lines · Jan Engelhardt

commit cc3e81cbbc8a6977cfe614286de16020f9efa3c6

Author: Jan Engelhardt <[email protected]>
Date:   Fri Oct 17 10:02:30 2008 -0400

netfilter: use NFPROTO_* constants in NF_HOOK callsites

This is missing arp, the only place that would qualify as bugfix. Please resubmit and add a changelog that explains that is actually fixes something.

I just did that! Or did you already delete the mail and marc is down?
http://marc.info/?l=netfilter-devel&m=122412130603479&w=2

author maintainer
#12 lore raw

Re: netfilter: use NFPROTO_* constants in NF_HOOK callsites

Quoted 7 lines · Jan Engelhardt
Quoted 5 lines · Patrick McHardy
Quoted 4 lines · Jan Engelhardt

commit cc3e81cbbc8a6977cfe614286de16020f9efa3c6

Author: Jan Engelhardt <[email protected]>
Date:   Fri Oct 17 10:02:30 2008 -0400
Quoted 8 lines
Quoted 4 lines
Quoted 1 line

netfilter: use NFPROTO_* constants in NF_HOOK callsites

This is missing arp, the only place that would qualify as bugfix. Please resubmit and add a changelog that explains that is actually fixes something.

I just did that! Or did you already delete the mail and marc is down?
http://marc.info/?l=netfilter-devel&m=122412130603479&w=2

I think that Patrick means that you have to merge both patches and include the changelog that *explicitly* states that this is not just a cleanup but a bugfix, otherwise it won't get into 2.6.27.

BTW, include the Reported-by tag. Ingo Molnar recently told us to do so in all of our patches. I don't care about credits but this is supposed to be "good practise" to encourage testers.

Signature · 1 line
"Los honestos son inadaptados sociales" -- Les Luthiers
#13 lore raw

netfilter: use NFPROTO_* constants in nf_hook_ops structures

In reply to Jan Engelhardt

commit 6f1807f67c1cb202096e03d1106e3dba06dd610d

Author: Jan Engelhardt <[email protected]>
Date:   Fri Oct 17 10:29:50 2008 -0400

