Merge branch 'nf-next' of git://1984.lsi.us.es/net-next

24 files changed, 278 insertions, 187 deletions

diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 46339ba7a2d3..799fc790b3cf 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -67,6 +67,7 @@ int fib_lookup(struct net *net, struct flowi4 *flp, struct fib_result *res)
 
         return err;
 }
+EXPORT_SYMBOL_GPL(fib_lookup);
 
 static int fib4_rule_action(struct fib_rule *rule, struct flowi *flp,
                             int flags, struct fib_lookup_arg *arg)
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 37b671185c81..d04b13ae18fe 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1607,6 +1607,7 @@ found:
         rcu_read_unlock();
         return ret;
 }
+EXPORT_SYMBOL_GPL(fib_table_lookup);
 
 /*
  * Remove the leaf and return parent.
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index f19f2182894c..7e1f5cdaf11e 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -82,6 +82,16 @@ config IP_NF_MATCH_ECN
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config IP_NF_MATCH_RPFILTER
+        tristate '"rpfilter" reverse path filter match support'
+        depends on NETFILTER_ADVANCED
+        ---help---
+          This option allows you to match packets whose replies would
+          go out via the interface the packet came in.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+          The module will be called ipt_rpfilter.
+
 config IP_NF_MATCH_TTL
         tristate '"ttl" match support'
         depends on NETFILTER_ADVANCED
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index dca2082ec683..123dd88cea53 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -50,6 +50,7 @@ obj-$(CONFIG_IP_NF_SECURITY) += iptable_security.o
 # matches
 obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
+obj-$(CONFIG_IP_NF_MATCH_RPFILTER) += ipt_rpfilter.o
 
 # targets
 obj-$(CONFIG_IP_NF_TARGET_CLUSTERIP) += ipt_CLUSTERIP.o
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
index 9931152a78b5..2f210c79dc87 100644
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -30,9 +30,9 @@ MODULE_DESCRIPTION("Xtables: automatic-address SNAT");
 /* FIXME: Multiple targets. --RR */
 static int masquerade_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
-        if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
+        if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
                 pr_debug("bad MAP_IPS.\n");
                 return -EINVAL;
         }
@@ -49,8 +49,8 @@ masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
         struct nf_conn *ct;
         struct nf_conn_nat *nat;
         enum ip_conntrack_info ctinfo;
-        struct nf_nat_range newrange;
-        const struct nf_nat_multi_range_compat *mr;
+        struct nf_nat_ipv4_range newrange;
+        const struct nf_nat_ipv4_multi_range_compat *mr;
         const struct rtable *rt;
         __be32 newsrc;
 
@@ -79,13 +79,13 @@ masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
         nat->masq_index = par->out->ifindex;
 
         /* Transfer from original range. */
-        newrange = ((struct nf_nat_range)
-                { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
+        newrange = ((struct nf_nat_ipv4_range)
+                { mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
                   newsrc, newsrc,
                   mr->range[0].min, mr->range[0].max });
 
         /* Hand modified range to generic setup. */
-        return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_SRC);
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
 }
 
 static int
@@ -139,7 +139,7 @@ static struct xt_target masquerade_tg_reg __read_mostly = {
         .name           = "MASQUERADE",
         .family         = NFPROTO_IPV4,
         .target         = masquerade_tg,
-        .targetsize     = sizeof(struct nf_nat_multi_range_compat),
+        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
         .table          = "nat",
         .hooks          = 1 << NF_INET_POST_ROUTING,
         .checkentry     = masquerade_tg_check,
diff --git a/net/ipv4/netfilter/ipt_NETMAP.c b/net/ipv4/netfilter/ipt_NETMAP.c
index 6cdb298f1035..b5bfbbabf70d 100644
--- a/net/ipv4/netfilter/ipt_NETMAP.c
+++ b/net/ipv4/netfilter/ipt_NETMAP.c
@@ -24,9 +24,9 @@ MODULE_DESCRIPTION("Xtables: 1:1 NAT mapping of IPv4 subnets");
 
 static int netmap_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
-        if (!(mr->range[0].flags & IP_NAT_RANGE_MAP_IPS)) {
+        if (!(mr->range[0].flags & NF_NAT_RANGE_MAP_IPS)) {
                 pr_debug("bad MAP_IPS.\n");
                 return -EINVAL;
         }
@@ -43,8 +43,8 @@ netmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         __be32 new_ip, netmask;
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_range newrange;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
+        struct nf_nat_ipv4_range newrange;
 
         NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
                      par->hooknum == NF_INET_POST_ROUTING ||
@@ -61,8 +61,8 @@ netmap_tg(struct sk_buff *skb, const struct xt_action_param *par)
                 new_ip = ip_hdr(skb)->saddr & ~netmask;
         new_ip |= mr->range[0].min_ip & netmask;
 
-        newrange = ((struct nf_nat_range)
-                { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
+        newrange = ((struct nf_nat_ipv4_range)
+                { mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
                   new_ip, new_ip,
                   mr->range[0].min, mr->range[0].max });
 
@@ -74,7 +74,7 @@ static struct xt_target netmap_tg_reg __read_mostly = {
         .name           = "NETMAP",
         .family         = NFPROTO_IPV4,
         .target         = netmap_tg,
-        .targetsize     = sizeof(struct nf_nat_multi_range_compat),
+        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
         .table          = "nat",
         .hooks          = (1 << NF_INET_PRE_ROUTING) |
                           (1 << NF_INET_POST_ROUTING) |
diff --git a/net/ipv4/netfilter/ipt_REDIRECT.c b/net/ipv4/netfilter/ipt_REDIRECT.c
index 18a0656505a0..7c0103a5203e 100644
--- a/net/ipv4/netfilter/ipt_REDIRECT.c
+++ b/net/ipv4/netfilter/ipt_REDIRECT.c
@@ -28,9 +28,9 @@ MODULE_DESCRIPTION("Xtables: Connection redirection to localhost");
 /* FIXME: Take multiple ranges --RR */
 static int redirect_tg_check(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
-        if (mr->range[0].flags & IP_NAT_RANGE_MAP_IPS) {
+        if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
                 pr_debug("bad MAP_IPS.\n");
                 return -EINVAL;
         }
@@ -47,8 +47,8 @@ redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
         __be32 newdst;
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
-        struct nf_nat_range newrange;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
+        struct nf_nat_ipv4_range newrange;
 
         NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
                      par->hooknum == NF_INET_LOCAL_OUT);
@@ -76,20 +76,20 @@ redirect_tg(struct sk_buff *skb, const struct xt_action_param *par)
         }
 
         /* Transfer from original range. */
-        newrange = ((struct nf_nat_range)
-                { mr->range[0].flags | IP_NAT_RANGE_MAP_IPS,
+        newrange = ((struct nf_nat_ipv4_range)
+                { mr->range[0].flags | NF_NAT_RANGE_MAP_IPS,
                   newdst, newdst,
                   mr->range[0].min, mr->range[0].max });
 
         /* Hand modified range to generic setup. */
-        return nf_nat_setup_info(ct, &newrange, IP_NAT_MANIP_DST);
+        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_DST);
 }
 
 static struct xt_target redirect_tg_reg __read_mostly = {
         .name           = "REDIRECT",
         .family         = NFPROTO_IPV4,
         .target         = redirect_tg,
-        .targetsize     = sizeof(struct nf_nat_multi_range_compat),
+        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
         .table          = "nat",
         .hooks          = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
         .checkentry     = redirect_tg_check,
diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c
new file mode 100644
index 000000000000..31371be8174b
--- /dev/null
+++ b/net/ipv4/netfilter/ipt_rpfilter.c
@@ -0,0 +1,141 @@
+/*
+ * Copyright (c) 2011 Florian Westphal <fw@strlen.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * based on fib_frontend.c; Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
+ */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/ip.h>
+#include <net/ip.h>
+#include <net/ip_fib.h>
+#include <net/route.h>
+
+#include <linux/netfilter/xt_rpfilter.h>
+#include <linux/netfilter/x_tables.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Florian Westphal <fw@strlen.de>");
+MODULE_DESCRIPTION("iptables: ipv4 reverse path filter match");
+
+/* don't try to find route from mcast/bcast/zeronet */
+static __be32 rpfilter_get_saddr(__be32 addr)
+{
+        if (ipv4_is_multicast(addr) || ipv4_is_lbcast(addr) ||
+            ipv4_is_zeronet(addr))
+                return 0;
+        return addr;
+}
+
+static bool rpfilter_lookup_reverse(struct flowi4 *fl4,
+                                const struct net_device *dev, u8 flags)
+{
+        struct fib_result res;
+        bool dev_match;
+        struct net *net = dev_net(dev);
+        int ret __maybe_unused;
+
+        if (fib_lookup(net, fl4, &res))
+                return false;
+
+        if (res.type != RTN_UNICAST) {
+                if (res.type != RTN_LOCAL || !(flags & XT_RPFILTER_ACCEPT_LOCAL))
+                        return false;
+        }
+        dev_match = false;
+#ifdef CONFIG_IP_ROUTE_MULTIPATH
+        for (ret = 0; ret < res.fi->fib_nhs; ret++) {
+                struct fib_nh *nh = &res.fi->fib_nh[ret];
+
+                if (nh->nh_dev == dev) {
+                        dev_match = true;
+                        break;
+                }
+        }
+#else
+        if (FIB_RES_DEV(res) == dev)
+                dev_match = true;
+#endif
+        if (dev_match || flags & XT_RPFILTER_LOOSE)
+                return FIB_RES_NH(res).nh_scope <= RT_SCOPE_HOST;
+        return dev_match;
+}
+
+static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par)
+{
+        const struct xt_rpfilter_info *info;
+        const struct iphdr *iph;
+        struct flowi4 flow;
+        bool invert;
+
+        info = par->matchinfo;
+        invert = info->flags & XT_RPFILTER_INVERT;
+
+        if (par->in->flags & IFF_LOOPBACK)
+                return true ^ invert;
+
+        iph = ip_hdr(skb);
+        if (ipv4_is_multicast(iph->daddr)) {
+                if (ipv4_is_zeronet(iph->saddr))
+                        return ipv4_is_local_multicast(iph->daddr) ^ invert;
+                flow.flowi4_iif = 0;
+        } else {
+                flow.flowi4_iif = dev_net(par->in)->loopback_dev->ifindex;
+        }
+
+        flow.daddr = iph->saddr;
+        flow.saddr = rpfilter_get_saddr(iph->daddr);
+        flow.flowi4_oif = 0;
+        flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0;
+        flow.flowi4_tos = RT_TOS(iph->tos);
+        flow.flowi4_scope = RT_SCOPE_UNIVERSE;
+
+        return rpfilter_lookup_reverse(&flow, par->in, info->flags) ^ invert;
+}
+
+static int rpfilter_check(const struct xt_mtchk_param *par)
+{
+        const struct xt_rpfilter_info *info = par->matchinfo;
+        unsigned int options = ~XT_RPFILTER_OPTION_MASK;
+        if (info->flags & options) {
+                pr_info("unknown options encountered");
+                return -EINVAL;
+        }
+
+        if (strcmp(par->table, "mangle") != 0 &&
+            strcmp(par->table, "raw") != 0) {
+                pr_info("match only valid in the \'raw\' "
+                        "or \'mangle\' tables, not \'%s\'.\n", par->table);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static struct xt_match rpfilter_mt_reg __read_mostly = {
+        .name           = "rpfilter",
+        .family         = NFPROTO_IPV4,
+        .checkentry     = rpfilter_check,
+        .match          = rpfilter_mt,
+        .matchsize      = sizeof(struct xt_rpfilter_info),
+        .hooks          = (1 << NF_INET_PRE_ROUTING),
+        .me             = THIS_MODULE
+};
+
+static int __init rpfilter_mt_init(void)
+{
+        return xt_register_match(&rpfilter_mt_reg);
+}
+
+static void __exit rpfilter_mt_exit(void)
+{
+        xt_unregister_match(&rpfilter_mt_reg);
+}
+
+module_init(rpfilter_mt_init);
+module_exit(rpfilter_mt_exit);
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 447bc5cfdc6c..acdd002bb540 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -30,7 +30,6 @@
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
-#include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 
 static DEFINE_SPINLOCK(nf_nat_lock);
@@ -57,7 +56,7 @@ hash_by_src(const struct net *net, u16 zone,
         /* Original src, to ensure we map it consistently if poss. */
         hash = jhash_3words((__force u32)tuple->src.u3.ip,
                             (__force u32)tuple->src.u.all ^ zone,
-                            tuple->dst.protonum, 0);
+                            tuple->dst.protonum, nf_conntrack_hash_rnd);
         return ((u64)hash * net->ipv4.nat_htable_size) >> 32;
 }
 
