Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/kaber/nf-next-2.6

11 files changed, 116 insertions, 78 deletions

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 7505dff4ffdf..27774c99d888 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -8,7 +8,7 @@
  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
  *
  */
-
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
@@ -341,15 +341,11 @@ unsigned int arpt_do_table(struct sk_buff *skb,
 }
 
 /* All zeroes == unconditional rule. */
-static inline int unconditional(const struct arpt_arp *arp)
+static inline bool unconditional(const struct arpt_arp *arp)
 {
-        unsigned int i;
+        static const struct arpt_arp uncond;
 
-        for (i = 0; i < sizeof(*arp)/sizeof(__u32); i++)
-                if (((__u32 *)arp)[i])
-                        return 0;
-
-        return 1;
+        return memcmp(arp, &uncond, sizeof(uncond)) == 0;
 }
 
 /* Figures out from what hook each rule can be called: returns 0 if
@@ -537,12 +533,28 @@ out:
         return ret;
 }
 
+static bool check_underflow(struct arpt_entry *e)
+{
+        const struct arpt_entry_target *t;
+        unsigned int verdict;
+
+        if (!unconditional(&e->arp))
+                return false;
+        t = arpt_get_target(e);
+        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+                return false;
+        verdict = ((struct arpt_standard_target *)t)->verdict;
+        verdict = -verdict - 1;
+        return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static inline int check_entry_size_and_hooks(struct arpt_entry *e,
                                              struct xt_table_info *newinfo,
                                              unsigned char *base,
                                              unsigned char *limit,
                                              const unsigned int *hook_entries,
                                              const unsigned int *underflows,
+                                             unsigned int valid_hooks,
                                              unsigned int *i)
 {
         unsigned int h;
@@ -562,15 +574,21 @@ static inline int check_entry_size_and_hooks(struct arpt_entry *e,
 
         /* Check hooks & underflows */
         for (h = 0; h < NF_ARP_NUMHOOKS; h++) {
+                if (!(valid_hooks & (1 << h)))
+                        continue;
                 if ((unsigned char *)e - base == hook_entries[h])
                         newinfo->hook_entry[h] = hook_entries[h];
-                if ((unsigned char *)e - base == underflows[h])
+                if ((unsigned char *)e - base == underflows[h]) {
+                        if (!check_underflow(e)) {
+                                pr_err("Underflows must be unconditional and "
+                                       "use the STANDARD target with "
+                                       "ACCEPT/DROP\n");
+                                return -EINVAL;
+                        }
                         newinfo->underflow[h] = underflows[h];
+                }
         }
 
-        /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not ARPT_RETURN). --RR */
-
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
@@ -630,7 +648,7 @@ static int translate_table(const char *name,
                                  newinfo,
                                  entry0,
                                  entry0 + size,
-                                 hook_entries, underflows, &i);
+                                 hook_entries, underflows, valid_hooks, &i);
         duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret);
         if (ret != 0)
                 return ret;
@@ -1760,7 +1778,8 @@ static int do_arpt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len
         return ret;
 }
 
-struct xt_table *arpt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *arpt_register_table(struct net *net,
+                                     const struct xt_table *table,
                                      const struct arpt_replace *repl)
 {
         int ret;
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 6ecfdae7c589..97337601827a 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -15,7 +15,7 @@ MODULE_DESCRIPTION("arptables filter table");
 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
                            (1 << NF_ARP_FORWARD))
 
-static struct
+static const struct
 {
         struct arpt_replace repl;
         struct arpt_standard entries[3];
@@ -45,7 +45,7 @@ static struct
         .term = ARPT_ERROR_INIT,
 };
 
-static struct xt_table packet_filter = {
+static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index fdefae6b5dfc..cde755d5eeab 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -8,6 +8,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/cache.h>
 #include <linux/capability.h>
 #include <linux/skbuff.h>
@@ -190,16 +191,11 @@ get_entry(void *base, unsigned int offset)
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline int
-unconditional(const struct ipt_ip *ip)
+static inline bool unconditional(const struct ipt_ip *ip)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
-                if (((__u32 *)ip)[i])
-                        return 0;
+        static const struct ipt_ip uncond;
 
-        return 1;
+        return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 #undef FWINV
 }
 
