Merge branch 'master' of git://dev.medozas.de/linux

diff --combined include/linux/netfilter/x_tables.h
index 9d671ebf0605ed28e9797721be636c895c4c06fa,fdd3342c123597a669006ae1f704c2e047e4009e..a0a144a6c6d939f50685350020799e785b21546e
--- 1/include/linux/netfilter/x_tables.h
--- 2/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@@ -93,7 -93,8 +93,7 @@@ struct _xt_align 
        __u64 u64;
  };
  
 -#define XT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1))        \
 -                      & ~(__alignof__(struct _xt_align)-1))
 +#define XT_ALIGN(s) ALIGN((s), __alignof__(struct _xt_align))
  
  /* Standard return verdict, or do jump. */
  #define XT_STANDARD_TARGET ""
@@@ -360,6 -361,7 +360,7 @@@ struct xt_table 
        struct module *me;
  
        u_int8_t af;            /* address/protocol family */
+       int priority;           /* hook order */
  
        /* A unique name... */
        const char name[XT_TABLE_MAXNAMELEN];
@@@ -521,6 -523,9 +522,9 @@@ static inline unsigned long ifname_comp
        return ret;
  }
  
+ extern struct nf_hook_ops *xt_hook_link(const struct xt_table *, nf_hookfn *);
+ extern void xt_hook_unlink(const struct xt_table *, struct nf_hook_ops *);
+ 
  #ifdef CONFIG_COMPAT
  #include <net/compat.h>
  
@@@ -561,7 -566,11 +565,7 @@@ struct compat_xt_entry_target 
   * current task alignment */
  
  struct compat_xt_counters {
 -#if defined(CONFIG_X86_64) || defined(CONFIG_IA64)
 -      u_int32_t cnt[4];
 -#else
 -      u_int64_t cnt[2];
 -#endif
 +      compat_u64 pcnt, bcnt;                  /* Packet and byte counters */
  };
  
  struct compat_xt_counters_info {
@@@ -570,14 -579,8 +574,14 @@@
        struct compat_xt_counters counters[0];
  };
  
 -#define COMPAT_XT_ALIGN(s) (((s) + (__alignof__(struct compat_xt_counters)-1)) \
 -              & ~(__alignof__(struct compat_xt_counters)-1))
 +struct _compat_xt_align {
 +      __u8 u8;
 +      __u16 u16;
 +      __u32 u32;
 +      compat_u64 u64;
 +};
 +
 +#define COMPAT_XT_ALIGN(s) ALIGN((s), __alignof__(struct _compat_xt_align))
  
  extern void xt_compat_lock(u_int8_t af);
  extern void xt_compat_unlock(u_int8_t af);

diff --combined net/netfilter/x_tables.c
index 5c564ff10a3b8b123c35591960a98c58a2bfc525,dc2e05cb54c088f90c98662b38453825a4b5a6f2..255ab0657ce83ce709db267e0b4c9f28f72a7f45
--- 1/net/netfilter/x_tables.c
--- 2/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@@ -26,7 -26,9 +26,9 @@@
  
  #include <linux/netfilter/x_tables.h>
  #include <linux/netfilter_arp.h>
- 
+ #include <linux/netfilter_ipv4/ip_tables.h>
+ #include <linux/netfilter_ipv6/ip6_tables.h>
+ #include <linux/netfilter_arp/arp_tables.h>
  
  MODULE_LICENSE("GPL");
  MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
@@@ -364,7 -366,7 +366,7 @@@ int xt_check_match(struct xt_mtchk_para
                 * ebt_among is exempt from centralized matchsize checking
                 * because it uses a dynamic-size data set.
                 */
 -              pr_err("%s_tables: %s match: invalid size %Zu != %u\n",
 +              pr_err("%s_tables: %s match: invalid size %u != %u\n",
                       xt_prefix[par->family], par->match->name,
                       XT_ALIGN(par->match->matchsize), size);
                return -EINVAL;
@@@ -514,7 -516,7 +516,7 @@@ int xt_check_target(struct xt_tgchk_par
                    unsigned int size, u_int8_t proto, bool inv_proto)
  {
        if (XT_ALIGN(par->target->targetsize) != size) {
 -              pr_err("%s_tables: %s target: invalid size %Zu != %u\n",
 +              pr_err("%s_tables: %s target: invalid size %u != %u\n",
                       xt_prefix[par->family], par->target->name,
                       XT_ALIGN(par->target->targetsize), size);
                return -EINVAL;
@@@ -1091,6 -1093,60 +1093,60 @@@ static const struct file_operations xt_
  
  #endif /* CONFIG_PROC_FS */
  
+ /**
+  * xt_hook_link - set up hooks for a new table
+  * @table:    table with metadata needed to set up hooks
+  * @fn:               Hook function
+  *
+  * This function will take care of creating and registering the necessary
+  * Netfilter hooks for XT tables.
+  */
+ struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn)
+ {
+       unsigned int hook_mask = table->valid_hooks;
+       uint8_t i, num_hooks = hweight32(hook_mask);
+       uint8_t hooknum;
+       struct nf_hook_ops *ops;
+       int ret;
+ 
+       ops = kmalloc(sizeof(*ops) * num_hooks, GFP_KERNEL);
+       if (ops == NULL)
+               return ERR_PTR(-ENOMEM);
+ 
+       for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;
+            hook_mask >>= 1, ++hooknum) {
+               if (!(hook_mask & 1))
+                       continue;
+               ops[i].hook     = fn;
+               ops[i].owner    = table->me;
+               ops[i].pf       = table->af;
+               ops[i].hooknum  = hooknum;
+               ops[i].priority = table->priority;
+               ++i;
+       }
+ 
+       ret = nf_register_hooks(ops, num_hooks);
+       if (ret < 0) {
+               kfree(ops);
+               return ERR_PTR(ret);
+       }
+ 
+       return ops;
+ }
+ EXPORT_SYMBOL_GPL(xt_hook_link);
+ 
+ /**
+  * xt_hook_unlink - remove hooks for a table
+  * @ops:      nf_hook_ops array as returned by nf_hook_link
+  * @hook_mask:        the very same mask that was passed to nf_hook_link
+  */
+ void xt_hook_unlink(const struct xt_table *table, struct nf_hook_ops *ops)
+ {
+       nf_unregister_hooks(ops, hweight32(table->valid_hooks));
+       kfree(ops);
+ }
+ EXPORT_SYMBOL_GPL(xt_hook_unlink);
+ 
  int xt_proto_init(struct net *net, u_int8_t af)
  {
  #ifdef CONFIG_PROC_FS