@@ -82,14 +81,14 @@ EXPORT_SYMBOL(nf_nat_used_tuple);
  * that meet the constraints of range. */
 static int
 in_range(const struct nf_conntrack_tuple *tuple,
-         const struct nf_nat_range *range)
+         const struct nf_nat_ipv4_range *range)
 {
         const struct nf_nat_protocol *proto;
         int ret = 0;
 
         /* If we are supposed to map IPs, then we must be in the
            range specified, otherwise let this drag us onto a new src IP. */
-        if (range->flags & IP_NAT_RANGE_MAP_IPS) {
+        if (range->flags & NF_NAT_RANGE_MAP_IPS) {
                 if (ntohl(tuple->src.u3.ip) < ntohl(range->min_ip) ||
                     ntohl(tuple->src.u3.ip) > ntohl(range->max_ip))
                         return 0;
@@ -97,8 +96,8 @@ in_range(const struct nf_conntrack_tuple *tuple,
 
         rcu_read_lock();
         proto = __nf_nat_proto_find(tuple->dst.protonum);
-        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) ||
-            proto->in_range(tuple, IP_NAT_MANIP_SRC,
+        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) ||
+            proto->in_range(tuple, NF_NAT_MANIP_SRC,
                             &range->min, &range->max))
                 ret = 1;
         rcu_read_unlock();
@@ -123,7 +122,7 @@ static int
 find_appropriate_src(struct net *net, u16 zone,
                      const struct nf_conntrack_tuple *tuple,
                      struct nf_conntrack_tuple *result,
-                     const struct nf_nat_range *range)
+                     const struct nf_nat_ipv4_range *range)
 {
         unsigned int h = hash_by_src(net, zone, tuple);
         const struct nf_conn_nat *nat;
@@ -157,7 +156,7 @@ find_appropriate_src(struct net *net, u16 zone,
 */
 static void
 find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
-                    const struct nf_nat_range *range,
+                    const struct nf_nat_ipv4_range *range,
                     const struct nf_conn *ct,
                     enum nf_nat_manip_type maniptype)
 {
@@ -166,10 +165,10 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
         u_int32_t minip, maxip, j;
 
         /* No IP mapping?  Do nothing. */
-        if (!(range->flags & IP_NAT_RANGE_MAP_IPS))
+        if (!(range->flags & NF_NAT_RANGE_MAP_IPS))
                 return;
 
-        if (maniptype == IP_NAT_MANIP_SRC)
+        if (maniptype == NF_NAT_MANIP_SRC)
                 var_ipp = &tuple->src.u3.ip;
         else
                 var_ipp = &tuple->dst.u3.ip;
@@ -189,7 +188,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
         minip = ntohl(range->min_ip);
         maxip = ntohl(range->max_ip);
         j = jhash_2words((__force u32)tuple->src.u3.ip,
-                         range->flags & IP_NAT_RANGE_PERSISTENT ?
+                         range->flags & NF_NAT_RANGE_PERSISTENT ?
                                 0 : (__force u32)tuple->dst.u3.ip ^ zone, 0);
         j = ((u64)j * (maxip - minip + 1)) >> 32;
         *var_ipp = htonl(minip + j);
@@ -204,7 +203,7 @@ find_best_ips_proto(u16 zone, struct nf_conntrack_tuple *tuple,
 static void
 get_unique_tuple(struct nf_conntrack_tuple *tuple,
                  const struct nf_conntrack_tuple *orig_tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_ipv4_range *range,
                  struct nf_conn *ct,
                  enum nf_nat_manip_type maniptype)
 {
@@ -219,8 +218,8 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
            This is only required for source (ie. NAT/masq) mappings.
            So far, we don't do local source mappings, so multiple
            manips not an issue.  */
-        if (maniptype == IP_NAT_MANIP_SRC &&
-            !(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
+        if (maniptype == NF_NAT_MANIP_SRC &&
+            !(range->flags & NF_NAT_RANGE_PROTO_RANDOM)) {
                 /* try the original tuple first */
                 if (in_range(orig_tuple, range)) {
                         if (!nf_nat_used_tuple(orig_tuple, ct)) {
@@ -247,8 +246,8 @@ get_unique_tuple(struct nf_conntrack_tuple *tuple,
         proto = __nf_nat_proto_find(orig_tuple->dst.protonum);
 
         /* Only bother mapping if it's not already in range and unique */
-        if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM)) {
-                if (range->flags & IP_NAT_RANGE_PROTO_SPECIFIED) {
+        if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM)) {
+                if (range->flags & NF_NAT_RANGE_PROTO_SPECIFIED) {
                         if (proto->in_range(tuple, maniptype, &range->min,
                                             &range->max) &&
                             (range->min.all == range->max.all ||
@@ -267,7 +266,7 @@ out:
 
 unsigned int
 nf_nat_setup_info(struct nf_conn *ct,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_ipv4_range *range,
                   enum nf_nat_manip_type maniptype)
 {
         struct net *net = nf_ct_net(ct);
@@ -284,8 +283,8 @@ nf_nat_setup_info(struct nf_conn *ct,
                 }
         }
 
-        NF_CT_ASSERT(maniptype == IP_NAT_MANIP_SRC ||
-                     maniptype == IP_NAT_MANIP_DST);
+        NF_CT_ASSERT(maniptype == NF_NAT_MANIP_SRC ||
+                     maniptype == NF_NAT_MANIP_DST);
         BUG_ON(nf_nat_initialized(ct, maniptype));
 
         /* What we've got will look like inverse of reply. Normally
@@ -306,13 +305,13 @@ nf_nat_setup_info(struct nf_conn *ct,
                 nf_conntrack_alter_reply(ct, &reply);
 
                 /* Non-atomic: we own this at the moment. */
-                if (maniptype == IP_NAT_MANIP_SRC)
+                if (maniptype == NF_NAT_MANIP_SRC)
                         ct->status |= IPS_SRC_NAT;
                 else
                         ct->status |= IPS_DST_NAT;
         }
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 unsigned int srchash;
 
                 srchash = hash_by_src(net, nf_ct_zone(ct),
@@ -327,7 +326,7 @@ nf_nat_setup_info(struct nf_conn *ct,
         }
 