@@ -315,7 +311,6 @@ ipt_do_table(struct sk_buff *skb,
 
         static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
         const struct iphdr *ip;
-        u_int16_t datalen;
         bool hotdrop = false;
         /* Initializing verdict to NF_DROP keeps gcc happy. */
         unsigned int verdict = NF_DROP;
@@ -328,7 +323,6 @@ ipt_do_table(struct sk_buff *skb,
 
         /* Initialization */
         ip = ip_hdr(skb);
-        datalen = skb->len - ip->ihl * 4;
         indev = in ? in->name : nulldevname;
         outdev = out ? out->name : nulldevname;
         /* We handle fragments by dealing with the first fragment as
@@ -427,8 +421,6 @@ ipt_do_table(struct sk_buff *skb,
 #endif
                 /* Target might have changed stuff. */
                 ip = ip_hdr(skb);
-                datalen = skb->len - ip->ihl * 4;
-
                 if (verdict == IPT_CONTINUE)
                         e = ipt_next_entry(e);
                 else
@@ -716,6 +708,21 @@ find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
         return ret;
 }
 
+static bool check_underflow(struct ipt_entry *e)
+{
+        const struct ipt_entry_target *t;
+        unsigned int verdict;
+
+        if (!unconditional(&e->ip))
+                return false;
+        t = ipt_get_target(e);
+        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+                return false;
+        verdict = ((struct ipt_standard_target *)t)->verdict;
+        verdict = -verdict - 1;
+        return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static int
 check_entry_size_and_hooks(struct ipt_entry *e,
                            struct xt_table_info *newinfo,
@@ -723,6 +730,7 @@ check_entry_size_and_hooks(struct ipt_entry *e,
                            unsigned char *limit,
                            const unsigned int *hook_entries,
                            const unsigned int *underflows,
+                           unsigned int valid_hooks,
                            unsigned int *i)
 {
         unsigned int h;
@@ -742,15 +750,21 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 
         /* Check hooks & underflows */
         for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+                if (!(valid_hooks & (1 << h)))
+                        continue;
                 if ((unsigned char *)e - base == hook_entries[h])
                         newinfo->hook_entry[h] = hook_entries[h];
-                if ((unsigned char *)e - base == underflows[h])
+                if ((unsigned char *)e - base == underflows[h]) {
+                        if (!check_underflow(e)) {
+                                pr_err("Underflows must be unconditional and "
+                                       "use the STANDARD target with "
+                                       "ACCEPT/DROP\n");
+                                return -EINVAL;
+                        }
                         newinfo->underflow[h] = underflows[h];
+                }
         }
 
-        /* FIXME: underflows must be unconditional, standard verdicts
-           < 0 (not IPT_RETURN). --RR */
-
         /* Clear counters and comefrom */
         e->counters = ((struct xt_counters) { 0, 0 });
         e->comefrom = 0;
@@ -813,7 +827,7 @@ translate_table(const char *name,
                                 newinfo,
                                 entry0,
                                 entry0 + size,
-                                hook_entries, underflows, &i);
+                                hook_entries, underflows, valid_hooks, &i);
         if (ret != 0)
                 return ret;
 
@@ -2051,7 +2065,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
         return ret;
 }
 
-struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *ipt_register_table(struct net *net,
+                                    const struct xt_table *table,
                                     const struct ipt_replace *repl)
 {
         int ret;
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index c30a969724f8..df566cbd68e5 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -53,11 +53,11 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table packet_filter = {
+static const struct xt_table packet_filter = {
         .name           = "filter",
         .valid_hooks    = FILTER_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
 };
 
 /* The work comes in here from netfilter.c. */
@@ -102,21 +102,21 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
         {
                 .hook           = ipt_local_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
                 .hook           = ipt_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
                 .hook           = ipt_local_out_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_FILTER,
         },
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 4087614d9519..036047f9b0f2 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -28,7 +28,7 @@ MODULE_DESCRIPTION("iptables mangle table");
                             (1 << NF_INET_POST_ROUTING))
 
