This one isn't going to compile with netfilter disabled, I can tell
just by looking at it :-)

The reason is that NF_HOOK_COND is defined to NF_HOOK in that case,
and these two macros take a different number of args so the compiler
is going to barf.