         /* It's done. */
-        if (maniptype == IP_NAT_MANIP_DST)
+        if (maniptype == NF_NAT_MANIP_DST)
                 ct->status |= IPS_DST_NAT_DONE;
         else
                 ct->status |= IPS_SRC_NAT_DONE;
@@ -361,7 +360,7 @@ manip_pkt(u_int16_t proto,
 
         iph = (void *)skb->data + iphdroff;
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 csum_replace4(&iph->check, iph->saddr, target->src.u3.ip);
                 iph->saddr = target->src.u3.ip;
         } else {
@@ -381,7 +380,7 @@ unsigned int nf_nat_packet(struct nf_conn *ct,
         unsigned long statusbit;
         enum nf_nat_manip_type mtype = HOOK2MANIP(hooknum);
 
-        if (mtype == IP_NAT_MANIP_SRC)
+        if (mtype == NF_NAT_MANIP_SRC)
                 statusbit = IPS_SRC_NAT;
         else
                 statusbit = IPS_DST_NAT;
@@ -414,8 +413,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                 struct icmphdr icmp;
                 struct iphdr ip;
         } *inside;
-        const struct nf_conntrack_l4proto *l4proto;
-        struct nf_conntrack_tuple inner, target;
+        struct nf_conntrack_tuple target;
         int hdrlen = ip_hdrlen(skb);
         enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
         unsigned long statusbit;
@@ -447,7 +445,7 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                         return 0;
         }
 
-        if (manip == IP_NAT_MANIP_SRC)
+        if (manip == NF_NAT_MANIP_SRC)
                 statusbit = IPS_SRC_NAT;
         else
                 statusbit = IPS_DST_NAT;
@@ -463,16 +461,6 @@ int nf_nat_icmp_reply_translation(struct nf_conn *ct,
                  "dir %s\n", skb, manip,
                  dir == IP_CT_DIR_ORIGINAL ? "ORIG" : "REPLY");
 
-        /* rcu_read_lock()ed by nf_hook_slow */
-        l4proto = __nf_ct_l4proto_find(PF_INET, inside->ip.protocol);
-
-        if (!nf_ct_get_tuple(skb, hdrlen + sizeof(struct icmphdr),
-                             (hdrlen +
-                              sizeof(struct icmphdr) + inside->ip.ihl * 4),
-                             (u_int16_t)AF_INET, inside->ip.protocol,
-                             &inner, l3proto, l4proto))
-                return 0;
-
         /* Change inner back to look like incoming packet.  We do the
            opposite manip on this hook to normal, because it might not
            pass all hooks (locally-generated ICMP).  Consider incoming
@@ -575,26 +563,6 @@ static struct nf_ct_ext_type nat_extend __read_mostly = {
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/nfnetlink_conntrack.h>
 
-static const struct nf_nat_protocol *
-nf_nat_proto_find_get(u_int8_t protonum)
-{
-        const struct nf_nat_protocol *p;
-
-        rcu_read_lock();
-        p = __nf_nat_proto_find(protonum);
-        if (!try_module_get(p->me))
-                p = &nf_nat_unknown_protocol;
-        rcu_read_unlock();
-
-        return p;
-}
-
-static void
-nf_nat_proto_put(const struct nf_nat_protocol *p)
-{
-        module_put(p->me);
-}
-
 static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
         [CTA_PROTONAT_PORT_MIN] = { .type = NLA_U16 },
         [CTA_PROTONAT_PORT_MAX] = { .type = NLA_U16 },
@@ -602,7 +570,7 @@ static const struct nla_policy protonat_nla_policy[CTA_PROTONAT_MAX+1] = {
 
 static int nfnetlink_parse_nat_proto(struct nlattr *attr,
                                      const struct nf_conn *ct,
-                                     struct nf_nat_range *range)
+                                     struct nf_nat_ipv4_range *range)
 {
         struct nlattr *tb[CTA_PROTONAT_MAX+1];
         const struct nf_nat_protocol *npt;
@@ -612,21 +580,23 @@ static int nfnetlink_parse_nat_proto(struct nlattr *attr,
         if (err < 0)
                 return err;
 
-        npt = nf_nat_proto_find_get(nf_ct_protonum(ct));
+        rcu_read_lock();
+        npt = __nf_nat_proto_find(nf_ct_protonum(ct));
         if (npt->nlattr_to_range)
                 err = npt->nlattr_to_range(tb, range);
-        nf_nat_proto_put(npt);
+        rcu_read_unlock();
         return err;
 }
 
 static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
         [CTA_NAT_MINIP]         = { .type = NLA_U32 },
         [CTA_NAT_MAXIP]         = { .type = NLA_U32 },
+        [CTA_NAT_PROTO]         = { .type = NLA_NESTED },
 };
 
 static int
 nfnetlink_parse_nat(const struct nlattr *nat,
-                    const struct nf_conn *ct, struct nf_nat_range *range)
+                    const struct nf_conn *ct, struct nf_nat_ipv4_range *range)
 {
         struct nlattr *tb[CTA_NAT_MAX+1];
         int err;
@@ -646,7 +616,7 @@ nfnetlink_parse_nat(const struct nlattr *nat,
                 range->max_ip = nla_get_be32(tb[CTA_NAT_MAXIP]);
 
         if (range->min_ip)
-                range->flags |= IP_NAT_RANGE_MAP_IPS;
+                range->flags |= NF_NAT_RANGE_MAP_IPS;
 
         if (!tb[CTA_NAT_PROTO])
                 return 0;
@@ -663,7 +633,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
                           const struct nlattr *attr)
 {
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         if (nfnetlink_parse_nat(attr, ct, &range) < 0)
                 return -EINVAL;
diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c
index b9a1136addbd..dc1dd912baf4 100644
--- a/net/ipv4/netfilter/nf_nat_h323.c
+++ b/net/ipv4/netfilter/nf_nat_h323.c
@@ -398,7 +398,7 @@ static int nat_h245(struct sk_buff *skb, struct nf_conn *ct,
 static void ip_nat_q931_expect(struct nf_conn *new,
                                struct nf_conntrack_expect *this)
 {
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         if (this->tuple.src.u3.ip != 0) {       /* Only accept calls from GK */
                 nf_nat_follow_master(new, this);
@@ -409,16 +409,16 @@ static void ip_nat_q931_expect(struct nf_conn *new,
         BUG_ON(new->status & IPS_NAT_DONE_MASK);
 
