Netfilter module name oddity

[Oleg Goldshmidt]

Ira Abramov <Lists-Linux-IL at ira.abramov.org> writes:

> Maybe I slept through some old thread about this, but nothing came out
> of searching Google about this: why do I have so many similarly named
> modules in my kernel? 

<snip>

> 9141    /lib/modules/2.6.26-1-amd64/kernel/net/ipv4/netfilter/ipt_ecn.ko
> 9975    /lib/modules/2.6.26-1-amd64/kernel/net/ipv4/netfilter/ipt_ECN.ko
> 8762    /lib/modules/2.6.26-1-amd64/kernel/net/ipv4/netfilter/ipt_ttl.ko
> 9232    /lib/modules/2.6.26-1-amd64/kernel/net/ipv4/netfilter/ipt_TTL.ko

I just went and looked at the code, and my guess, based on 

http://lxr.linux.no/linux+v2.6.29/net/netfilter/Makefile
http://lxr.linux.no/linux+v2.6.29/net/ipv4/netfilter/Makefile

and a quick glance at

http://lxr.linux.no/linux+v2.6.29/net/ipv4/netfilter/ipt_ecn.c
http://lxr.linux.no/linux+v2.6.29/net/ipv4/netfilter/ipt_ECN.c

is that the lower case modules (such as ipt_ecn.ko) are those
responsible for matching rules (e.g., matching an ECN flag) while the
upper case modules (ipt_ECN.ko) are responsible for targets (e.g.,
modifying the ECN flag).

As for Googling, my first attempt to search for "netfilter module
naming convention" yielded

http://jengelh.medozas.de/documents/Netfilter_Modules.pdf

at #2 from the top, and the very beginning of this document supports
my guess.

Hope it helps,

-- 
Oleg Goldshmidt | pub at goldshmidt.org