 /* Ouch - five different hooks? Maybe this should be a config option..... -- BC */
-static struct
+static const struct
 {
         struct ipt_replace repl;
         struct ipt_standard entries[5];
@@ -64,11 +64,11 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table packet_mangler = {
+static const struct xt_table packet_mangler = {
         .name           = "mangle",
         .valid_hooks    = MANGLE_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
 };
 
 /* The work comes in here from netfilter.c. */
@@ -162,35 +162,35 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
         {
                 .hook           = ipt_pre_routing_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP_PRI_MANGLE,
         },
         {
                 .hook           = ipt_local_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_MANGLE,
         },
         {
                 .hook           = ipt_forward_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP_PRI_MANGLE,
         },
         {
                 .hook           = ipt_local_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_MANGLE,
         },
         {
                 .hook           = ipt_post_routing_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP_PRI_MANGLE,
         },
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index e5356da1fb54..993edc23be09 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -9,7 +9,7 @@
 
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
 
-static struct
+static const struct
 {
         struct ipt_replace repl;
         struct ipt_standard entries[2];
@@ -36,11 +36,11 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table packet_raw = {
+static const struct xt_table packet_raw = {
         .name = "raw",
         .valid_hooks =  RAW_VALID_HOOKS,
         .me = THIS_MODULE,
-        .af = AF_INET,
+        .af = NFPROTO_IPV4,
 };
 
 /* The work comes in here from netfilter.c. */
@@ -74,14 +74,14 @@ ipt_local_hook(unsigned int hook,
 static struct nf_hook_ops ipt_ops[] __read_mostly = {
         {
                 .hook = ipt_hook,
-                .pf = PF_INET,
+                .pf = NFPROTO_IPV4,
                 .hooknum = NF_INET_PRE_ROUTING,
                 .priority = NF_IP_PRI_RAW,
                 .owner = THIS_MODULE,
         },
         {
                 .hook = ipt_local_hook,
-                .pf = PF_INET,
+                .pf = NFPROTO_IPV4,
                 .hooknum = NF_INET_LOCAL_OUT,
                 .priority = NF_IP_PRI_RAW,
                 .owner = THIS_MODULE,
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 29ab630f240a..99eb76c65d25 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -27,7 +27,7 @@ MODULE_DESCRIPTION("iptables security table, for MAC rules");
                                 (1 << NF_INET_FORWARD) | \
                                 (1 << NF_INET_LOCAL_OUT)
 
-static struct
+static const struct
 {
         struct ipt_replace repl;
         struct ipt_standard entries[3];
@@ -57,11 +57,11 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table security_table = {
+static const struct xt_table security_table = {
         .name           = "security",
         .valid_hooks    = SECURITY_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
 };
 
 static unsigned int
@@ -105,21 +105,21 @@ static struct nf_hook_ops ipt_ops[] __read_mostly = {
         {
                 .hook           = ipt_local_in_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_SECURITY,
         },
         {
                 .hook           = ipt_forward_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_FORWARD,
                 .priority       = NF_IP_PRI_SECURITY,
         },
         {
                 .hook           = ipt_local_out_hook,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_SECURITY,
         },
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 7d2ead7228ac..aa95bb82ee6c 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -26,6 +26,7 @@
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/nf_nat_helper.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
+#include <net/netfilter/nf_log.h>
 
 int (*nf_nat_seq_adjust_hook)(struct sk_buff *skb,
                               struct nf_conn *ct,
@@ -113,8 +114,11 @@ static unsigned int ipv4_confirm(unsigned int hooknum,
 
         ret = helper->help(skb, skb_network_offset(skb) + ip_hdrlen(skb),
                            ct, ctinfo);
-        if (ret != NF_ACCEPT)
+        if (ret != NF_ACCEPT) {
+                nf_log_packet(NFPROTO_IPV4, hooknum, skb, in, out, NULL,
+                              "nf_ct_%s: dropping packet", helper->name);
                 return ret;
+        }
 
         if (test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)) {
                 typeof(nf_nat_seq_adjust_hook) seq_adjust;
@@ -158,28 +162,28 @@ static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
         {
                 .hook           = ipv4_conntrack_in,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP_PRI_CONNTRACK,
         },
         {
                 .hook           = ipv4_conntrack_local,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_CONNTRACK,
         },
         {
                 .hook           = ipv4_confirm,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
         },
         {
                 .hook           = ipv4_confirm,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
         },
@@ -256,11 +260,11 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
         tuple.dst.u3.ip = inet->daddr;
         tuple.dst.u.tcp.port = inet->dport;
         tuple.src.l3num = PF_INET;
-        tuple.dst.protonum = IPPROTO_TCP;
+        tuple.dst.protonum = sk->sk_protocol;
 
