2 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <linux/netfilter/nf_tables_compat.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <linux/netfilter_arp/arp_tables.h>
24 #include <net/netfilter/nf_tables.h>
27 struct list_head head
;
28 struct nft_expr_ops ops
;
32 static void nft_xt_put(struct nft_xt
*xt
)
34 if (--xt
->refcnt
== 0) {
40 static int nft_compat_chain_validate_dependency(const char *tablename
,
41 const struct nft_chain
*chain
)
43 const struct nft_base_chain
*basechain
;
45 if (!tablename
|| !(chain
->flags
& NFT_BASE_CHAIN
))
48 basechain
= nft_base_chain(chain
);
49 if (strcmp(tablename
, "nat") == 0 &&
50 basechain
->type
->type
!= NFT_CHAIN_T_NAT
)
60 struct arpt_entry arp
;
64 nft_compat_set_par(struct xt_action_param
*par
, void *xt
, const void *xt_info
)
67 par
->targinfo
= xt_info
;
71 static void nft_target_eval_xt(const struct nft_expr
*expr
,
72 struct nft_regs
*regs
,
73 const struct nft_pktinfo
*pkt
)
75 void *info
= nft_expr_priv(expr
);
76 struct xt_target
*target
= expr
->ops
->data
;
77 struct sk_buff
*skb
= pkt
->skb
;
80 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
82 ret
= target
->target(skb
, &pkt
->xt
);
89 regs
->verdict
.code
= NFT_CONTINUE
;
92 regs
->verdict
.code
= ret
;
97 static void nft_target_eval_bridge(const struct nft_expr
*expr
,
98 struct nft_regs
*regs
,
99 const struct nft_pktinfo
*pkt
)
101 void *info
= nft_expr_priv(expr
);
102 struct xt_target
*target
= expr
->ops
->data
;
103 struct sk_buff
*skb
= pkt
->skb
;
106 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
108 ret
= target
->target(skb
, &pkt
->xt
);
115 regs
->verdict
.code
= NF_ACCEPT
;
118 regs
->verdict
.code
= NF_DROP
;
121 regs
->verdict
.code
= NFT_CONTINUE
;
124 regs
->verdict
.code
= NFT_RETURN
;
127 regs
->verdict
.code
= ret
;
132 static const struct nla_policy nft_target_policy
[NFTA_TARGET_MAX
+ 1] = {
133 [NFTA_TARGET_NAME
] = { .type
= NLA_NUL_STRING
},
134 [NFTA_TARGET_REV
] = { .type
= NLA_U32
},
135 [NFTA_TARGET_INFO
] = { .type
= NLA_BINARY
},
139 nft_target_set_tgchk_param(struct xt_tgchk_param
*par
,
140 const struct nft_ctx
*ctx
,
141 struct xt_target
*target
, void *info
,
142 union nft_entry
*entry
, u16 proto
, bool inv
)
145 par
->table
= ctx
->table
->name
;
146 switch (ctx
->afi
->family
) {
148 entry
->e4
.ip
.proto
= proto
;
149 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
153 entry
->e6
.ipv6
.flags
|= IP6T_F_PROTO
;
155 entry
->e6
.ipv6
.proto
= proto
;
156 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
159 entry
->ebt
.ethproto
= (__force __be16
)proto
;
160 entry
->ebt
.invflags
= inv
? EBT_IPROTO
: 0;
165 par
->entryinfo
= entry
;
166 par
->target
= target
;
167 par
->targinfo
= info
;
168 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
169 const struct nft_base_chain
*basechain
=
170 nft_base_chain(ctx
->chain
);
171 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
173 par
->hook_mask
= 1 << ops
->hooknum
;
177 par
->family
= ctx
->afi
->family
;
178 par
->nft_compat
= true;
181 static void target_compat_from_user(struct xt_target
*t
, void *in
, void *out
)
185 memcpy(out
, in
, t
->targetsize
);
186 pad
= XT_ALIGN(t
->targetsize
) - t
->targetsize
;
188 memset(out
+ t
->targetsize
, 0, pad
);
191 static const struct nla_policy nft_rule_compat_policy
[NFTA_RULE_COMPAT_MAX
+ 1] = {
192 [NFTA_RULE_COMPAT_PROTO
] = { .type
= NLA_U32
},
193 [NFTA_RULE_COMPAT_FLAGS
] = { .type
= NLA_U32
},
196 static int nft_parse_compat(const struct nlattr
*attr
, u16
*proto
, bool *inv
)
198 struct nlattr
*tb
[NFTA_RULE_COMPAT_MAX
+1];
202 err
= nla_parse_nested(tb
, NFTA_RULE_COMPAT_MAX
, attr
,