         /* Change src to where master sends to */
-        range.flags = IP_NAT_RANGE_MAP_IPS;
+        range.flags = NF_NAT_RANGE_MAP_IPS;
         range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
-        nf_nat_setup_info(new, &range, IP_NAT_MANIP_SRC);
+        nf_nat_setup_info(new, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
-        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
+        range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
         range.min = range.max = this->saved_proto;
         range.min_ip = range.max_ip =
             new->master->tuplehash[!this->dir].tuple.src.u3.ip;
-        nf_nat_setup_info(new, &range, IP_NAT_MANIP_DST);
+        nf_nat_setup_info(new, &range, NF_NAT_MANIP_DST);
 }
 
 /****************************************************************************/
@@ -496,21 +496,21 @@ static int nat_q931(struct sk_buff *skb, struct nf_conn *ct,
 static void ip_nat_callforwarding_expect(struct nf_conn *new,
                                          struct nf_conntrack_expect *this)
 {
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         /* This must be a fresh one. */
         BUG_ON(new->status & IPS_NAT_DONE_MASK);
 
         /* Change src to where master sends to */
-        range.flags = IP_NAT_RANGE_MAP_IPS;
+        range.flags = NF_NAT_RANGE_MAP_IPS;
         range.min_ip = range.max_ip = new->tuplehash[!this->dir].tuple.src.u3.ip;
-        nf_nat_setup_info(new, &range, IP_NAT_MANIP_SRC);
+        nf_nat_setup_info(new, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
-        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
+        range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
         range.min = range.max = this->saved_proto;
         range.min_ip = range.max_ip = this->saved_ip;
-        nf_nat_setup_info(new, &range, IP_NAT_MANIP_DST);
+        nf_nat_setup_info(new, &range, NF_NAT_MANIP_DST);
 }
 
 /****************************************************************************/
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index ebc5f8894f99..af65958f6308 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -253,12 +253,6 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
         struct udphdr *udph;
         int datalen, oldlen;
 
-        /* UDP helpers might accidentally mangle the wrong packet */
-        iph = ip_hdr(skb);
-        if (skb->len < iph->ihl*4 + sizeof(*udph) +
-                               match_offset + match_len)
-                return 0;
-
         if (!skb_make_writable(skb, skb->len))
                 return 0;
 
@@ -430,22 +424,22 @@ nf_nat_seq_adjust(struct sk_buff *skb,
 void nf_nat_follow_master(struct nf_conn *ct,
                           struct nf_conntrack_expect *exp)
 {
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         /* This must be a fresh one. */
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
 
         /* Change src to where master sends to */
-        range.flags = IP_NAT_RANGE_MAP_IPS;
+        range.flags = NF_NAT_RANGE_MAP_IPS;
         range.min_ip = range.max_ip
                 = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
-        nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
+        nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
-        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
+        range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
         range.min = range.max = exp->saved_proto;
         range.min_ip = range.max_ip
                 = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
-        nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
+        nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 }
 EXPORT_SYMBOL(nf_nat_follow_master);
diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
index 3e8284ba46b8..c273d58980ae 100644
--- a/net/ipv4/netfilter/nf_nat_pptp.c
+++ b/net/ipv4/netfilter/nf_nat_pptp.c
@@ -47,7 +47,7 @@ static void pptp_nat_expected(struct nf_conn *ct,
         struct nf_conntrack_tuple t;
         const struct nf_ct_pptp_master *ct_pptp_info;
         const struct nf_nat_pptp *nat_pptp_info;
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         ct_pptp_info = &nfct_help(master)->help.ct_pptp_info;
         nat_pptp_info = &nfct_nat(master)->help.nat_pptp_info;
@@ -88,24 +88,24 @@ static void pptp_nat_expected(struct nf_conn *ct,
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
 
         /* Change src to where master sends to */
-        range.flags = IP_NAT_RANGE_MAP_IPS;
+        range.flags = NF_NAT_RANGE_MAP_IPS;
         range.min_ip = range.max_ip
                 = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
         if (exp->dir == IP_CT_DIR_ORIGINAL) {
-                range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
+                range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
                 range.min = range.max = exp->saved_proto;
         }
-        nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
+        nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
 
         /* For DST manip, map port here to where it's expected. */
-        range.flags = IP_NAT_RANGE_MAP_IPS;
+        range.flags = NF_NAT_RANGE_MAP_IPS;
         range.min_ip = range.max_ip
                 = ct->master->tuplehash[!exp->dir].tuple.src.u3.ip;
         if (exp->dir == IP_CT_DIR_REPLY) {
-                range.flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
+                range.flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
                 range.min = range.max = exp->saved_proto;
         }
-        nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
+        nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 }
 
 /* outbound packets == from PNS to PAC */
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index a3d997618602..9993bc93e102 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -26,7 +26,7 @@ bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
 {
         __be16 port;
 
-        if (maniptype == IP_NAT_MANIP_SRC)
+        if (maniptype == NF_NAT_MANIP_SRC)
                 port = tuple->src.u.all;
         else
                 port = tuple->dst.u.all;
@@ -37,7 +37,7 @@ bool nf_nat_proto_in_range(const struct nf_conntrack_tuple *tuple,
 EXPORT_SYMBOL_GPL(nf_nat_proto_in_range);
 
 void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
-                               const struct nf_nat_range *range,
+                               const struct nf_nat_ipv4_range *range,
                                enum nf_nat_manip_type maniptype,
                                const struct nf_conn *ct,
                                u_int16_t *rover)
@@ -46,15 +46,15 @@ void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
         __be16 *portptr;
         u_int16_t off;
 
-        if (maniptype == IP_NAT_MANIP_SRC)
+        if (maniptype == NF_NAT_MANIP_SRC)
                 portptr = &tuple->src.u.all;
         else
                 portptr = &tuple->dst.u.all;
 