-        /* We only do TCP at the moment: is there a better way? */
-        if (strcmp(sk->sk_prot->name, "TCP")) {
-                pr_debug("SO_ORIGINAL_DST: Not a TCP socket\n");
+        /* We only do TCP and SCTP at the moment: is there a better way? */
+        if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
+                pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
                 return -ENOPROTOOPT;
         }
 
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 3229e0a81ba6..68afc6ecd343 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -212,7 +212,7 @@ find_best_ips_proto(struct nf_conntrack_tuple *tuple,
         maxip = ntohl(range->max_ip);
         j = jhash_2words((__force u32)tuple->src.u3.ip,
                          range->flags & IP_NAT_RANGE_PERSISTENT ?
-                                (__force u32)tuple->dst.u3.ip : 0, 0);
+                                0 : (__force u32)tuple->dst.u3.ip, 0);
         j = ((u64)j * (maxip - minip + 1)) >> 32;
         *var_ipp = htonl(minip + j);
 }
@@ -620,7 +620,7 @@ static const struct nla_policy nat_nla_policy[CTA_NAT_MAX+1] = {
 };
 
 static int
-nfnetlink_parse_nat(struct nlattr *nat,
+nfnetlink_parse_nat(const struct nlattr *nat,
                     const struct nf_conn *ct, struct nf_nat_range *range)
 {
         struct nlattr *tb[CTA_NAT_MAX+1];
@@ -656,7 +656,7 @@ nfnetlink_parse_nat(struct nlattr *nat,
 static int
 nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
-                          struct nlattr *attr)
+                          const struct nlattr *attr)
 {
         struct nf_nat_range range;
 
@@ -671,7 +671,7 @@ nfnetlink_parse_nat_setup(struct nf_conn *ct,
 static int
 nfnetlink_parse_nat_setup(struct nf_conn *ct,
                           enum nf_nat_manip_type manip,
-                          struct nlattr *attr)
+                          const struct nlattr *attr)
 {
         return -EOPNOTSUPP;
 }
diff --git a/net/ipv4/netfilter/nf_nat_rule.c b/net/ipv4/netfilter/nf_nat_rule.c
index 6348a793936e..9e81e0dfb4ec 100644
--- a/net/ipv4/netfilter/nf_nat_rule.c
+++ b/net/ipv4/netfilter/nf_nat_rule.c
@@ -28,7 +28,7 @@
                          (1 << NF_INET_POST_ROUTING) | \
                          (1 << NF_INET_LOCAL_OUT))
 
-static struct
+static const struct
 {
         struct ipt_replace repl;
         struct ipt_standard entries[3];
@@ -58,11 +58,11 @@ static struct
         .term = IPT_ERROR_INIT,                 /* ERROR */
 };
 
-static struct xt_table nat_table = {
+static const struct xt_table nat_table = {
         .name           = "nat",
         .valid_hooks    = NAT_VALID_HOOKS,
         .me             = THIS_MODULE,
-        .af             = AF_INET,
+        .af             = NFPROTO_IPV4,
 };
 
 /* Source NAT */
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index 5567bd0d0750..5f41d017ddd8 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -251,7 +251,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_in,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_PRE_ROUTING,
                 .priority       = NF_IP_PRI_NAT_DST,
         },
@@ -259,7 +259,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_out,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_POST_ROUTING,
                 .priority       = NF_IP_PRI_NAT_SRC,
         },
@@ -267,7 +267,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_local_fn,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_OUT,
                 .priority       = NF_IP_PRI_NAT_DST,
         },
@@ -275,7 +275,7 @@ static struct nf_hook_ops nf_nat_ops[] __read_mostly = {
         {
                 .hook           = nf_nat_fn,
                 .owner          = THIS_MODULE,
-                .pf             = PF_INET,
+                .pf             = NFPROTO_IPV4,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP_PRI_NAT_SRC,
         },