netfilter: xtables: change xt_match.checkentry return type
[linux-2.6.git] / net / ipv4 / netfilter / ip_tables.c
index fdefae6..771ffa7 100644 (file)
@@ -8,6 +8,7 @@
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/cache.h>
 #include <linux/capability.h>
 #include <linux/skbuff.h>
@@ -27,6 +28,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter_ipv4/ip_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -37,13 +39,13 @@ MODULE_DESCRIPTION("IPv4 packet filter");
 /*#define DEBUG_IP_FIREWALL_USER*/
 
 #ifdef DEBUG_IP_FIREWALL
-#define dprintf(format, args...)  printk(format , ## args)
+#define dprintf(format, args...) pr_info(format , ## args)
 #else
 #define dprintf(format, args...)
 #endif
 
 #ifdef DEBUG_IP_FIREWALL_USER
-#define duprintf(format, args...) printk(format , ## args)
+#define duprintf(format, args...) pr_info(format , ## args)
 #else
 #define duprintf(format, args...)
 #endif
@@ -65,6 +67,12 @@ do {                                                         \
 #define inline
 #endif
 
+void *ipt_alloc_initial_table(const struct xt_table *info)
+{
+       return xt_alloc_initial_table(ipt, IPT);
+}
+EXPORT_SYMBOL_GPL(ipt_alloc_initial_table);
+
 /*
    We keep a set of rules for each CPU, so we can avoid write-locking
    them in the softirq when updating the counters and therefore
@@ -88,9 +96,9 @@ ip_packet_match(const struct iphdr *ip,
 #define FWINV(bool, invflg) ((bool) ^ !!(ipinfo->invflags & (invflg)))
 
        if (FWINV((ip->saddr&ipinfo->smsk.s_addr) != ipinfo->src.s_addr,
-                 IPT_INV_SRCIP)
-           || FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
-                    IPT_INV_DSTIP)) {
+                 IPT_INV_SRCIP) ||
+           FWINV((ip->daddr&ipinfo->dmsk.s_addr) != ipinfo->dst.s_addr,
+                 IPT_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");
 
                dprintf("SRC: %pI4. Mask: %pI4. Target: %pI4.%s\n",
@@ -121,8 +129,8 @@ ip_packet_match(const struct iphdr *ip,
        }
 
        /* Check specific protocol */
-       if (ipinfo->proto
-           && FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
+       if (ipinfo->proto &&
+           FWINV(ip->protocol != ipinfo->proto, IPT_INV_PROTO)) {
                dprintf("Packet protocol %hi does not match %hi.%s\n",
                        ip->protocol, ipinfo->proto,
                        ipinfo->invflags&IPT_INV_PROTO ? " (INV)":"");
@@ -160,15 +168,14 @@ static unsigned int
 ipt_error(struct sk_buff *skb, const struct xt_target_param *par)
 {
        if (net_ratelimit())
-               printk("ip_tables: error: `%s'\n",
-                      (const char *)par->targinfo);
+               pr_info("error: `%s'\n", (const char *)par->targinfo);
 
        return NF_DROP;
 }
 
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
+do_match(const struct ipt_entry_match *m, const struct sk_buff *skb,
         struct xt_match_param *par)
 {
        par->match     = m->u.kernel.match;
@@ -183,26 +190,28 @@ do_match(struct ipt_entry_match *m, const struct sk_buff *skb,
 
 /* Performance critical */
 static inline struct ipt_entry *
-get_entry(void *base, unsigned int offset)
+get_entry(const void *base, unsigned int offset)
 {
        return (struct ipt_entry *)(base + offset);
 }
 
 /* All zeroes == unconditional rule. */
 /* Mildly perf critical (only if packet tracing is on) */
-static inline int
-unconditional(const struct ipt_ip *ip)
+static inline bool unconditional(const struct ipt_ip *ip)
 {
-       unsigned int i;
+       static const struct ipt_ip uncond;
 
-       for (i = 0; i < sizeof(*ip)/sizeof(__u32); i++)
-               if (((__u32 *)ip)[i])
-                       return 0;
-
-       return 1;
+       return memcmp(ip, &uncond, sizeof(uncond)) == 0;
 #undef FWINV
 }
 
+/* for const-correctness */
+static inline const struct ipt_entry_target *
+ipt_get_target_c(const struct ipt_entry *e)
+{
+       return ipt_get_target((struct ipt_entry *)e);
+}
+
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
     defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 static const char *const hooknames[] = {
@@ -237,11 +246,11 @@ static struct nf_loginfo trace_loginfo = {
 
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
-get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
+get_chainname_rulenum(const struct ipt_entry *s, const struct ipt_entry *e,
                      const char *hookname, const char **chainname,
                      const char **comment, unsigned int *rulenum)
 {
-       struct ipt_standard_target *t = (void *)ipt_get_target(s);
+       const struct ipt_standard_target *t = (void *)ipt_get_target_c(s);
 
        if (strcmp(t->target.u.kernel.target->name, IPT_ERROR_TARGET) == 0) {
                /* Head of user chain: ERROR target with chainname */
@@ -250,11 +259,11 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
        } else if (s == e) {
                (*rulenum)++;
 
-               if (s->target_offset == sizeof(struct ipt_entry)
-                  && strcmp(t->target.u.kernel.target->name,
-                            IPT_STANDARD_TARGET) == 0
-                  && t->verdict < 0
-                  && unconditional(&s->ip)) {
+               if (s->target_offset == sizeof(struct ipt_entry) &&
+                   strcmp(t->target.u.kernel.target->name,
+                          IPT_STANDARD_TARGET) == 0 &&
+                  t->verdict < 0 &&
+                  unconditional(&s->ip)) {
                        /* Tail of chains: STANDARD target (return/policy) */
                        *comment = *chainname == hookname
                                ? comments[NF_IP_TRACE_COMMENT_POLICY]
@@ -267,17 +276,18 @@ get_chainname_rulenum(struct ipt_entry *s, struct ipt_entry *e,
        return 0;
 }
 
