Move the ip checksum code out to ncmlib.
Fix the return value for nlmsg_get_error().
Use SO_LOCK_FILTER to ensure that BPF filters cannot be removed once attached.

This facility was added to Linux in early 2013.  If it is not available,
the BPF will still be installed, but redundant checks will be performed
to guard against the BPF possibly being removed by an attacker.