         /* If no range specified... */
-        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
+        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) {
                 /* If it's dst rewrite, can't change port */
-                if (maniptype == IP_NAT_MANIP_DST)
+                if (maniptype == NF_NAT_MANIP_DST)
                         return;
 
                 if (ntohs(*portptr) < 1024) {
@@ -75,9 +75,9 @@ void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
                 range_size = ntohs(range->max.all) - min + 1;
         }
 
-        if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
+        if (range->flags & NF_NAT_RANGE_PROTO_RANDOM)
                 off = secure_ipv4_port_ephemeral(tuple->src.u3.ip, tuple->dst.u3.ip,
-                                                 maniptype == IP_NAT_MANIP_SRC
+                                                 maniptype == NF_NAT_MANIP_SRC
                                                  ? tuple->dst.u.all
                                                  : tuple->src.u.all);
         else
@@ -87,7 +87,7 @@ void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
                 *portptr = htons(min + off % range_size);
                 if (++i != range_size && nf_nat_used_tuple(tuple, ct))
                         continue;
-                if (!(range->flags & IP_NAT_RANGE_PROTO_RANDOM))
+                if (!(range->flags & NF_NAT_RANGE_PROTO_RANDOM))
                         *rover = off;
                 return;
         }
@@ -96,31 +96,19 @@ void nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
 EXPORT_SYMBOL_GPL(nf_nat_proto_unique_tuple);
 
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-int nf_nat_proto_range_to_nlattr(struct sk_buff *skb,
-                                 const struct nf_nat_range *range)
-{
-        NLA_PUT_BE16(skb, CTA_PROTONAT_PORT_MIN, range->min.all);
-        NLA_PUT_BE16(skb, CTA_PROTONAT_PORT_MAX, range->max.all);
-        return 0;
-
-nla_put_failure:
-        return -1;
-}
-EXPORT_SYMBOL_GPL(nf_nat_proto_nlattr_to_range);
-
 int nf_nat_proto_nlattr_to_range(struct nlattr *tb[],
-                                 struct nf_nat_range *range)
+                                 struct nf_nat_ipv4_range *range)
 {
         if (tb[CTA_PROTONAT_PORT_MIN]) {
                 range->min.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MIN]);
                 range->max.all = range->min.tcp.port;
-                range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
+                range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
         if (tb[CTA_PROTONAT_PORT_MAX]) {
                 range->max.all = nla_get_be16(tb[CTA_PROTONAT_PORT_MAX]);
-                range->flags |= IP_NAT_RANGE_PROTO_SPECIFIED;
+                range->flags |= NF_NAT_RANGE_PROTO_SPECIFIED;
         }
         return 0;
 }
-EXPORT_SYMBOL_GPL(nf_nat_proto_range_to_nlattr);
+EXPORT_SYMBOL_GPL(nf_nat_proto_nlattr_to_range);
 #endif
diff --git a/net/ipv4/netfilter/nf_nat_proto_dccp.c b/net/ipv4/netfilter/nf_nat_proto_dccp.c
index 570faf2667b2..3f67138d187c 100644
--- a/net/ipv4/netfilter/nf_nat_proto_dccp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_dccp.c
@@ -24,7 +24,7 @@ static u_int16_t dccp_port_rover;
 
 static void
 dccp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_ipv4_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
@@ -54,7 +54,7 @@ dccp_manip_pkt(struct sk_buff *skb,
         iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct dccp_hdr *)(skb->data + hdroff);
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 oldip = iph->saddr;
                 newip = tuple->src.u3.ip;
                 newport = tuple->src.u.dccp.port;
@@ -80,12 +80,10 @@ dccp_manip_pkt(struct sk_buff *skb,
 
 static const struct nf_nat_protocol nf_nat_protocol_dccp = {
         .protonum               = IPPROTO_DCCP,
-        .me                     = THIS_MODULE,
         .manip_pkt              = dccp_manip_pkt,
         .in_range               = nf_nat_proto_in_range,
         .unique_tuple           = dccp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c
index bc8d83a31c73..46ba0b9ab985 100644
--- a/net/ipv4/netfilter/nf_nat_proto_gre.c
+++ b/net/ipv4/netfilter/nf_nat_proto_gre.c
@@ -39,7 +39,7 @@ MODULE_DESCRIPTION("Netfilter NAT protocol helper module for GRE");
 /* generate unique tuple ... */
 static void
 gre_unique_tuple(struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_ipv4_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
@@ -52,12 +52,12 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple,
         if (!ct->master)
                 return;
 
-        if (maniptype == IP_NAT_MANIP_SRC)
+        if (maniptype == NF_NAT_MANIP_SRC)
                 keyptr = &tuple->src.u.gre.key;
         else
                 keyptr = &tuple->dst.u.gre.key;
 
-        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED)) {
+        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED)) {
                 pr_debug("%p: NATing GRE PPTP\n", ct);
                 min = 1;
                 range_size = 0xffff;
@@ -99,7 +99,7 @@ gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
 
         /* we only have destination manip of a packet, since 'source key'
          * is not present in the packet itself */
-        if (maniptype != IP_NAT_MANIP_DST)
+        if (maniptype != NF_NAT_MANIP_DST)
                 return true;
         switch (greh->version) {
         case GRE_VERSION_1701:
@@ -119,12 +119,10 @@ gre_manip_pkt(struct sk_buff *skb, unsigned int iphdroff,
 
 static const struct nf_nat_protocol gre = {
         .protonum               = IPPROTO_GRE,
-        .me                     = THIS_MODULE,
         .manip_pkt              = gre_manip_pkt,
         .in_range               = nf_nat_proto_in_range,
         .unique_tuple           = gre_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_icmp.c b/net/ipv4/netfilter/nf_nat_proto_icmp.c
index 9f4dc1235dc7..b35172851bae 100644
--- a/net/ipv4/netfilter/nf_nat_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_icmp.c
@@ -30,7 +30,7 @@ icmp_in_range(const struct nf_conntrack_tuple *tuple,
 
 static void
 icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_ipv4_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
@@ -40,7 +40,7 @@ icmp_unique_tuple(struct nf_conntrack_tuple *tuple,
 
         range_size = ntohs(range->max.icmp.id) - ntohs(range->min.icmp.id) + 1;
         /* If no range specified... */
-        if (!(range->flags & IP_NAT_RANGE_PROTO_SPECIFIED))
+        if (!(range->flags & NF_NAT_RANGE_PROTO_SPECIFIED))
                 range_size = 0xFFFF;
 