-static void trace_packet(struct sk_buff *skb,
+static void trace_packet(const struct sk_buff *skb,
                         unsigned int hook,
                         const struct net_device *in,
                         const struct net_device *out,
                         const char *tablename,
-                        struct xt_table_info *private,
-                        struct ipt_entry *e)
+                        const struct xt_table_info *private,
+                        const struct ipt_entry *e)
 {
-       void *table_base;
+       const void *table_base;
        const struct ipt_entry *root;
        const char *hookname, *chainname, *comment;
+       const struct ipt_entry *iter;
        unsigned int rulenum = 0;
 
        table_base = private->entries[smp_processor_id()];
@@ -286,10 +296,10 @@ static void trace_packet(struct sk_buff *skb,
        hookname = chainname = hooknames[hook];
        comment = comments[NF_IP_TRACE_COMMENT_RULE];
 
-       IPT_ENTRY_ITERATE(root,
-                         private->size - private->hook_entry[hook],
-                         get_chainname_rulenum,
-                         e, hookname, &chainname, &comment, &rulenum);
+       xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
+               if (get_chainname_rulenum(iter, e, hookname,
+                   &chainname, &comment, &rulenum) != 0)
+                       break;
 
        nf_log_packet(AF_INET, hook, skb, in, out, &trace_loginfo,
                      "TRACE: %s:%s:%s:%u ",
@@ -315,20 +325,18 @@ ipt_do_table(struct sk_buff *skb,
 
        static const char nulldevname[IFNAMSIZ] __attribute__((aligned(sizeof(long))));
        const struct iphdr *ip;
-       u_int16_t datalen;
        bool hotdrop = false;
        /* Initializing verdict to NF_DROP keeps gcc happy. */
        unsigned int verdict = NF_DROP;
        const char *indev, *outdev;
-       void *table_base;
+       const void *table_base;
        struct ipt_entry *e, *back;
-       struct xt_table_info *private;
+       const struct xt_table_info *private;
        struct xt_match_param mtpar;
        struct xt_target_param tgpar;
 
        /* Initialization */
        ip = ip_hdr(skb);
-       datalen = skb->len - ip->ihl * 4;
        indev = in ? in->name : nulldevname;
        outdev = out ? out->name : nulldevname;
        /* We handle fragments by dealing with the first fragment as
@@ -356,17 +364,22 @@ ipt_do_table(struct sk_buff *skb,
        back = get_entry(table_base, private->underflow[hook]);
 
        do {
-               struct ipt_entry_target *t;
+               const struct ipt_entry_target *t;
+               const struct xt_entry_match *ematch;
 
                IP_NF_ASSERT(e);
                IP_NF_ASSERT(back);
                if (!ip_packet_match(ip, indev, outdev,
-                   &e->ip, mtpar.fragoff) ||
-                   IPT_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
+                   &e->ip, mtpar.fragoff)) {
+ no_match:
                        e = ipt_next_entry(e);
                        continue;
                }
 
+               xt_ematch_foreach(ematch, e)
+                       if (do_match(ematch, skb, &mtpar) != 0)
+                               goto no_match;
+
                ADD_COUNTER(e->counters, ntohs(ip->tot_len), 1);
 
                t = ipt_get_target(e);
@@ -394,8 +407,8 @@ ipt_do_table(struct sk_buff *skb,
                                back = get_entry(table_base, back->comefrom);
                                continue;
                        }
-                       if (table_base + v != ipt_next_entry(e)
-                           && !(e->ip.flags & IPT_F_GOTO)) {
+                       if (table_base + v != ipt_next_entry(e) &&
+                           !(e->ip.flags & IPT_F_GOTO)) {
                                /* Save old back ptr in next entry */
                                struct ipt_entry *next = ipt_next_entry(e);
                                next->comefrom = (void *)back - table_base;
@@ -427,8 +440,6 @@ ipt_do_table(struct sk_buff *skb,
 #endif
                /* Target might have changed stuff. */
                ip = ip_hdr(skb);
-               datalen = skb->len - ip->ihl * 4;
-
                if (verdict == IPT_CONTINUE)
                        e = ipt_next_entry(e);
                else
@@ -451,7 +462,7 @@ ipt_do_table(struct sk_buff *skb,
 /* Figures out from what hook each rule can be called: returns 0 if
    there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct xt_table_info *newinfo,
+mark_source_chains(const struct xt_table_info *newinfo,
                   unsigned int valid_hooks, void *entry0)
 {
        unsigned int hook;
@@ -469,8 +480,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                e->counters.pcnt = pos;
 
                for (;;) {
-                       struct ipt_standard_target *t
-                               = (void *)ipt_get_target(e);
+                       const struct ipt_standard_target *t
+                               = (void *)ipt_get_target_c(e);
                        int visited = e->comefrom & (1 << hook);
 
                        if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
@@ -481,11 +492,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                        e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
 
                        /* Unconditional return/END. */
-                       if ((e->target_offset == sizeof(struct ipt_entry)
-                           && (strcmp(t->target.u.user.name,
-                                      IPT_STANDARD_TARGET) == 0)
-                           && t->verdict < 0
-                           && unconditional(&e->ip)) || visited) {
+                       if ((e->target_offset == sizeof(struct ipt_entry) &&
+                            (strcmp(t->target.u.user.name,
+                                    IPT_STANDARD_TARGET) == 0) &&
+                            t->verdict < 0 && unconditional(&e->ip)) ||
+                           visited) {
                                unsigned int oldpos, size;
 
                                if ((strcmp(t->target.u.user.name,
@@ -532,8 +543,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                int newpos = t->verdict;
 
                                if (strcmp(t->target.u.user.name,
-                                          IPT_STANDARD_TARGET) == 0
-                                   && newpos >= 0) {
+                                          IPT_STANDARD_TARGET) == 0 &&
+                                   newpos >= 0) {
                                        if (newpos > newinfo->size -
                                                sizeof(struct ipt_entry)) {
                                                duprintf("mark_source_chains: "
@@ -560,30 +571,26 @@ mark_source_chains(struct xt_table_info *newinfo,
        return 1;
 }
 
-static int
-cleanup_match(struct ipt_entry_match *m, unsigned int *i)
+static void cleanup_match(struct ipt_entry_match *m, struct net *net)
 {
        struct xt_mtdtor_param par;
 
