[PATCH] netfilter: fix arptable_filter wrong hook registering

[Pablo Neira Ayuso <pablo@netfilter.org>]

This patch replaces NFPROTO_ARP by NF_ARP in the hooks registered
by arptable_filter, otherwise the arptables tool does not work.
Thus, we use NF_ARP to register ARP hooks to match the NF_HOOK
invocation in net/ipv4/arp.c and NFPROTO_ARP for internal xtables
handling, ie. matches, targets and tables.

This patch also fixes the ARP mangling in the ipt_CLUSTERIP target.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

 net/ipv4/netfilter/arptable_filter.c |    6 +++---
 net/ipv4/netfilter/ipt_CLUSTERIP.c   |    2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index bee3d11..984d05d 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -89,21 +89,21 @@ static struct nf_hook_ops arpt_ops[] __read_mostly = {
 	{
 		.hook		= arpt_in_hook,
 		.owner		= THIS_MODULE,
-		.pf		= NFPROTO_ARP,
+		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_IN,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
 		.hook		= arpt_out_hook,
 		.owner		= THIS_MODULE,
-		.pf		= NFPROTO_ARP,
+		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_OUT,
 		.priority	= NF_IP_PRI_FILTER,
 	},
 	{
 		.hook		= arpt_forward_hook,
 		.owner		= THIS_MODULE,
-		.pf		= NFPROTO_ARP,
+		.pf		= NF_ARP,
 		.hooknum	= NF_ARP_FORWARD,
 		.priority	= NF_IP_PRI_FILTER,
 	},
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 7ac1677..af8b1bb 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -541,7 +541,7 @@ arp_mangle(unsigned int hook,
 
 static struct nf_hook_ops cip_arp_ops __read_mostly = {
 	.hook = arp_mangle,
-	.pf = NFPROTO_ARP,
+	.pf = NF_ARP,
 	.hooknum = NF_ARP_OUT,
 	.priority = -1
 };