         for (i = 0; ; ++id) {
@@ -74,12 +74,10 @@ icmp_manip_pkt(struct sk_buff *skb,
 
 const struct nf_nat_protocol nf_nat_protocol_icmp = {
         .protonum               = IPPROTO_ICMP,
-        .me                     = THIS_MODULE,
         .manip_pkt              = icmp_manip_pkt,
         .in_range               = icmp_in_range,
         .unique_tuple           = icmp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_sctp.c b/net/ipv4/netfilter/nf_nat_proto_sctp.c
index bd5a80a62a5b..3cce9b6c1c29 100644
--- a/net/ipv4/netfilter/nf_nat_proto_sctp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_sctp.c
@@ -19,7 +19,7 @@ static u_int16_t nf_sctp_port_rover;
 
 static void
 sctp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                  const struct nf_nat_range *range,
+                  const struct nf_nat_ipv4_range *range,
                   enum nf_nat_manip_type maniptype,
                   const struct nf_conn *ct)
 {
@@ -46,7 +46,7 @@ sctp_manip_pkt(struct sk_buff *skb,
         iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct sctphdr *)(skb->data + hdroff);
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 /* Get rid of src ip and src pt */
                 oldip = iph->saddr;
                 newip = tuple->src.u3.ip;
@@ -70,12 +70,10 @@ sctp_manip_pkt(struct sk_buff *skb,
 
 static const struct nf_nat_protocol nf_nat_protocol_sctp = {
         .protonum               = IPPROTO_SCTP,
-        .me                     = THIS_MODULE,
         .manip_pkt              = sctp_manip_pkt,
         .in_range               = nf_nat_proto_in_range,
         .unique_tuple           = sctp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_tcp.c b/net/ipv4/netfilter/nf_nat_proto_tcp.c
index 0d67bb80130f..9fb4b4e72bbf 100644
--- a/net/ipv4/netfilter/nf_nat_proto_tcp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_tcp.c
@@ -23,7 +23,7 @@ static u_int16_t tcp_port_rover;
 
 static void
 tcp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_ipv4_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
@@ -55,7 +55,7 @@ tcp_manip_pkt(struct sk_buff *skb,
         iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct tcphdr *)(skb->data + hdroff);
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 /* Get rid of src ip and src pt */
                 oldip = iph->saddr;
                 newip = tuple->src.u3.ip;
@@ -82,12 +82,10 @@ tcp_manip_pkt(struct sk_buff *skb,
 
 const struct nf_nat_protocol nf_nat_protocol_tcp = {
         .protonum               = IPPROTO_TCP,
-        .me                     = THIS_MODULE,
         .manip_pkt              = tcp_manip_pkt,
         .in_range               = nf_nat_proto_in_range,
         .unique_tuple           = tcp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_udp.c b/net/ipv4/netfilter/nf_nat_proto_udp.c
index 0b1b8601cba7..9883336e628f 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udp.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udp.c
@@ -22,7 +22,7 @@ static u_int16_t udp_port_rover;
 
 static void
 udp_unique_tuple(struct nf_conntrack_tuple *tuple,
-                 const struct nf_nat_range *range,
+                 const struct nf_nat_ipv4_range *range,
                  enum nf_nat_manip_type maniptype,
                  const struct nf_conn *ct)
 {
@@ -47,7 +47,7 @@ udp_manip_pkt(struct sk_buff *skb,
         iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct udphdr *)(skb->data + hdroff);
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 /* Get rid of src ip and src pt */
                 oldip = iph->saddr;
                 newip = tuple->src.u3.ip;
@@ -73,12 +73,10 @@ udp_manip_pkt(struct sk_buff *skb,
 
 const struct nf_nat_protocol nf_nat_protocol_udp = {
         .protonum               = IPPROTO_UDP,
-        .me                     = THIS_MODULE,
         .manip_pkt              = udp_manip_pkt,
         .in_range               = nf_nat_proto_in_range,
         .unique_tuple           = udp_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_udplite.c b/net/ipv4/netfilter/nf_nat_proto_udplite.c
index f83ef23e2ab7..d24d10a7beb2 100644
--- a/net/ipv4/netfilter/nf_nat_proto_udplite.c
+++ b/net/ipv4/netfilter/nf_nat_proto_udplite.c
@@ -21,7 +21,7 @@ static u_int16_t udplite_port_rover;
 
 static void
 udplite_unique_tuple(struct nf_conntrack_tuple *tuple,
-                     const struct nf_nat_range *range,
+                     const struct nf_nat_ipv4_range *range,
                      enum nf_nat_manip_type maniptype,
                      const struct nf_conn *ct)
 {
@@ -47,7 +47,7 @@ udplite_manip_pkt(struct sk_buff *skb,
         iph = (struct iphdr *)(skb->data + iphdroff);
         hdr = (struct udphdr *)(skb->data + hdroff);
 
-        if (maniptype == IP_NAT_MANIP_SRC) {
+        if (maniptype == NF_NAT_MANIP_SRC) {
                 /* Get rid of src ip and src pt */
                 oldip = iph->saddr;
                 newip = tuple->src.u3.ip;
@@ -72,12 +72,10 @@ udplite_manip_pkt(struct sk_buff *skb,
 
 static const struct nf_nat_protocol nf_nat_protocol_udplite = {
         .protonum               = IPPROTO_UDPLITE,
-        .me                     = THIS_MODULE,
         .manip_pkt              = udplite_manip_pkt,
         .in_range               = nf_nat_proto_in_range,
         .unique_tuple           = udplite_unique_tuple,
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
-        .range_to_nlattr        = nf_nat_proto_range_to_nlattr,
         .nlattr_to_range        = nf_nat_proto_nlattr_to_range,
 #endif
 };
diff --git a/net/ipv4/netfilter/nf_nat_proto_unknown.c b/net/ipv4/netfilter/nf_nat_proto_unknown.c
index a50f2bc1c732..e0afe8112b1c 100644
--- a/net/ipv4/netfilter/nf_nat_proto_unknown.c
+++ b/net/ipv4/netfilter/nf_nat_proto_unknown.c
@@ -27,7 +27,7 @@ static bool unknown_in_range(const struct nf_conntrack_tuple *tuple,
 }
 