-       if (i && (*i)-- == 0)
-               return 1;
-
+       par.net       = net;
        par.match     = m->u.kernel.match;
        par.matchinfo = m->data;
        par.family    = NFPROTO_IPV4;
        if (par.match->destroy != NULL)
                par.match->destroy(&par);
        module_put(par.match->me);
-       return 0;
 }
 
 static int
-check_entry(struct ipt_entry *e, const char *name)
+check_entry(const struct ipt_entry *e, const char *name)
 {
-       struct ipt_entry_target *t;
+       const struct ipt_entry_target *t;
 
        if (!ip_checkentry(&e->ip)) {
-               duprintf("ip_tables: ip check failed %p %s.\n", e, name);
+               duprintf("ip check failed %p %s.\n", e, name);
                return -EINVAL;
        }
 
@@ -591,7 +598,7 @@ check_entry(struct ipt_entry *e, const char *name)
            e->next_offset)
                return -EINVAL;
 
-       t = ipt_get_target(e);
+       t = ipt_get_target_c(e);
        if (e->target_offset + t->u.target_size > e->next_offset)
                return -EINVAL;
 
@@ -599,8 +606,7 @@ check_entry(struct ipt_entry *e, const char *name)
 }
 
 static int
-check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
-           unsigned int *i)
+check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 {
        const struct ipt_ip *ip = par->entryinfo;
        int ret;
@@ -611,31 +617,27 @@ check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
        ret = xt_check_match(par, m->u.match_size - sizeof(*m),
              ip->proto, ip->invflags & IPT_INV_PROTO);
        if (ret < 0) {
-               duprintf("ip_tables: check failed for `%s'.\n",
-                        par.match->name);
+               duprintf("check failed for `%s'.\n", par.match->name);
                return ret;
        }
-       ++*i;
        return 0;
 }
 
 static int
-find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par,
-                unsigned int *i)
+find_check_match(struct ipt_entry_match *m, struct xt_mtchk_param *par)
 {
        struct xt_match *match;
        int ret;
 
-       match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
-                                                     m->u.user.revision),
-                                       "ipt_%s", m->u.user.name);
-       if (IS_ERR(match) || !match) {
+       match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
+                                     m->u.user.revision);
+       if (IS_ERR(match)) {
                duprintf("find_check_match: `%s' not found\n", m->u.user.name);
-               return match ? PTR_ERR(match) : -ENOENT;
+               return PTR_ERR(match);
        }
        m->u.kernel.match = match;
 
-       ret = check_match(m, par, i);
+       ret = check_match(m, par);
        if (ret)
                goto err;
 
@@ -645,10 +647,11 @@ err:
        return ret;
 }
 
-static int check_target(struct ipt_entry *e, const char *name)
+static int check_target(struct ipt_entry *e, struct net *net, const char *name)
 {
        struct ipt_entry_target *t = ipt_get_target(e);
        struct xt_tgchk_param par = {
+               .net       = net,
                .table     = name,
                .entryinfo = e,
                .target    = t->u.kernel.target,
@@ -661,7 +664,7 @@ static int check_target(struct ipt_entry *e, const char *name)
        ret = xt_check_target(&par, t->u.target_size - sizeof(*t),
              e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
        if (ret < 0) {
-               duprintf("ip_tables: check failed for `%s'.\n",
+               duprintf("check failed for `%s'.\n",
                         t->u.kernel.target->name);
                return ret;
        }
@@ -669,66 +672,86 @@ static int check_target(struct ipt_entry *e, const char *name)
 }
 
 static int
-find_check_entry(struct ipt_entry *e, const char *name, unsigned int size,
-                unsigned int *i)
+find_check_entry(struct ipt_entry *e, struct net *net, const char *name,
+                unsigned int size)
 {
        struct ipt_entry_target *t;
        struct xt_target *target;
        int ret;
        unsigned int j;
        struct xt_mtchk_param mtpar;
+       struct xt_entry_match *ematch;
 
        ret = check_entry(e, name);
        if (ret)
                return ret;
 
        j = 0;
+       mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
        mtpar.hook_mask = e->comefrom;
        mtpar.family    = NFPROTO_IPV4;
-       ret = IPT_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
-       if (ret != 0)
-               goto cleanup_matches;
+       xt_ematch_foreach(ematch, e) {
+               ret = find_check_match(ematch, &mtpar);
+               if (ret != 0)
+                       goto cleanup_matches;
+               ++j;
+       }
 
        t = ipt_get_target(e);
-       target = try_then_request_module(xt_find_target(AF_INET,
-                                                       t->u.user.name,
-                                                       t->u.user.revision),
-                                        "ipt_%s", t->u.user.name);
-       if (IS_ERR(target) || !target) {
+       target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
+                                       t->u.user.revision);
+       if (IS_ERR(target)) {
                duprintf("find_check_entry: `%s' not found\n", t->u.user.name);
-               ret = target ? PTR_ERR(target) : -ENOENT;
+               ret = PTR_ERR(target);
                goto cleanup_matches;
        }
        t->u.kernel.target = target;
 
-       ret = check_target(e, name);
+       ret = check_target(e, net, name);
        if (ret)
                goto err;
-
-       (*i)++;
        return 0;
  err:
        module_put(t->u.kernel.target->me);
  cleanup_matches:
-       IPT_MATCH_ITERATE(e, cleanup_match, &j);
+       xt_ematch_foreach(ematch, e) {
+               if (j-- == 0)
+                       break;
+               cleanup_match(ematch, net);
+       }
        return ret;
 }
 
+static bool check_underflow(const struct ipt_entry *e)
+{
+       const struct ipt_entry_target *t;
+       unsigned int verdict;
+
+       if (!unconditional(&e->ip))
+               return false;
+       t = ipt_get_target_c(e);
+       if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
+               return false;
+       verdict = ((struct ipt_standard_target *)t)->verdict;
+       verdict = -verdict - 1;
+       return verdict == NF_DROP || verdict == NF_ACCEPT;
+}
+
 static int
 check_entry_size_and_hooks(struct ipt_entry *e,
                           struct xt_table_info *newinfo,
-                          unsigned char *base,
-                          unsigned char *limit,
+                          const unsigned char *base,
+                          const unsigned char *limit,
                           const unsigned int *hook_entries,
                           const unsigned int *underflows,
-                          unsigned int *i)
+                          unsigned int valid_hooks)
 {
        unsigned int h;
 