netfilter: use NFPROTO_* constants in nf_hook_ops structures

Signed-off-by Jan Engelhardt <[email protected]>
---
 net/bridge/br_netfilter.c                      |   16 ++++++++--------
 net/bridge/netfilter/ebtable_filter.c          |    6 +++---
 net/bridge/netfilter/ebtable_nat.c             |    6 +++---
 net/decnet/netfilter/dn_rtmsg.c                |    2 +-
 net/ipv4/netfilter/iptable_filter.c            |    6 +++---
 net/ipv4/netfilter/iptable_mangle.c            |   10 +++++-----
 net/ipv4/netfilter/iptable_raw.c               |    4 ++--
 net/ipv4/netfilter/iptable_security.c          |    6 +++---
 net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c |    8 ++++----
 net/ipv4/netfilter/nf_defrag_ipv4.c            |    4 ++--
 net/ipv4/netfilter/nf_nat_standalone.c         |    8 ++++----
 net/ipv6/netfilter/ip6table_filter.c           |    6 +++---
 net/ipv6/netfilter/ip6table_mangle.c           |   10 +++++-----
 net/ipv6/netfilter/ip6table_raw.c              |    4 ++--
 net/ipv6/netfilter/ip6table_security.c         |    6 +++---
 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c |   12 ++++++------
 net/netfilter/ipvs/ip_vs_core.c                |   16 ++++++++--------
 security/selinux/hooks.c                       |   10 +++++-----
 18 files changed, 70 insertions(+), 70 deletions(-)
net/bridge/br_netfilter.c +8 -8
index 13e8cb3..1ace89e 100644
@@ -878,42 +878,42 @@ static unsigned int ip_sabotage_in(unsigned int hook, struct sk_buff *skb,
 static struct nf_hook_ops br_nf_ops[] __read_mostly = {
 	{ .hook = br_nf_pre_routing,
 	  .owner = THIS_MODULE,
-	  .pf = PF_BRIDGE,
+	  .pf = NFPROTO_BRIDGE,
 	  .hooknum = NF_BR_PRE_ROUTING,
 	  .priority = NF_BR_PRI_BRNF, },
 	{ .hook = br_nf_local_in,
 	  .owner = THIS_MODULE,
-	  .pf = PF_BRIDGE,
+	  .pf = NFPROTO_BRIDGE,
 	  .hooknum = NF_BR_LOCAL_IN,
 	  .priority = NF_BR_PRI_BRNF, },
 	{ .hook = br_nf_forward_ip,
 	  .owner = THIS_MODULE,
-	  .pf = PF_BRIDGE,
+	  .pf = NFPROTO_BRIDGE,
 	  .hooknum = NF_BR_FORWARD,
 	  .priority = NF_BR_PRI_BRNF - 1, },
 	{ .hook = br_nf_forward_arp,
 	  .owner = THIS_MODULE,
-	  .pf = PF_BRIDGE,
+	  .pf = NFPROTO_BRIDGE,
 	  .hooknum = NF_BR_FORWARD,
 	  .priority = NF_BR_PRI_BRNF, },
 	{ .hook = br_nf_local_out,
 	  .owner = THIS_MODULE,
-	  .pf = PF_BRIDGE,
+	  .pf = NFPROTO_BRIDGE,
 	  .hooknum = NF_BR_LOCAL_OUT,
 	  .priority = NF_BR_PRI_FIRST, },
 	{ .hook = br_nf_post_routing,
 	  .owner = THIS_MODULE,
-	  .pf = PF_BRIDGE,
+	  .pf = NFPROTO_BRIDGE,
 	  .hooknum = NF_BR_POST_ROUTING,
 	  .priority = NF_BR_PRI_LAST, },
 	{ .hook = ip_sabotage_in,
 	  .owner = THIS_MODULE,
-	  .pf = PF_INET,
+	  .pf = NFPROTO_IPV4,
 	  .hooknum = NF_INET_PRE_ROUTING,
 	  .priority = NF_IP_PRI_FIRST, },
 	{ .hook = ip_sabotage_in,
 	  .owner = THIS_MODULE,
-	  .pf = PF_INET6,
+	  .pf = NFPROTO_IPV6,
 	  .hooknum = NF_INET_PRE_ROUTING,
 	  .priority = NF_IP6_PRI_FIRST, },
 };
net/bridge/netfilter/ebtable_filter.c +3 -3
index 1a58af5..439f172 100644
@@ -71,21 +71,21 @@ static struct nf_hook_ops ebt_ops_filter[] __read_mostly = {
 	{
 		.hook		= ebt_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_BRIDGE,
+		.pf		= NFPROTO_BRIDGE,
 		.hooknum	= NF_BR_LOCAL_IN,
 		.priority	= NF_BR_PRI_FILTER_BRIDGED,
 	},
 	{
 		.hook		= ebt_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_BRIDGE,
+		.pf		= NFPROTO_BRIDGE,
 		.hooknum	= NF_BR_FORWARD,
 		.priority	= NF_BR_PRI_FILTER_BRIDGED,
 	},
 	{
 		.hook		= ebt_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_BRIDGE,
+		.pf		= NFPROTO_BRIDGE,
 		.hooknum	= NF_BR_LOCAL_OUT,
 		.priority	= NF_BR_PRI_FILTER_OTHER,
 	},
net/bridge/netfilter/ebtable_nat.c +3 -3
index f60c1e7..5f49fe4 100644
@@ -78,21 +78,21 @@ static struct nf_hook_ops ebt_ops_nat[] __read_mostly = {
 	{
 		.hook		= ebt_nat_dst,
 		.owner		= THIS_MODULE,
-		.pf		= PF_BRIDGE,
+		.pf		= NFPROTO_BRIDGE,
 		.hooknum	= NF_BR_LOCAL_OUT,
 		.priority	= NF_BR_PRI_NAT_DST_OTHER,
 	},
 	{
 		.hook		= ebt_nat_src,
 		.owner		= THIS_MODULE,
-		.pf		= PF_BRIDGE,
+		.pf		= NFPROTO_BRIDGE,
 		.hooknum	= NF_BR_POST_ROUTING,
 		.priority	= NF_BR_PRI_NAT_SRC,
 	},
 	{
 		.hook		= ebt_nat_dst,
 		.owner		= THIS_MODULE,
-		.pf		= PF_BRIDGE,
+		.pf		= NFPROTO_BRIDGE,
 		.hooknum	= NF_BR_PRE_ROUTING,
 		.priority	= NF_BR_PRI_NAT_DST_BRIDGED,
 	},
net/decnet/netfilter/dn_rtmsg.c +1 -1
index 6d2bd32..937ce4c 100644
@@ -117,7 +117,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb)
 