203 nft_rule_compat_policy
, NULL
);
207 if (!tb
[NFTA_RULE_COMPAT_PROTO
] || !tb
[NFTA_RULE_COMPAT_FLAGS
])
210 flags
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_FLAGS
]));
211 if (flags
& ~NFT_RULE_COMPAT_F_MASK
)
213 if (flags
& NFT_RULE_COMPAT_F_INV
)
216 *proto
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_PROTO
]));
221 nft_target_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
222 const struct nlattr
* const tb
[])
224 void *info
= nft_expr_priv(expr
);
225 struct xt_target
*target
= expr
->ops
->data
;
226 struct xt_tgchk_param par
;
227 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_TARGET_INFO
]));
230 union nft_entry e
= {};
233 target_compat_from_user(target
, nla_data(tb
[NFTA_TARGET_INFO
]), info
);
235 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
236 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
241 nft_target_set_tgchk_param(&par
, ctx
, target
, info
, &e
, proto
, inv
);
243 ret
= xt_check_target(&par
, size
, proto
, inv
);
247 /* The standard target cannot be used */
248 if (target
->target
== NULL
) {
255 module_put(target
->me
);
260 nft_target_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
262 struct xt_target
*target
= expr
->ops
->data
;
263 void *info
= nft_expr_priv(expr
);
264 struct xt_tgdtor_param par
;
269 par
.family
= ctx
->afi
->family
;
270 if (par
.target
->destroy
!= NULL
)
271 par
.target
->destroy(&par
);
273 nft_xt_put(container_of(expr
->ops
, struct nft_xt
, ops
));
274 module_put(target
->me
);
277 static int nft_target_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
279 const struct xt_target
*target
= expr
->ops
->data
;
280 void *info
= nft_expr_priv(expr
);
282 if (nla_put_string(skb
, NFTA_TARGET_NAME
, target
->name
) ||
283 nla_put_be32(skb
, NFTA_TARGET_REV
, htonl(target
->revision
)) ||
284 nla_put(skb
, NFTA_TARGET_INFO
, XT_ALIGN(target
->targetsize
), info
))
285 goto nla_put_failure
;
293 static int nft_target_validate(const struct nft_ctx
*ctx
,
294 const struct nft_expr
*expr
,
295 const struct nft_data
**data
)
297 struct xt_target
*target
= expr
->ops
->data
;
298 unsigned int hook_mask
= 0;
301 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
302 const struct nft_base_chain
*basechain
=
303 nft_base_chain(ctx
->chain
);
304 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
306 hook_mask
= 1 << ops
->hooknum
;
307 if (!(hook_mask
& target
->hooks
))
310 ret
= nft_compat_chain_validate_dependency(target
->table
,
318 static void nft_match_eval(const struct nft_expr
*expr
,
319 struct nft_regs
*regs
,
320 const struct nft_pktinfo
*pkt
)
322 void *info
= nft_expr_priv(expr
);
323 struct xt_match
*match
= expr
->ops
->data
;
324 struct sk_buff
*skb
= pkt
->skb
;
327 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, match
, info
);
329 ret
= match
->match(skb
, (struct xt_action_param
*)&pkt
->xt
);
331 if (pkt
->xt
.hotdrop
) {
332 regs
->verdict
.code
= NF_DROP
;
336 switch (ret
? 1 : 0) {
338 regs
->verdict
.code
= NFT_CONTINUE
;
341 regs
->verdict
.code
= NFT_BREAK
;
346 static const struct nla_policy nft_match_policy
[NFTA_MATCH_MAX
+ 1] = {
347 [NFTA_MATCH_NAME
] = { .type
= NLA_NUL_STRING
},
348 [NFTA_MATCH_REV
] = { .type
= NLA_U32
},
349 [NFTA_MATCH_INFO
] = { .type
= NLA_BINARY
},
352 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
354 nft_match_set_mtchk_param(struct xt_mtchk_param
*par
, const struct nft_ctx
*ctx
,
355 struct xt_match
*match
, void *info
,
356 union nft_entry
*entry
, u16 proto
, bool inv
)
359 par
->table
= ctx
->table
->name
;
360 switch (ctx
->afi
->family
) {
362 entry
->e4
.ip
.proto
= proto
;
363 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
367 entry
->e6
.ipv6
.flags
|= IP6T_F_PROTO
;
369 entry
->e6
.ipv6
.proto
= proto
;
370 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
373 entry
->ebt
.ethproto
= (__force __be16
)proto
;
374 entry
->ebt
.invflags
= inv
? EBT_IPROTO
: 0;
379 par
->entryinfo
= entry
;
381 par
->matchinfo
= info
;
382 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
383 const struct nft_base_chain
*basechain
=
384 nft_base_chain(ctx
->chain
);
385 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
387 par
->hook_mask
= 1 << ops
->hooknum
;
391 par
->family
= ctx
->afi
->family
;
392 par
->nft_compat
= true;
395 static void match_compat_from_user(struct xt_match
*m
, void *in
, void *out
)
399 memcpy(out
, in
, m
->matchsize
);
400 pad
= XT_ALIGN(m
->matchsize
) - m
->matchsize
;
402 memset(out
+ m
->matchsize
, 0, pad
);
406 nft_match_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
407 const struct nlattr
* const tb
[])
409 void *info
= nft_expr_priv(expr
);
410 struct xt_match
*match
= expr
->ops
->data
;
411 struct xt_mtchk_param par
;
412 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_MATCH_INFO
]));
415 union nft_entry e
= {};
418 match_compat_from_user(match
, nla_data(tb
[NFTA_MATCH_INFO
]), info
);
420 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
421 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
426 nft_match_set_mtchk_param(&par
, ctx
, match
, info
, &e
, proto
, inv
);
428 ret
= xt_check_match(&par
, size
, proto
, inv
);
434 module_put(match
->me
);
439 nft_match_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
441 struct xt_match
*match
= expr
->ops
->data
;
442 void *info
= nft_expr_priv(expr
);
443 struct xt_mtdtor_param par
;
447 par
.matchinfo
= info
;
448 par
.family
= ctx
->afi
->family
;
449 if (par
.match
->destroy
!= NULL
)
450 par
.match
->destroy(&par
);
452 nft_xt_put(container_of(expr
->ops
, struct nft_xt
, ops
));
453 module_put(match
->me
);
456 static int nft_match_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
458 void *info
= nft_expr_priv(expr
);
459 struct xt_match
*match
= expr
->ops
->data
;
461 if (nla_put_string(skb
, NFTA_MATCH_NAME
, match
->name
) ||
462 nla_put_be32(skb
, NFTA_MATCH_REV
, htonl(match
->revision
)) ||
463 nla_put(skb
, NFTA_MATCH_INFO
, XT_ALIGN(match
->matchsize
), info
))
464 goto nla_put_failure
;
472 static int nft_match_validate(const struct nft_ctx
*ctx
,
473 const struct nft_expr
*expr
,
474 const struct nft_data
**data
)
476 struct xt_match
*match
= expr
->ops
->data
;
477 unsigned int hook_mask
= 0;
480 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
481 const struct nft_base_chain
*basechain
=
482 nft_base_chain(ctx
->chain
);
483 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
485 hook_mask
= 1 << ops
->hooknum
;
486 if (!(hook_mask
& match
->hooks
))
489 ret
= nft_compat_chain_validate_dependency(match
->table
,
498 nfnl_compat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
499 int event
, u16 family
, const char *name
,
502 struct nlmsghdr
*nlh
;
503 struct nfgenmsg
*nfmsg
;
504 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
506 event
|= NFNL_SUBSYS_NFT_COMPAT
<< 8;
507 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
511 nfmsg
= nlmsg_data(nlh
);
512 nfmsg
->nfgen_family
= family
;
513 nfmsg
->version
= NFNETLINK_V0
;
516 if (nla_put_string(skb
, NFTA_COMPAT_NAME
, name
) ||
517 nla_put_be32(skb
, NFTA_COMPAT_REV
, htonl(rev
)) ||
518 nla_put_be32(skb
, NFTA_COMPAT_TYPE
, htonl(target
)))
519 goto nla_put_failure
;
526 nlmsg_cancel(skb
, nlh
);
530 static int nfnl_compat_get(struct net
*net