-       if ((unsigned long)e % __alignof__(struct ipt_entry) != 0
-           || (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
+       if ((unsigned long)e % __alignof__(struct ipt_entry) != 0 ||
+           (unsigned char *)e + sizeof(struct ipt_entry) >= limit) {
                duprintf("Bad offset %p\n", e);
                return -EINVAL;
        }
@@ -742,62 +765,60 @@ check_entry_size_and_hooks(struct ipt_entry *e,
 
        /* Check hooks & underflows */
        for (h = 0; h < NF_INET_NUMHOOKS; h++) {
+               if (!(valid_hooks & (1 << h)))
+                       continue;
                if ((unsigned char *)e - base == hook_entries[h])
                        newinfo->hook_entry[h] = hook_entries[h];
-               if ((unsigned char *)e - base == underflows[h])
+               if ((unsigned char *)e - base == underflows[h]) {
+                       if (!check_underflow(e)) {
+                               pr_err("Underflows must be unconditional and "
+                                      "use the STANDARD target with "
+                                      "ACCEPT/DROP\n");
+                               return -EINVAL;
+                       }
                        newinfo->underflow[h] = underflows[h];
+               }
        }
 
-       /* FIXME: underflows must be unconditional, standard verdicts
-          < 0 (not IPT_RETURN). --RR */
-
        /* Clear counters and comefrom */
        e->counters = ((struct xt_counters) { 0, 0 });
        e->comefrom = 0;
-
-       (*i)++;
        return 0;
 }
 
-static int
-cleanup_entry(struct ipt_entry *e, unsigned int *i)
+static void
+cleanup_entry(struct ipt_entry *e, struct net *net)
 {
        struct xt_tgdtor_param par;
        struct ipt_entry_target *t;
-
-       if (i && (*i)-- == 0)
-               return 1;
+       struct xt_entry_match *ematch;
 
        /* Cleanup all matches */
-       IPT_MATCH_ITERATE(e, cleanup_match, NULL);
+       xt_ematch_foreach(ematch, e)
+               cleanup_match(ematch, net);
        t = ipt_get_target(e);
 
+       par.net      = net;
        par.target   = t->u.kernel.target;
        par.targinfo = t->data;
        par.family   = NFPROTO_IPV4;
        if (par.target->destroy != NULL)
                par.target->destroy(&par);
        module_put(par.target->me);
-       return 0;
 }
 
 /* Checks and translates the user-supplied table segment (held in
    newinfo) */
 static int
-translate_table(const char *name,
-               unsigned int valid_hooks,
-               struct xt_table_info *newinfo,
-               void *entry0,
-               unsigned int size,
-               unsigned int number,
-               const unsigned int *hook_entries,
-               const unsigned int *underflows)
+translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
+                const struct ipt_replace *repl)
 {
+       struct ipt_entry *iter;
        unsigned int i;
-       int ret;
+       int ret = 0;
 
-       newinfo->size = size;
-       newinfo->number = number;
+       newinfo->size = repl->size;
+       newinfo->number = repl->num_entries;
 
        /* Init all hooks to impossible value. */
        for (i = 0; i < NF_INET_NUMHOOKS; i++) {
@@ -808,49 +829,58 @@ translate_table(const char *name,
        duprintf("translate_table: size %u\n", newinfo->size);
        i = 0;
        /* Walk through entries, checking offsets. */
-       ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                               check_entry_size_and_hooks,
-                               newinfo,
-                               entry0,
-                               entry0 + size,
-                               hook_entries, underflows, &i);
-       if (ret != 0)
-               return ret;
+       xt_entry_foreach(iter, entry0, newinfo->size) {
+               ret = check_entry_size_and_hooks(iter, newinfo, entry0,
+                                                entry0 + repl->size,
+                                                repl->hook_entry,
+                                                repl->underflow,
+                                                repl->valid_hooks);
+               if (ret != 0)
+                       return ret;
+               ++i;
+       }
 
-       if (i != number) {
+       if (i != repl->num_entries) {
                duprintf("translate_table: %u not %u entries\n",
-                        i, number);
+                        i, repl->num_entries);
                return -EINVAL;
        }
 
        /* Check hooks all assigned */
        for (i = 0; i < NF_INET_NUMHOOKS; i++) {
                /* Only hooks which are valid */
-               if (!(valid_hooks & (1 << i)))
+               if (!(repl->valid_hooks & (1 << i)))
                        continue;
                if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                        duprintf("Invalid hook entry %u %u\n",
-                                i, hook_entries[i]);
+                                i, repl->hook_entry[i]);
                        return -EINVAL;
                }
                if (newinfo->underflow[i] == 0xFFFFFFFF) {
                        duprintf("Invalid underflow %u %u\n",
-                                i, underflows[i]);
+                                i, repl->underflow[i]);
                        return -EINVAL;
                }
        }
 
-       if (!mark_source_chains(newinfo, valid_hooks, entry0))
+       if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
                return -ELOOP;
 
        /* Finally, each sanity check must pass */
        i = 0;
-       ret = IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                               find_check_entry, name, size, &i);
+       xt_entry_foreach(iter, entry0, newinfo->size) {
+               ret = find_check_entry(iter, net, repl->name, repl->size);
+               if (ret != 0)
+                       break;
+               ++i;
+       }
 
        if (ret != 0) {
-               IPT_ENTRY_ITERATE(entry0, newinfo->size,
-                               cleanup_entry, &i);
+               xt_entry_foreach(iter, entry0, newinfo->size) {
+                       if (i-- == 0)
+                               break;
+                       cleanup_entry(iter, net);
+               }
                return ret;
        }
 