 static struct nf_hook_ops dnrmg_ops __read_mostly = {
 	.hook		= dnrmg_hook,
-	.pf		= PF_DECnet,
+	.pf		= NFPROTO_DECNET,
 	.hooknum	= NF_DN_ROUTE,
 	.priority	= NF_DN_PRI_DNRTMSG,
 };
net/ipv4/netfilter/iptable_filter.c +3 -3
index c922431..404b386 100644
@@ -108,21 +108,21 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
 	{
 		.hook		= ipt_local_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
 		.hook		= ipt_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_FORWARD,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
 		.hook		= ipt_local_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_FILTER,
 	},
net/ipv4/netfilter/iptable_mangle.c +5 -5
index 69f2c42..79a1c4d 100644
@@ -167,35 +167,35 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
 	{
 		.hook		= ipt_pre_routing_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_MANGLE,
 	},
 	{
 		.hook		= ipt_local_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_MANGLE,
 	},
 	{
 		.hook		= ipt_forward_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_FORWARD,
 		.priority	= NF_IP_PRI_MANGLE,
 	},
 	{
 		.hook		= ipt_local_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_MANGLE,
 	},
 	{
 		.hook		= ipt_post_routing_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP_PRI_MANGLE,
 	},
net/ipv4/netfilter/iptable_raw.c +2 -2
index 8faebfe..e9401e6 100644
@@ -79,14 +79,14 @@ ipt_local_hook(unsigned int hook,
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
 	{
 		.hook = ipt_hook,
-		.pf = PF_INET,
+		.pf = NFPROTO_IPV4,
 		.hooknum = NF_INET_PRE_ROUTING,
 		.priority = NF_IP_PRI_RAW,
 		.owner = THIS_MODULE,
 	},
 	{
 		.hook = ipt_local_hook,
-		.pf = PF_INET,
+		.pf = NFPROTO_IPV4,
 		.hooknum = NF_INET_LOCAL_OUT,
 		.priority = NF_IP_PRI_RAW,
 		.owner = THIS_MODULE,
net/ipv4/netfilter/iptable_security.c +3 -3
index 36f3be3..e120f33 100644
@@ -110,21 +110,21 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
 	{
 		.hook		= ipt_local_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_SECURITY,
 	},
 	{
 		.hook		= ipt_forward_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_FORWARD,
 		.priority	= NF_IP_PRI_SECURITY,
 	},
 	{
 		.hook		= ipt_local_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_SECURITY,
 	},
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +4 -4
index 4a7c352..47cfed1 100644
@@ -160,28 +160,28 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
 	{
 		.hook		= ipv4_conntrack_in,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_CONNTRACK,
 	},
 	{
 		.hook		= ipv4_conntrack_local,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_CONNTRACK,
 	},
 	{
 		.hook		= ipv4_confirm,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM,
 	},
 	{
 		.hook		= ipv4_confirm,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_CONNTRACK_CONFIRM,
 	},
net/ipv4/netfilter/nf_defrag_ipv4.c +2 -2
index aa2c50a..a19135f 100644
@@ -62,14 +62,14 @@ static struct nf_hook_ops ipv4_defrag_ops[] = {
 	{
 		.hook		= ipv4_conntrack_defrag,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_CONNTRACK_DEFRAG,
 	},
 	{
 		.hook           = ipv4_conntrack_defrag,
 		.owner          = THIS_MODULE,
-		.pf             = PF_INET,
+		.pf             = NFPROTO_IPV4,
 		.hooknum        = NF_INET_LOCAL_OUT,
 		.priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
 	},
net/ipv4/netfilter/nf_nat_standalone.c +4 -4
index b7dd695..56152ed 100644
@@ -252,7 +252,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
 	{
 		.hook		= nf_nat_in,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},