, struct sock
*nfnl
,
531 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
532 const struct nlattr
* const tb
[])
535 struct nfgenmsg
*nfmsg
;
539 struct sk_buff
*skb2
;
541 if (tb
[NFTA_COMPAT_NAME
] == NULL
||
542 tb
[NFTA_COMPAT_REV
] == NULL
||
543 tb
[NFTA_COMPAT_TYPE
] == NULL
)
546 name
= nla_data(tb
[NFTA_COMPAT_NAME
]);
547 rev
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_REV
]));
548 target
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_TYPE
]));
550 nfmsg
= nlmsg_data(nlh
);
552 switch(nfmsg
->nfgen_family
) {
566 pr_err("nft_compat: unsupported protocol %d\n",
567 nfmsg
->nfgen_family
);
571 try_then_request_module(xt_find_revision(nfmsg
->nfgen_family
, name
,
578 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
582 /* include the best revision for this extension in the message */
583 if (nfnl_compat_fill_info(skb2
, NETLINK_CB(skb
).portid
,
585 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
588 name
, ret
, target
) <= 0) {
593 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
598 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
601 static const struct nla_policy nfnl_compat_policy_get
[NFTA_COMPAT_MAX
+1] = {
602 [NFTA_COMPAT_NAME
] = { .type
= NLA_NUL_STRING
,
603 .len
= NFT_COMPAT_NAME_MAX
-1 },
604 [NFTA_COMPAT_REV
] = { .type
= NLA_U32
},
605 [NFTA_COMPAT_TYPE
] = { .type
= NLA_U32
},
608 static const struct nfnl_callback nfnl_nft_compat_cb
[NFNL_MSG_COMPAT_MAX
] = {
609 [NFNL_MSG_COMPAT_GET
] = { .call
= nfnl_compat_get
,
610 .attr_count
= NFTA_COMPAT_MAX
,
611 .policy
= nfnl_compat_policy_get
},
614 static const struct nfnetlink_subsystem nfnl_compat_subsys
= {
615 .name
= "nft-compat",
616 .subsys_id
= NFNL_SUBSYS_NFT_COMPAT
,
617 .cb_count
= NFNL_MSG_COMPAT_MAX
,
618 .cb
= nfnl_nft_compat_cb
,
621 static LIST_HEAD(nft_match_list
);
623 static struct nft_expr_type nft_match_type
;
625 static bool nft_match_cmp(const struct xt_match
*match
,
626 const char *name
, u32 rev
, u32 family
)
628 return strcmp(match
->name
, name
) == 0 && match
->revision
== rev
&&
629 (match
->family
== NFPROTO_UNSPEC
|| match
->family
== family
);
632 static const struct nft_expr_ops
*
633 nft_match_select_ops(const struct nft_ctx
*ctx
,
634 const struct nlattr
* const tb
[])
636 struct nft_xt
*nft_match
;
637 struct xt_match
*match
;
642 if (tb
[NFTA_MATCH_NAME
] == NULL
||
643 tb
[NFTA_MATCH_REV
] == NULL
||
644 tb
[NFTA_MATCH_INFO
] == NULL
)
645 return ERR_PTR(-EINVAL
);
647 mt_name
= nla_data(tb
[NFTA_MATCH_NAME
]);
648 rev
= ntohl(nla_get_be32(tb
[NFTA_MATCH_REV
]));
649 family
= ctx
->afi
->family
;
651 /* Re-use the existing match if it's already loaded. */
652 list_for_each_entry(nft_match
, &nft_match_list
, head
) {
653 struct xt_match
*match
= nft_match
->ops
.data
;
655 if (nft_match_cmp(match
, mt_name
, rev
, family
)) {
656 if (!try_module_get(match
->me
))
657 return ERR_PTR(-ENOENT
);
660 return &nft_match
->ops
;
664 match
= xt_request_find_match(family
, mt_name
, rev
);
666 return ERR_PTR(-ENOENT
);
668 if (match
->matchsize
> nla_len(tb
[NFTA_MATCH_INFO
])) {
673 /* This is the first time we use this match, allocate operations */
674 nft_match
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
675 if (nft_match
== NULL
) {
680 nft_match
->refcnt
= 1;
681 nft_match
->ops
.type
= &nft_match_type
;
682 nft_match
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(match
->matchsize
));
683 nft_match
->ops
.eval
= nft_match_eval
;
684 nft_match
->ops
.init
= nft_match_init
;
685 nft_match
->ops
.destroy
= nft_match_destroy
;
686 nft_match
->ops
.dump
= nft_match_dump
;
687 nft_match
->ops
.validate
= nft_match_validate
;
688 nft_match
->ops
.data
= match
;
690 list_add(&nft_match
->head
, &nft_match_list
);
692 return &nft_match
->ops
;
694 module_put(match
->me
);
698 static struct nft_expr_type nft_match_type __read_mostly
= {
700 .select_ops
= nft_match_select_ops
,
701 .policy
= nft_match_policy
,
702 .maxattr
= NFTA_MATCH_MAX
,
703 .owner
= THIS_MODULE
,
706 static LIST_HEAD(nft_target_list
);
708 static struct nft_expr_type nft_target_type
;
710 static bool nft_target_cmp(const struct xt_target
*tg
,
711 const char *name
, u32 rev
, u32 family
)
713 return strcmp(tg
->name
, name
) == 0 && tg
->revision
== rev
&&
714 (tg
->family
== NFPROTO_UNSPEC
|| tg
->family
== family
);
717 static const struct nft_expr_ops
*
718 nft_target_select_ops(const struct nft_ctx
*ctx
,
719 const struct nlattr
* const tb
[])
721 struct nft_xt
*nft_target
;
722 struct xt_target
*target
;
727 if (tb
[NFTA_TARGET_NAME
] == NULL
||
728 tb
[NFTA_TARGET_REV
] == NULL
||
729 tb
[NFTA_TARGET_INFO
] == NULL
)
730 return ERR_PTR(-EINVAL
);
732 tg_name
= nla_data(tb
[NFTA_TARGET_NAME
]);
733 rev
= ntohl(nla_get_be32(tb
[NFTA_TARGET_REV
]));
734 family
= ctx
->afi
->family
;
736 /* Re-use the existing target if it's already loaded. */
737 list_for_each_entry(nft_target
, &nft_target_list
, head
) {
738 struct xt_target
*target
= nft_target
->ops
.data
;
740 if (nft_target_cmp(target
, tg_name
, rev
, family
)) {
741 if (!try_module_get(target
->me
))
742 return ERR_PTR(-ENOENT
);
744 nft_target
->refcnt
++;
745 return &nft_target
->ops
;
749 target
= xt_request_find_target(family
, tg_name
, rev
);
751 return ERR_PTR(-ENOENT
);
753 if (target
->targetsize
> nla_len(tb
[NFTA_TARGET_INFO
])) {
758 /* This is the first time we use this target, allocate operations */
759 nft_target
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
760 if (nft_target
== NULL
) {
765 nft_target
->refcnt
= 1;
766 nft_target
->ops
.type
= &nft_target_type
;
767 nft_target
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(target
->targetsize
));
768 nft_target
->ops
.init
= nft_target_init
;
769 nft_target
->ops
.destroy
= nft_target_destroy
;
770 nft_target
->ops
.dump
= nft_target_dump
;
771 nft_target
->ops
.validate
= nft_target_validate
;
772 nft_target
->ops
.data
= target
;
774 if (family
== NFPROTO_BRIDGE
)
775 nft_target
->ops
.eval
= nft_target_eval_bridge
;
777 nft_target
->ops
.eval
= nft_target_eval_xt
;
779 list_add(&nft_target
->head
, &nft_target_list
);
781 return &nft_target
->ops
;
783 module_put(target
->me
);
787 static struct nft_expr_type nft_target_type __read_mostly
= {
789 .select_ops
= nft_target_select_ops
,
790 .policy
= nft_target_policy
,
791 .maxattr
= NFTA_TARGET_MAX
,
792 .owner
= THIS_MODULE
,
795 static int __init
nft_compat_module_init(void)
799 ret
= nft_register_expr(&nft_match_type
);
803 ret
= nft_register_expr(&nft_target_type
);
807 ret
= nfnetlink_subsys_register(&nfnl_compat_subsys
);
809 pr_err("nft_compat: cannot register with nfnetlink.\n");
813 pr_info("nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>\n");
818 nft_unregister_expr(&nft_target_type
);
820 nft_unregister_expr(&nft_match_type
);
824 static void __exit
nft_compat_module_exit(void)
826 nfnetlink_subsys_unregister(&nfnl_compat_subsys
);
827 nft_unregister_expr(&nft_target_type
);
828 nft_unregister_expr(&nft_match_type
);
831 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT
);
833 module_init(nft_compat_module_init
);
834 module_exit(nft_compat_module_exit
);
836 MODULE_LICENSE("GPL");
837 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
838 MODULE_ALIAS_NFT_EXPR("match");
839 MODULE_ALIAS_NFT_EXPR("target");