@@ -863,33 +893,11 @@ translate_table(const char *name,
        return ret;
 }
 
-/* Gets counters. */
-static inline int
-add_entry_to_counter(const struct ipt_entry *e,
-                    struct xt_counters total[],
-                    unsigned int *i)
-{
-       ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-       (*i)++;
-       return 0;
-}
-
-static inline int
-set_entry_to_counter(const struct ipt_entry *e,
-                    struct ipt_counters total[],
-                    unsigned int *i)
-{
-       SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-
-       (*i)++;
-       return 0;
-}
-
 static void
 get_counters(const struct xt_table_info *t,
             struct xt_counters counters[])
 {
+       struct ipt_entry *iter;
        unsigned int cpu;
        unsigned int i;
        unsigned int curcpu;
@@ -905,32 +913,32 @@ get_counters(const struct xt_table_info *t,
        curcpu = smp_processor_id();
 
        i = 0;
-       IPT_ENTRY_ITERATE(t->entries[curcpu],
-                         t->size,
-                         set_entry_to_counter,
-                         counters,
-                         &i);
+       xt_entry_foreach(iter, t->entries[curcpu], t->size) {
+               SET_COUNTER(counters[i], iter->counters.bcnt,
+                           iter->counters.pcnt);
+               ++i;
+       }
 
        for_each_possible_cpu(cpu) {
                if (cpu == curcpu)
                        continue;
                i = 0;
                xt_info_wrlock(cpu);
-               IPT_ENTRY_ITERATE(t->entries[cpu],
-                                 t->size,
-                                 add_entry_to_counter,
-                                 counters,
-                                 &i);
+               xt_entry_foreach(iter, t->entries[cpu], t->size) {
+                       ADD_COUNTER(counters[i], iter->counters.bcnt,
+                                   iter->counters.pcnt);
+                       ++i; /* macro does multi eval of i */
+               }
                xt_info_wrunlock(cpu);
        }
        local_bh_enable();
 }
 
-static struct xt_counters * alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
        unsigned int countersize;
        struct xt_counters *counters;
-       struct xt_table_info *private = table->private;
+       const struct xt_table_info *private = table->private;
 
        /* We need atomic snapshot of counters: rest doesn't change
           (other than comefrom, which userspace doesn't care
@@ -948,11 +956,11 @@ static struct xt_counters * alloc_counters(struct xt_table *table)
 
 static int
 copy_entries_to_user(unsigned int total_size,
-                    struct xt_table *table,
+                    const struct xt_table *table,
                     void __user *userptr)
 {
        unsigned int off, num;
-       struct ipt_entry *e;
+       const struct ipt_entry *e;
        struct xt_counters *counters;
        const struct xt_table_info *private = table->private;
        int ret = 0;
@@ -1004,7 +1012,7 @@ copy_entries_to_user(unsigned int total_size,
                        }
                }
 
-               t = ipt_get_target(e);
+               t = ipt_get_target_c(e);
                if (copy_to_user(userptr + off + e->target_offset
                                 + offsetof(struct ipt_entry_target,
                                            u.user.name),
@@ -1021,7 +1029,7 @@ copy_entries_to_user(unsigned int total_size,
 }
 
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
        int v = *(compat_int_t *)src;
 
@@ -1030,7 +1038,7 @@ static void compat_standard_from_user(void *dst, void *src)
        memcpy(dst, &v, sizeof(v));
 }
 
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
        compat_int_t cv = *(int *)src;
 
@@ -1039,25 +1047,20 @@ static int compat_standard_to_user(void __user *dst, void *src)
        return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
 
-static inline int
-compat_calc_match(struct ipt_entry_match *m, int *size)
-{
-       *size += xt_compat_match_offset(m->u.kernel.match);
-       return 0;
-}
-
-static int compat_calc_entry(struct ipt_entry *e,
+static int compat_calc_entry(const struct ipt_entry *e,
                             const struct xt_table_info *info,
-                            void *base, struct xt_table_info *newinfo)
+                            const void *base, struct xt_table_info *newinfo)
 {
-       struct ipt_entry_target *t;
+       const struct xt_entry_match *ematch;
+       const struct ipt_entry_target *t;
        unsigned int entry_offset;
        int off, i, ret;
 
        off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
        entry_offset = (void *)e - base;
-       IPT_MATCH_ITERATE(e, compat_calc_match, &off);
-       t = ipt_get_target(e);
+       xt_ematch_foreach(ematch, e)
+               off += xt_compat_match_offset(ematch->u.kernel.match);
+       t = ipt_get_target_c(e);
        off += xt_compat_target_offset(t->u.kernel.target);
        newinfo->size -= off;
        ret = xt_compat_add_offset(AF_INET, entry_offset, off);
@@ -1078,7 +1081,9 @@ static int compat_calc_entry(struct ipt_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                             struct xt_table_info *newinfo)
 {
+       struct ipt_entry *iter;
        void *loc_cpu_entry;
+       int ret;
 
        if (!newinfo || !info)
                return -EINVAL;
@@ -1087,13 +1092,17 @@ static int compat_table_info(const struct xt_table_info *info,
        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
        newinfo->initial_entries = 0;
        loc_cpu_entry = info->entries[raw_smp_processor_id()];
-       return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
-                                compat_calc_entry, info, loc_cpu_entry,
-                                newinfo);
+       xt_entry_foreach(iter, loc_cpu_entry, info->size) {
+               ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
+               if (ret != 0)
+                       return ret;
+       }
+       return 0;
 }
 #endif
 
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
        char name[IPT_TABLE_MAXNAMELEN];
        struct xt_table *t;
@@ -1118,10 +1127,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct ipt_getinfo info;
                const struct xt_table_info *private = t->private;
-
 #ifdef CONFIG_COMPAT
+               struct xt_table_info tmp;
+
                if (compat) {
-                       struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(AF_INET);
                        private = &tmp;
@@ -1153,7 +1162,8 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 
 static int
-get_entries(struct net *net, struct ipt_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ipt_get_entries __user *uptr,
+           const int *len)
 {
        int ret;
        struct ipt_get_entries get;
@@ -1201,6 +1211,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct xt_table_info *oldinfo;
        struct xt_counters *counters;
        void *loc_cpu_old_entry;
+       struct ipt_entry *iter;
 
        ret = 0;
        counters = vmalloc(num_counters * sizeof(struct xt_counters));
@@ -1243,8 +1254,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
        /* Decrease module usage counts and free resource */
        loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-       IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
-                         NULL);
+       xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
+               cleanup_entry(iter, net);
+
        xt_free_table_info(oldinfo);
        if (copy_to_user(counters_ptr, counters,
                         sizeof(struct xt_counters) * num_counters) != 0)
@@ -1263,12 +1275,13 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 
 static int
-do_replace(struct net *net, void __user *user, unsigned int len)
+do_replace(struct net *net, const void __user *user, unsigned int len)
 {
        int ret;
        struct ipt_replace tmp;
        struct xt_table_info *newinfo;
        void *loc_cpu_entry;
+       struct ipt_entry *iter;
 
