I have observed this using kernel 2.6.18 - I'm not sure if the patches for other kernels have the same problem. In linux/net/ipv4/netfilter/ipt_layer7.c, at line 471, the original source looks like: static struct ipt_match layer7_match = { .name = "layer7", .match = &match, .checkentry = &checkentry, .... }; The members match and checkentry in ipt_match (really struct xt_match in include/linux/netfilter/x_tables.h) are pointers to functions. In ipt_layer7.c match and checkentry are the names of two functions that are placed into this structure. They're inserted as a pointer to a function pointer, which I'm pretty sure is not good. This can be fixed by changing two of layer7_match's members from: .match = &match, .checkentry = &checkentry, to .match = match, .checkentry = checkentry,
*** Bug 155876 has been marked as a duplicate of this bug. ***
I think if there was any real problem there would be a compile error. With or without your change the following warning occurred: I'm thinking the compile warning net/ipv4/netfilter/ipt_layer7.c:473: warning: initialization from incompatible pointer type This is described here: http://sourceforge.net/tracker/index.php?func=detail&aid=1556775&group_id=80085&atid=558668 and more specificly here http://l7-filter.sourceforge.net/HOWTO (look for warning on the page) Looking closer at this the type of the match structure member is: int (*match)(const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct xt_match *match, const void *matchinfo, int offset, unsigned int protoff, int *hotdrop); compared to the ipt_layer7.c: static int match(/* const */ struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct xt_match *match, const void *matchinfo, int offset, unsigned int protoff, int *hotdrop) This illistrates the commented out const is the cause of the warning. &match I'm assuming is the same as match because all functions are implicltly pointers. Feel free to prove me wrong but I doubt this is a problem.
