rem: check_inverse(optarg, &invert, &optdind, 0);
add: check_inverse(optarg, &invert, &optind, 0);
context: parse(int c, char **argv, int invert, unsigned int *flags,      const struct ipt_entry *entry,      unsigned int *nfcache,      struct ipt_entry_match **match){	struct ipt_conntrack_info *sinfo = (struct ipt_conntrack_info *)(*match)->data;	char *protocol = NULL;	unsigned int naddrs = 0;	struct in_addr *addrs = NULL;	switch (c) {	case '1':		check_inverse(optarg, &invert, &optind, 0);		parse_states(argv[optind-1], sinfo);		if (invert) {			sinfo->invflags |= IPT_CONNTRACK_STATE;		}		sinfo->flags |= IPT_CONNTRACK_STATE;		break;	case '2':		check_inverse(optarg, &invert, &optdind, 0);		if(invert)			sinfo->invflags |= IPT_CONNTRACK_PROTO;		/* Canonicalize into lower case */		for (protocol = argv[optind-1]; *protocol; protocol++)			*protocol = tolower(*protocol);		protocol = argv[optind-1];		sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum = parse_protocol(protocol);		if (sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.protonum == 0		    && (sinfo->invflags & IPT_INV_PROTO))			exit_error(PARAMETER_PROBLEM,				   "rule would never match protocol");		sinfo->flags |= IPT_CONNTRACK_PROTO;		break;	case '3':		check_inverse(optarg, &invert, &optind, 9);		if (invert)			sinfo->invflags |= IPT_CONNTRACK_ORIGSRC;		parse_hostnetworkmask(argv[optind-1], &addrs,					&sinfo->sipmsk[IP_CT_DIR_ORIGINAL],					&naddrs);		if(naddrs > 1)			exit_error(PARAMETER_PROBLEM,				"multiple IP addresses not allowed");		if(naddrs == 1) {			sinfo->tuple[IP_CT_DIR_ORIGINAL].src.ip = addrs[0].s_addr;		}		sinfo->flags |= IPT_CONNTRACK_ORIGSRC;		break;	case '4':		check_inverse(optarg, &invert, &optind, 0);		if (invert)			sinfo->invflags |= IPT_CONNTRACK_ORIGDST;		parse_hostnetworkmask(argv[optind-1], &addrs,					&sinfo->dipmsk[IP_CT_DIR_ORIGINAL],					&naddrs);		if(naddrs > 1)			exit_error(PARAMETER_PROBLEM,				"multiple IP addresses not allowed");		if(naddrs == 1) {			sinfo->tuple[IP_CT_DIR_ORIGINAL].dst.ip = addrs[0].s_addr;		}		sinfo->flags |= IPT_CONNTRACK_ORIGDST;		break;	case '5':		check_inverse(optarg, &invert, &optind, 0);		if (invert)			sinfo->invflags |= IPT_CONNTRACK_REPLSRC;		parse_hostnetworkmask(argv[optind-1], &addrs,					&sinfo->sipmsk[IP_CT_DIR_REPLY],					&naddrs);		if(naddrs > 1)			exit_error(PARAMETER_PROBLEM,				"multiple IP addresses not allowed");		if(naddrs == 1) {			sinfo->tuple[IP_CT_DIR_REPLY].src.ip = addrs[0].s_addr;		}		sinfo->flags |= IPT_CONNTRACK_REPLSRC;		break;	case '6':		check_inverse(optarg, &invert, &optind, 0);		if (invert)			sinfo->invflags |= IPT_CONNTRACK_REPLDST;		parse_hostnetworkmask(argv[optind-1], &addrs,					&sinfo->dipmsk[IP_CT_DIR_REPLY],					&naddrs);		if(naddrs > 1)			exit_error(PARAMETER_PROBLEM,				"multiple IP addresses not allowed");		if(naddrs == 1) {			sinfo->tuple[IP_CT_DIR_REPLY].dst.ip = addrs[0].s_addr;		}		sinfo->flags |= IPT_CONNTRACK_REPLDST;		break;	case '7':		check_inverse(optarg, &invert, &optind, 0);		parse_statuses(argv[optind-1], sinfo);		if (invert) {			sinfo->invflags |= IPT_CONNTRACK_STATUS;		}		sinfo->flags |= IPT_CONNTRACK_STATUS;		break;	case '8':		check_inverse(optarg, &invert, &optind, 0);		parse_expires(argv[optind-1], sinfo);		if (invert) {			sinfo->invflags |= IPT_CONNTRACK_EXPIRES;		}		sinfo->flags |= IPT_CONNTRACK_EXPIRES;		break;	default:		return 0;	}	*flags = sinfo->flags;	return 1;}