        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                return -EFAULT;
@@ -1289,13 +1302,11 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
 
-       ret = translate_table(tmp.name, tmp.valid_hooks,
-                             newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                             tmp.hook_entry, tmp.underflow);
+       ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
        if (ret != 0)
                goto free_newinfo;
 
-       duprintf("ip_tables: Translated table\n");
+       duprintf("Translated table\n");
 
        ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
                           tmp.num_counters, tmp.counters);
@@ -1304,27 +1315,16 @@ do_replace(struct net *net, void __user *user, unsigned int len)
        return 0;
 
  free_newinfo_untrans:
-       IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+       xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+               cleanup_entry(iter, net);
  free_newinfo:
        xt_free_table_info(newinfo);
        return ret;
 }
 
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
-static int
-add_counter_to_entry(struct ipt_entry *e,
-                    const struct xt_counters addme[],
-                    unsigned int *i)
-{
-       ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-
-       (*i)++;
-       return 0;
-}
-
 static int
-do_add_counters(struct net *net, void __user *user, unsigned int len, int compat)
+do_add_counters(struct net *net, const void __user *user,
+                unsigned int len, int compat)
 {
        unsigned int i, curcpu;
        struct xt_counters_info tmp;
@@ -1337,6 +1337,7 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
        const struct xt_table_info *private;
        int ret = 0;
        void *loc_cpu_entry;
+       struct ipt_entry *iter;
 #ifdef CONFIG_COMPAT
        struct compat_xt_counters_info compat_tmp;
 
@@ -1394,11 +1395,10 @@ do_add_counters(struct net *net, void __user *user, unsigned int len, int compat
        curcpu = smp_processor_id();
        loc_cpu_entry = private->entries[curcpu];
        xt_info_wrlock(curcpu);
-       IPT_ENTRY_ITERATE(loc_cpu_entry,
-                         private->size,
-                         add_counter_to_entry,
-                         paddc,
-                         &i);
+       xt_entry_foreach(iter, loc_cpu_entry, private->size) {
+               ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
+               ++i;
+       }
        xt_info_wrunlock(curcpu);
  unlock_up_free:
        local_bh_enable();
@@ -1426,45 +1426,40 @@ struct compat_ipt_replace {
 static int
 compat_copy_entry_to_user(struct ipt_entry *e, void __user **dstptr,
                          unsigned int *size, struct xt_counters *counters,
-                         unsigned int *i)
+                         unsigned int i)
 {
        struct ipt_entry_target *t;
        struct compat_ipt_entry __user *ce;
        u_int16_t target_offset, next_offset;
        compat_uint_t origsize;
-       int ret;
+       const struct xt_entry_match *ematch;
+       int ret = 0;
 
-       ret = -EFAULT;
        origsize = *size;
        ce = (struct compat_ipt_entry __user *)*dstptr;
-       if (copy_to_user(ce, e, sizeof(struct ipt_entry)))
-               goto out;
-
-       if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
-               goto out;
+       if (copy_to_user(ce, e, sizeof(struct ipt_entry)) != 0 ||
+           copy_to_user(&ce->counters, &counters[i],
+           sizeof(counters[i])) != 0)
+               return -EFAULT;
 
        *dstptr += sizeof(struct compat_ipt_entry);
        *size -= sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 
-       ret = IPT_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
+       xt_ematch_foreach(ematch, e) {
+               ret = xt_compat_match_to_user(ematch, dstptr, size);
+               if (ret != 0)
+                       return ret;
+       }
        target_offset = e->target_offset - (origsize - *size);
-       if (ret)
-               goto out;
        t = ipt_get_target(e);
        ret = xt_compat_target_to_user(t, dstptr, size);
        if (ret)
-               goto out;
-       ret = -EFAULT;
+               return ret;
        next_offset = e->next_offset - (origsize - *size);
-       if (put_user(target_offset, &ce->target_offset))
-               goto out;
-       if (put_user(next_offset, &ce->next_offset))
-               goto out;
-
-       (*i)++;
+       if (put_user(target_offset, &ce->target_offset) != 0 ||
+           put_user(next_offset, &ce->next_offset) != 0)
+               return -EFAULT;
        return 0;
-out:
-       return ret;
 }
 
 static int
@@ -1472,61 +1467,45 @@ compat_find_calc_match(struct ipt_entry_match *m,
                       const char *name,
                       const struct ipt_ip *ip,
                       unsigned int hookmask,
-                      int *size, unsigned int *i)
+                      int *size)
 {
        struct xt_match *match;
 
-       match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
-                                                     m->u.user.revision),
-                                       "ipt_%s", m->u.user.name);
-       if (IS_ERR(match) || !match) {
+       match = xt_request_find_match(NFPROTO_IPV4, m->u.user.name,
+                                     m->u.user.revision);
+       if (IS_ERR(match)) {
                duprintf("compat_check_calc_match: `%s' not found\n",
                         m->u.user.name);
-               return match ? PTR_ERR(match) : -ENOENT;
+               return PTR_ERR(match);
        }
        m->u.kernel.match = match;
        *size += xt_compat_match_offset(match);
-
-       (*i)++;
-       return 0;
-}
-
-static int
-compat_release_match(struct ipt_entry_match *m, unsigned int *i)
-{
-       if (i && (*i)-- == 0)
-               return 1;
-
-       module_put(m->u.kernel.match->me);
        return 0;
 }
 
-static int
-compat_release_entry(struct compat_ipt_entry *e, unsigned int *i)
+static void compat_release_entry(struct compat_ipt_entry *e)
 {
        struct ipt_entry_target *t;
-
-       if (i && (*i)-- == 0)
-               return 1;
+       struct xt_entry_match *ematch;
 