@@ -260,7 +260,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
 	{
 		.hook		= nf_nat_out,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP_PRI_NAT_SRC,
 	},

@@ -268,7 +268,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
 	{
 		.hook		= nf_nat_local_fn,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP_PRI_NAT_DST,
 	},

@@ -276,7 +276,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
 	{
 		.hook		= nf_nat_fn,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP_PRI_NAT_SRC,
 	},
net/ipv6/netfilter/ip6table_filter.c +3 -3
index b110a8a..e6b7309 100644
@@ -107,21 +107,21 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
 	{
 		.hook		= ip6t_local_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_FILTER,
 	},
 	{
 		.hook		= ip6t_forward_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_FORWARD,
 		.priority	= NF_IP6_PRI_FILTER,
 	},
 	{
 		.hook		= ip6t_local_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_FILTER,
 	},
net/ipv6/netfilter/ip6table_mangle.c +5 -5
index d0b31b2..2086054 100644
@@ -137,35 +137,35 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
 	{
 		.hook		= ip6t_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP6_PRI_MANGLE,
 	},
 	{
 		.hook		= ip6t_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_MANGLE,
 	},
 	{
 		.hook		= ip6t_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_FORWARD,
 		.priority	= NF_IP6_PRI_MANGLE,
 	},
 	{
 		.hook		= ip6t_local_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_MANGLE,
 	},
 	{
 		.hook		= ip6t_post_routing_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP6_PRI_MANGLE,
 	},
net/ipv6/netfilter/ip6table_raw.c +2 -2
index 109fab6..6e38627 100644
@@ -69,14 +69,14 @@ ip6t_local_out_hook(unsigned int hook,
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
 	{
 	  .hook = ip6t_pre_routing_hook,
-	  .pf = PF_INET6,
+	  .pf = NFPROTO_IPV6,
 	  .hooknum = NF_INET_PRE_ROUTING,
 	  .priority = NF_IP6_PRI_FIRST,
 	  .owner = THIS_MODULE,
 	},
 	{
 	  .hook = ip6t_local_out_hook,
-	  .pf = PF_INET6,
+	  .pf = NFPROTO_IPV6,
 	  .hooknum = NF_INET_LOCAL_OUT,
 	  .priority = NF_IP6_PRI_FIRST,
 	  .owner = THIS_MODULE,
net/ipv6/netfilter/ip6table_security.c +3 -3
index 20bc52f..cbee23f 100644
@@ -102,21 +102,21 @@ static struct nf_hook_ops ip6t_ops[] __read_mostly = {
 	{
 		.hook		= ip6t_local_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_SECURITY,
 	},
 	{
 		.hook		= ip6t_forward_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_FORWARD,
 		.priority	= NF_IP6_PRI_SECURITY,
 	},
 	{
 		.hook		= ip6t_local_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_SECURITY,
 	},
net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +6 -6
index e91db16..059a0a1 100644
@@ -265,42 +265,42 @@ static struct nf_hook_ops ipv6_conntrack_ops[] __read_mostly = {
 	{
 		.hook		= ipv6_defrag,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP6_PRI_CONNTRACK_DEFRAG,
 	},
 	{
 		.hook		= ipv6_conntrack_in,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_PRE_ROUTING,
 		.priority	= NF_IP6_PRI_CONNTRACK,
 	},
 	{
 		.hook		= ipv6_conntrack_local,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_CONNTRACK,
 	},
 	{
 		.hook		= ipv6_defrag,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_OUT,
 		.priority	= NF_IP6_PRI_CONNTRACK_DEFRAG,
 	},
 	{
 		.hook		= ipv6_confirm,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_POST_ROUTING,
 		.priority	= NF_IP6_PRI_LAST,
 	},
 	{
 		.hook		= ipv6_confirm,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum	= NF_INET_LOCAL_IN,
 		.priority	= NF_IP6_PRI_LAST-1,
 	},
net/netfilter/ipvs/ip_vs_core.c +8 -8
index 958abf3..49e712c 100644
@@ -1407,7 +1407,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_in,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum        = NF_INET_LOCAL_IN,
 		.priority       = 100,
 	},

@@ -1415,7 +1415,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_out,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum        = NF_INET_FORWARD,
 		.priority       = 100,
 	},

@@ -1424,7 +1424,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_forward_icmp,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum        = NF_INET_FORWARD,
 		.priority       = 99,
 	},

@@ -1432,7 +1432,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_post_routing,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET,
+		.pf		= NFPROTO_IPV4,
 		.hooknum        = NF_INET_POST_ROUTING,
 		.priority       = NF_IP_PRI_NAT_SRC-1,
 	},

@@ -1443,7 +1443,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_in,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum        = NF_INET_LOCAL_IN,
 		.priority       = 100,
 	},

@@ -1451,7 +1451,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_out,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum        = NF_INET_FORWARD,
 		.priority       = 100,
 	},

@@ -1460,7 +1460,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_forward_icmp_v6,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum        = NF_INET_FORWARD,
 		.priority       = 99,
 	},

@@ -1468,7 +1468,7 @@ static struct nf_hook_ops ip_vs_ops[] __read_mostly = {
 	{
 		.hook		= ip_vs_post_routing,
 		.owner		= THIS_MODULE,
-		.pf		= PF_INET6,
+		.pf		= NFPROTO_IPV6,
 		.hooknum        = NF_INET_POST_ROUTING,
 		.priority       = NF_IP6_PRI_NAT_SRC-1,
 	},
security/selinux/hooks.c +5 -5
index 576e511..b1e14cc 100644
@@ -5748,21 +5748,21 @@ static struct nf_hook_ops selinux_ipv4_ops[] = {
 	{
 		.hook =		selinux_ipv4_postroute,
 		.owner =	THIS_MODULE,
-		.pf =		PF_INET,
+		.pf =		NFPROTO_IPV4,
 		.hooknum =	NF_INET_POST_ROUTING,
 		.priority =	NF_IP_PRI_SELINUX_LAST,
 	},
 	{
 		.hook =		selinux_ipv4_forward,
 		.owner =	THIS_MODULE,
-		.pf =		PF_INET,
+		.pf =		NFPROTO_IPV4,
 		.hooknum =	NF_INET_FORWARD,
 		.priority =	NF_IP_PRI_SELINUX_FIRST,
 	},
 	{
 		.hook =		selinux_ipv4_output,
 		.owner =	THIS_MODULE,
-		.pf =		PF_INET,
+		.pf =		NFPROTO_IPV4,
 		.hooknum =	NF_INET_LOCAL_OUT,
 		.priority =	NF_IP_PRI_SELINUX_FIRST,
 	}

@@ -5774,14 +5774,14 @@ static struct nf_hook_ops selinux_ipv6_ops[] = {
 	{
 		.hook =		selinux_ipv6_postroute,
 		.owner =	THIS_MODULE,
-		.pf =		PF_INET6,
+		.pf =		NFPROTO_IPV6,
 		.hooknum =	NF_INET_POST_ROUTING,
 		.priority =	NF_IP6_PRI_SELINUX_LAST,
 	},
 	{
 		.hook =		selinux_ipv6_forward,
 		.owner =	THIS_MODULE,
-		.pf =		PF_INET6,
+		.pf =		NFPROTO_IPV6,
 		.hooknum =	NF_INET_FORWARD,
 		.priority =	NF_IP6_PRI_SELINUX_FIRST,
 	}
Applied
#14 lore raw
In reply to Jan Engelhardt
Quoted 11 lines · Jan Engelhardt

commit 60318cc486d15253b5ffc39b662a329f7e8f73b4

Author: Jan Engelhardt <[email protected]>
Date:   Wed Oct 15 21:31:21 2008 -0400

netfilter: replace old NF_ARP calls with NFPROTO_ARP

(Supplements: ee999d8b9573df1b547aacdc6d79f86eb79c25cd)

NFPROTO_ARP actually has a different value from NF_ARP, so ensure all callers use the new value so that packets _do_ get delivered to the registered hooks

Applied, thanks.