 static void unknown_unique_tuple(struct nf_conntrack_tuple *tuple,
-                                 const struct nf_nat_range *range,
+                                 const struct nf_nat_ipv4_range *range,
                                  enum nf_nat_manip_type maniptype,
                                  const struct nf_conn *ct)
 {
@@ -46,7 +46,6 @@ unknown_manip_pkt(struct sk_buff *skb,
 }
 
 const struct nf_nat_protocol nf_nat_unknown_protocol = {
-        /* .me isn't set: getting a ref to this cannot fail. */
         .manip_pkt              = unknown_manip_pkt,
         .in_range               = unknown_in_range,
         .unique_tuple           = unknown_unique_tuple,
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 733c9abc1cbd..d2a9dc314e0e 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -44,7 +44,7 @@ ipt_snat_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
         NF_CT_ASSERT(par->hooknum == NF_INET_POST_ROUTING ||
                      par->hooknum == NF_INET_LOCAL_IN);
@@ -56,7 +56,7 @@ ipt_snat_target(struct sk_buff *skb, const struct xt_action_param *par)
                             ctinfo == IP_CT_RELATED_REPLY));
         NF_CT_ASSERT(par->out != NULL);
 
-        return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_SRC);
+        return nf_nat_setup_info(ct, &mr->range[0], NF_NAT_MANIP_SRC);
 }
 
 static unsigned int
@@ -64,7 +64,7 @@ ipt_dnat_target(struct sk_buff *skb, const struct xt_action_param *par)
 {
         struct nf_conn *ct;
         enum ip_conntrack_info ctinfo;
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
         NF_CT_ASSERT(par->hooknum == NF_INET_PRE_ROUTING ||
                      par->hooknum == NF_INET_LOCAL_OUT);
@@ -74,12 +74,12 @@ ipt_dnat_target(struct sk_buff *skb, const struct xt_action_param *par)
         /* Connection must be valid and new. */
         NF_CT_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
 
-        return nf_nat_setup_info(ct, &mr->range[0], IP_NAT_MANIP_DST);
+        return nf_nat_setup_info(ct, &mr->range[0], NF_NAT_MANIP_DST);
 }
 
 static int ipt_snat_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
         /* Must be a valid range */
         if (mr->rangesize != 1) {
@@ -91,7 +91,7 @@ static int ipt_snat_checkentry(const struct xt_tgchk_param *par)
 
 static int ipt_dnat_checkentry(const struct xt_tgchk_param *par)
 {
-        const struct nf_nat_multi_range_compat *mr = par->targinfo;
+        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
 
         /* Must be a valid range */
         if (mr->rangesize != 1) {
@@ -105,13 +105,13 @@ static unsigned int
 alloc_null_binding(struct nf_conn *ct, unsigned int hooknum)
 {
         /* Force range to this IP; let proto decide mapping for
-           per-proto parts (hence not IP_NAT_RANGE_PROTO_SPECIFIED).
+           per-proto parts (hence not NF_NAT_RANGE_PROTO_SPECIFIED).
         */
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         range.flags = 0;
         pr_debug("Allocating NULL binding for %p (%pI4)\n", ct,
-                 HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC ?
+                 HOOK2MANIP(hooknum) == NF_NAT_MANIP_SRC ?
                  &ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3.ip :
                  &ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3.ip);
 
@@ -140,7 +140,7 @@ int nf_nat_rule_find(struct sk_buff *skb,
 static struct xt_target ipt_snat_reg __read_mostly = {
         .name           = "SNAT",
         .target         = ipt_snat_target,
-        .targetsize     = sizeof(struct nf_nat_multi_range_compat),
+        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
         .table          = "nat",
         .hooks          = (1 << NF_INET_POST_ROUTING) | (1 << NF_INET_LOCAL_IN),
         .checkentry     = ipt_snat_checkentry,
@@ -150,7 +150,7 @@ static struct xt_target ipt_snat_reg __read_mostly = {
 static struct xt_target ipt_dnat_reg __read_mostly = {
         .name           = "DNAT",
         .target         = ipt_dnat_target,
-        .targetsize     = sizeof(struct nf_nat_multi_range_compat),
+        .targetsize     = sizeof(struct nf_nat_ipv4_multi_range_compat),
         .table          = "nat",
         .hooks          = (1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT),
         .checkentry     = ipt_dnat_checkentry,
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 78844d9208f1..d0319f96269f 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -249,25 +249,25 @@ static void ip_nat_sip_seq_adjust(struct sk_buff *skb, s16 off)
 static void ip_nat_sip_expected(struct nf_conn *ct,
                                 struct nf_conntrack_expect *exp)
 {
-        struct nf_nat_range range;
+        struct nf_nat_ipv4_range range;
 
         /* This must be a fresh one. */
         BUG_ON(ct->status & IPS_NAT_DONE_MASK);
 
         /* For DST manip, map port here to where it's expected. */
-        range.flags = (IP_NAT_RANGE_MAP_IPS | IP_NAT_RANGE_PROTO_SPECIFIED);
+        range.flags = (NF_NAT_RANGE_MAP_IPS | NF_NAT_RANGE_PROTO_SPECIFIED);
         range.min = range.max = exp->saved_proto;
         range.min_ip = range.max_ip = exp->saved_ip;
-        nf_nat_setup_info(ct, &range, IP_NAT_MANIP_DST);
+        nf_nat_setup_info(ct, &range, NF_NAT_MANIP_DST);
 
         /* Change src to where master sends to, but only if the connection
          * actually came from the same source. */
         if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip ==
             ct->master->tuplehash[exp->dir].tuple.src.u3.ip) {
-                range.flags = IP_NAT_RANGE_MAP_IPS;
+                range.flags = NF_NAT_RANGE_MAP_IPS;
                 range.min_ip = range.max_ip
                         = ct->master->tuplehash[!exp->dir].tuple.dst.u3.ip;
-                nf_nat_setup_info(ct, &range, IP_NAT_MANIP_SRC);
+                nf_nat_setup_info(ct, &range, NF_NAT_MANIP_SRC);
         }
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 92900482edea..3828a4229822 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -137,7 +137,7 @@ nf_nat_fn(unsigned int hooknum,
                                 return ret;
                 } else
                         pr_debug("Already setup manip %s for ct %p\n",
-                                 maniptype == IP_NAT_MANIP_SRC ? "SRC" : "DST",
+                                 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
                                  ct);
                 break;