        /* Cleanup all matches */
-       COMPAT_IPT_MATCH_ITERATE(e, compat_release_match, NULL);
+       xt_ematch_foreach(ematch, e)
+               module_put(ematch->u.kernel.match->me);
        t = compat_ipt_get_target(e);
        module_put(t->u.kernel.target->me);
-       return 0;
 }
 
 static int
 check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
                                  struct xt_table_info *newinfo,
                                  unsigned int *size,
-                                 unsigned char *base,
-                                 unsigned char *limit,
-                                 unsigned int *hook_entries,
-                                 unsigned int *underflows,
-                                 unsigned int *i,
+                                 const unsigned char *base,
+                                 const unsigned char *limit,
+                                 const unsigned int *hook_entries,
+                                 const unsigned int *underflows,
                                  const char *name)
 {
+       struct xt_entry_match *ematch;
        struct ipt_entry_target *t;
        struct xt_target *target;
        unsigned int entry_offset;
@@ -1534,8 +1513,8 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
        int ret, off, h;
 
        duprintf("check_compat_entry_size_and_hooks %p\n", e);
-       if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
-           || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+       if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0 ||
+           (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
                duprintf("Bad offset %p, limit = %p\n", e, limit);
                return -EINVAL;
        }
@@ -1555,20 +1534,21 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
        off = sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
        entry_offset = (void *)e - (void *)base;
        j = 0;
-       ret = COMPAT_IPT_MATCH_ITERATE(e, compat_find_calc_match, name,
-                                      &e->ip, e->comefrom, &off, &j);
-       if (ret != 0)
-               goto release_matches;
+       xt_ematch_foreach(ematch, e) {
+               ret = compat_find_calc_match(ematch, name,
+                                            &e->ip, e->comefrom, &off);
+               if (ret != 0)
+                       goto release_matches;
+               ++j;
+       }
 
        t = compat_ipt_get_target(e);
-       target = try_then_request_module(xt_find_target(AF_INET,
-                                                       t->u.user.name,
-                                                       t->u.user.revision),
-                                        "ipt_%s", t->u.user.name);
-       if (IS_ERR(target) || !target) {
+       target = xt_request_find_target(NFPROTO_IPV4, t->u.user.name,
+                                       t->u.user.revision);
+       if (IS_ERR(target)) {
                duprintf("check_compat_entry_size_and_hooks: `%s' not found\n",
                         t->u.user.name);
-               ret = target ? PTR_ERR(target) : -ENOENT;
+               ret = PTR_ERR(target);
                goto release_matches;
        }
        t->u.kernel.target = target;
@@ -1590,14 +1570,16 @@ check_compat_entry_size_and_hooks(struct compat_ipt_entry *e,
        /* Clear counters and comefrom */
        memset(&e->counters, 0, sizeof(e->counters));
        e->comefrom = 0;
-
-       (*i)++;
        return 0;
 
 out:
        module_put(t->u.kernel.target->me);
 release_matches:
-       IPT_MATCH_ITERATE(e, compat_release_match, &j);
+       xt_ematch_foreach(ematch, e) {
+               if (j-- == 0)
+                       break;
+               module_put(ematch->u.kernel.match->me);
+       }
        return ret;
 }
 
@@ -1611,6 +1593,7 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
        struct ipt_entry *de;
        unsigned int origsize;
        int ret, h;
+       struct xt_entry_match *ematch;
 
        ret = 0;
        origsize = *size;
@@ -1621,10 +1604,11 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
        *dstptr += sizeof(struct ipt_entry);
        *size += sizeof(struct ipt_entry) - sizeof(struct compat_ipt_entry);
 
-       ret = COMPAT_IPT_MATCH_ITERATE(e, xt_compat_match_from_user,
-                                      dstptr, size);
-       if (ret)
-               return ret;
+       xt_ematch_foreach(ematch, e) {
+               ret = xt_compat_match_from_user(ematch, dstptr, size);
+               if (ret != 0)
+                       return ret;
+       }
        de->target_offset = e->target_offset - (origsize - *size);
        t = compat_ipt_get_target(e);
        target = t->u.kernel.target;
@@ -1641,36 +1625,43 @@ compat_copy_entry_from_user(struct compat_ipt_entry *e, void **dstptr,
 }
 
 static int
-compat_check_entry(struct ipt_entry *e, const char *name,
-                                    unsigned int *i)
+compat_check_entry(struct ipt_entry *e, struct net *net, const char *name)
 {
+       struct xt_entry_match *ematch;
        struct xt_mtchk_param mtpar;
        unsigned int j;
-       int ret;
+       int ret = 0;
 
        j = 0;
+       mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ip;
        mtpar.hook_mask = e->comefrom;
        mtpar.family    = NFPROTO_IPV4;
-       ret = IPT_MATCH_ITERATE(e, check_match, &mtpar, &j);
-       if (ret)
-               goto cleanup_matches;
+       xt_ematch_foreach(ematch, e) {
+               ret = check_match(ematch, &mtpar);
+               if (ret != 0)
+                       goto cleanup_matches;
+               ++j;
+       }
 
-       ret = check_target(e, name);
+       ret = check_target(e, net, name);
        if (ret)
                goto cleanup_matches;
-
-       (*i)++;
        return 0;
 
  cleanup_matches:
-       IPT_MATCH_ITERATE(e, cleanup_match, &j);
+       xt_ematch_foreach(ematch, e) {
+               if (j-- == 0)
+                       break;
+               cleanup_match(ematch, net);
+       }
        return ret;
 }
 
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                      const char *name,
                       unsigned int valid_hooks,
                       struct xt_table_info **pinfo,
                       void **pentry0,
@@ -1682,6 +1673,8 @@ translate_compat_table(const char *name,
        unsigned int i, j;
        struct xt_table_info *newinfo, *info;
        void *pos, *entry0, *entry1;
+       struct compat_ipt_entry *iter0;
+       struct ipt_entry *iter1;
        unsigned int size;
        int ret;
 
@@ -1700,13 +1693,17 @@ translate_compat_table(const char *name,
        j = 0;
        xt_compat_lock(AF_INET);
        /* Walk through entries, checking offsets. */
-       ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
-                                      check_compat_entry_size_and_hooks,
-                                      info, &size, entry0,
-                                      entry0 + total_size,
-                                      hook_entries, underflows, &j, name);
-       if (ret != 0)
-               goto out_unlock;
+       xt_entry_foreach(iter0, entry0, total_size) {
+               ret = check_compat_entry_size_and_hooks(iter0, info, &size,
+                                                       entry0,
+                                                       entry0 + total_size,
+                                                       hook_entries,
+                                                       underflows,
+                                                       name);
+               if (ret != 0)
+                       goto out_unlock;
+               ++j;
+       }
 
        ret = -EINVAL;
        if (j != number) {
@@ -1745,9 +1742,12 @@ translate_compat_table(const char *name,
        entry1 = newinfo->entries[raw_smp_processor_id()];
        pos = entry1;
        size = total_size;
-       ret = COMPAT_IPT_ENTRY_ITERATE(entry0, total_size,
-                                      compat_copy_entry_from_user,
-                                      &pos, &size, name, newinfo, entry1);
+       xt_entry_foreach(iter0, entry0, total_size) {
+               ret = compat_copy_entry_from_user(iter0, &pos, &size,
+                                                 name, newinfo, entry1);
+               if (ret != 0)
+                       break;
+       }
        xt_compat_flush_offsets(AF_INET);
        xt_compat_unlock(AF_INET);
        if (ret)
@@ -1758,13 +1758,32 @@ translate_compat_table(const char *name,
                goto free_newinfo;
 
        i = 0;
-       ret = IPT_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
-                               name, &i);
+       xt_entry_foreach(iter1, entry1, newinfo->size) {
+               ret = compat_check_entry(iter1, net, name);
+               if (ret != 0)
+                       break;
+               ++i;
+       }
        if (ret) {
+               /*
+                * The first i matches need cleanup_entry (calls ->destroy)
+                * because they had called ->check already. The other j-i
+                * entries need only release.
+                */
+               int skip = i;
                j -= i;
-               COMPAT_IPT_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
-                                                 compat_release_entry, &j);
-               IPT_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+               xt_entry_foreach(iter0, entry0, newinfo->size) {
+                       if (skip-- > 0)
+                               continue;
+                       if (j-- == 0)
+                               break;
+                       compat_release_entry(iter0);
+               }
+               xt_entry_foreach(iter1, entry1, newinfo->size) {
+                       if (i-- == 0)
+                               break;
+                       cleanup_entry(iter1, net);
+               }
                xt_free_table_info(newinfo);
                return ret;
        }
@@ -1782,7 +1801,11 @@ translate_compat_table(const char *name,
 free_newinfo:
        xt_free_table_info(newinfo);
 out:
-       COMPAT_IPT_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+       xt_entry_foreach(iter0, entry0, total_size) {
+               if (j-- == 0)
+                       break;
+               compat_release_entry(iter0);
+       }
        return ret;
 out_unlock:
        xt_compat_flush_offsets(AF_INET);
@@ -1797,6 +1820,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
        struct compat_ipt_replace tmp;
        struct xt_table_info *newinfo;
        void *loc_cpu_entry;
+       struct ipt_entry *iter;
 
        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                return -EFAULT;
@@ -1819,7 +1843,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
 
-       ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+       ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                     &newinfo, &loc_cpu_entry, tmp.size,
                                     tmp.num_entries, tmp.hook_entry,
                                     tmp.underflow);
@@ -1835,7 +1859,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
        return 0;
 
  free_newinfo_untrans:
-       IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+       xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+               cleanup_entry(iter, net);
  free_newinfo:
        xt_free_table_info(newinfo);
        return ret;
@@ -1884,6 +1909,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
        int ret = 0;
        const void *loc_cpu_entry;
        unsigned int i = 0;
+       struct ipt_entry *iter;
 
        counters = alloc_counters(table);
        if (IS_ERR(counters))
@@ -1896,9 +1922,12 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
        loc_cpu_entry = private->entries[raw_smp_processor_id()];
        pos = userptr;
        size = total_size;
-       ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
-                               compat_copy_entry_to_user,
-                               &pos, &size, counters, &i);
+       xt_entry_foreach(iter, loc_cpu_entry, total_size) {
+               ret = compat_copy_entry_to_user(iter, &pos,
+                                               &size, counters, i++);
+               if (ret != 0)
+                       break;
+       }
 
        vfree(counters);
        return ret;
@@ -2051,7 +2080,8 @@ do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
        return ret;
 }
 
-struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
+struct xt_table *ipt_register_table(struct net *net,
+                                   const struct xt_table *table,
                                    const struct ipt_replace *repl)
 {
        int ret;
@@ -2071,11 +2101,7 @@ struct xt_table *ipt_register_table(struct net *net, struct xt_table *table,
        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
        memcpy(loc_cpu_entry, repl->entries, repl->size);
 
-       ret = translate_table(table->name, table->valid_hooks,
-                             newinfo, loc_cpu_entry, repl->size,
-                             repl->num_entries,
-                             repl->hook_entry,
-                             repl->underflow);
+       ret = translate_table(net, newinfo, loc_cpu_entry, repl);
        if (ret != 0)
                goto out_free;
 
@@ -2093,17 +2119,19 @@ out:
        return ERR_PTR(ret);
 }
 
-void ipt_unregister_table(struct xt_table *table)
+void ipt_unregister_table(struct net *net, struct xt_table *table)
 {
        struct xt_table_info *private;
        void *loc_cpu_entry;
        struct module *table_owner = table->me;
+       struct ipt_entry *iter;
 
        private = xt_unregister_table(table);
 
        /* Decrease module usage counts and free resources */
        loc_cpu_entry = private->entries[raw_smp_processor_id()];
-       IPT_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+       xt_entry_foreach(iter, loc_cpu_entry, private->size)
+               cleanup_entry(iter, net);
        if (private->number > private->initial_entries)
                module_put(table_owner);
        xt_free_table_info(private);
@@ -2148,7 +2176,7 @@ icmp_match(const struct sk_buff *skb, const struct xt_match_param *par)
                                    !!(icmpinfo->invflags&IPT_ICMP_INV));
 }
 
-static bool icmp_checkentry(const struct xt_mtchk_param *par)
+static int icmp_checkentry(const struct xt_mtchk_param *par)
 {
        const struct ipt_icmp *icmpinfo = par->matchinfo;
 
@@ -2240,7 +2268,7 @@ static int __init ip_tables_init(void)
        if (ret < 0)
                goto err5;
 
-       printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
+       pr_info("(C) 2000-2006 Netfilter Core Team\n");
        return 0;
 
 err5: