2 * (C) 2012 Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation (or any later at your option).
8 * This software has been sponsored by Vyatta Inc. <http://www.vyatta.com>
10 #include <linux/init.h>
11 #include <linux/module.h>
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netlink.h>
15 #include <linux/rculist.h>
16 #include <linux/slab.h>
17 #include <linux/types.h>
18 #include <linux/list.h>
19 #include <linux/errno.h>
20 #include <net/netlink.h>
23 #include <net/netfilter/nf_conntrack_helper.h>
24 #include <net/netfilter/nf_conntrack_expect.h>
25 #include <net/netfilter/nf_conntrack_ecache.h>
27 #include <linux/netfilter/nfnetlink.h>
28 #include <linux/netfilter/nfnetlink_conntrack.h>
29 #include <linux/netfilter/nfnetlink_cthelper.h>
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
33 MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers");
35 struct nfnl_cthelper
{
36 struct list_head list
;
37 struct nf_conntrack_helper helper
;
40 static LIST_HEAD(nfnl_cthelper_list
);
43 nfnl_userspace_cthelper(struct sk_buff
*skb
, unsigned int protoff
,
44 struct nf_conn
*ct
, enum ip_conntrack_info ctinfo
)
46 const struct nf_conn_help
*help
;
47 struct nf_conntrack_helper
*helper
;
53 /* rcu_read_lock()ed by nf_hook_thresh */
54 helper
= rcu_dereference(help
->helper
);
58 /* This is a user-space helper not yet configured, skip. */
60 (NF_CT_HELPER_F_USERSPACE
| NF_CT_HELPER_F_CONFIGURED
)) ==
61 NF_CT_HELPER_F_USERSPACE
)
64 /* If the user-space helper is not available, don't block traffic. */
65 return NF_QUEUE_NR(helper
->queue_num
) | NF_VERDICT_FLAG_QUEUE_BYPASS
;
68 static const struct nla_policy nfnl_cthelper_tuple_pol
[NFCTH_TUPLE_MAX
+1] = {
69 [NFCTH_TUPLE_L3PROTONUM
] = { .type
= NLA_U16
, },
70 [NFCTH_TUPLE_L4PROTONUM
] = { .type
= NLA_U8
, },
74 nfnl_cthelper_parse_tuple(struct nf_conntrack_tuple
*tuple
,
75 const struct nlattr
*attr
)
78 struct nlattr
*tb
[NFCTH_TUPLE_MAX
+1];
80 err
= nla_parse_nested(tb
, NFCTH_TUPLE_MAX
, attr
,
81 nfnl_cthelper_tuple_pol
, NULL
);
85 if (!tb
[NFCTH_TUPLE_L3PROTONUM
] || !tb
[NFCTH_TUPLE_L4PROTONUM
])
88 /* Not all fields are initialized so first zero the tuple */
89 memset(tuple
, 0, sizeof(struct nf_conntrack_tuple
));
91 tuple
->src
.l3num
= ntohs(nla_get_be16(tb
[NFCTH_TUPLE_L3PROTONUM
]));
92 tuple
->dst
.protonum
= nla_get_u8(tb
[NFCTH_TUPLE_L4PROTONUM
]);
98 nfnl_cthelper_from_nlattr(struct nlattr
*attr
, struct nf_conn
*ct
)
100 struct nf_conn_help
*help
= nfct_help(ct
);
105 if (help
->helper
->data_len
== 0)
108 nla_memcpy(help
->data
, nla_data(attr
), sizeof(help
->data
));
113 nfnl_cthelper_to_nlattr(struct sk_buff
*skb
, const struct nf_conn
*ct
)
115 const struct nf_conn_help
*help
= nfct_help(ct
);
117 if (help
->helper
->data_len
&&
118 nla_put(skb
, CTA_HELP_INFO
, help
->helper
->data_len
, &help
->data
))
119 goto nla_put_failure
;
127 static const struct nla_policy nfnl_cthelper_expect_pol
[NFCTH_POLICY_MAX
+1] = {
128 [NFCTH_POLICY_NAME
] = { .type
= NLA_NUL_STRING
,
129 .len
= NF_CT_HELPER_NAME_LEN
-1 },
130 [NFCTH_POLICY_EXPECT_MAX
] = { .type
= NLA_U32
, },
131 [NFCTH_POLICY_EXPECT_TIMEOUT
] = { .type
= NLA_U32
, },
135 nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy
*expect_policy
,
136 const struct nlattr
*attr
)
139 struct nlattr
*tb
[NFCTH_POLICY_MAX
+1];
141 err
= nla_parse_nested(tb
, NFCTH_POLICY_MAX
, attr
,
142 nfnl_cthelper_expect_pol
, NULL
);
146 if (!tb
[NFCTH_POLICY_NAME
] ||
147 !tb
[NFCTH_POLICY_EXPECT_MAX
] ||
148 !tb
[NFCTH_POLICY_EXPECT_TIMEOUT
])
151 strncpy(expect_policy
->name
,
152 nla_data(tb
[NFCTH_POLICY_NAME
]), NF_CT_HELPER_NAME_LEN
);
153 expect_policy
->max_expected
=
154 ntohl(nla_get_be32(tb
[NFCTH_POLICY_EXPECT_MAX
]));
155 if (expect_policy
->max_expected
> NF_CT_EXPECT_MAX_CNT
)
158 expect_policy
->timeout
=
159 ntohl(nla_get_be32(tb
[NFCTH_POLICY_EXPECT_TIMEOUT
]));
164 static const struct nla_policy
165 nfnl_cthelper_expect_policy_set
[NFCTH_POLICY_SET_MAX
+1] = {
166 [NFCTH_POLICY_SET_NUM
] = { .type
= NLA_U32
, },
170 nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper
*helper
,
171 const struct nlattr
*attr
)
174 struct nf_conntrack_expect_policy
*expect_policy
;
175 struct nlattr
*tb
[NFCTH_POLICY_SET_MAX
+1];
176 unsigned int class_max
;
178 ret
= nla_parse_nested(tb
, NFCTH_POLICY_SET_MAX
, attr
,
179 nfnl_cthelper_expect_policy_set
, NULL
);
183 if (!tb
[NFCTH_POLICY_SET_NUM
])
186 class_max
= ntohl(nla_get_be32(tb
[NFCTH_POLICY_SET_NUM
]));
189 if (class_max
> NF_CT_MAX_EXPECT_CLASSES
)
192 expect_policy
= kzalloc(sizeof(struct nf_conntrack_expect_policy
) *
193 class_max
, GFP_KERNEL
);
194 if (expect_policy
== NULL
)
197 for (i
= 0; i
< class_max
; i
++) {
198 if (!tb
[NFCTH_POLICY_SET
+i
])
201 ret
= nfnl_cthelper_expect_policy(&expect_policy
[i
],
202 tb
[NFCTH_POLICY_SET
+i
]);
207 helper
->expect_class_max
= class_max
- 1;
208 helper
->expect_policy
= expect_policy
;
211 kfree(expect_policy
);
216 nfnl_cthelper_create(const struct nlattr
* const tb
[],
217 struct nf_conntrack_tuple
*tuple
)
219 struct nf_conntrack_helper
*helper
;
220 struct nfnl_cthelper
*nfcth
;
224 if (!tb
[NFCTH_TUPLE
] || !tb
[NFCTH_POLICY
] || !tb
[NFCTH_PRIV_DATA_LEN
])
227 nfcth
= kzalloc(sizeof(*nfcth
), GFP_KERNEL
);
230 helper
= &nfcth
->helper
;
232 ret
= nfnl_cthelper_parse_expect_policy(helper
, tb
[NFCTH_POLICY
]);
236 strncpy(helper
->name
, nla_data(tb
[NFCTH_NAME
]), NF_CT_HELPER_NAME_LEN
);
237 size
= ntohl(nla_get_be32(tb
[NFCTH_PRIV_DATA_LEN
]));
238 if (size
> FIELD_SIZEOF(struct nf_conn_help
, data
)) {
243 helper
->flags
|= NF_CT_HELPER_F_USERSPACE
;
244 memcpy(&helper
->tuple
, tuple
, sizeof(struct nf_conntrack_tuple
));
246 helper
->me
= THIS_MODULE
;
247 helper
->help
= nfnl_userspace_cthelper
;
248 helper
->from_nlattr
= nfnl_cthelper_from_nlattr
;
249 helper
->to_nlattr
= nfnl_cthelper_to_nlattr
;
251 /* Default to queue number zero, this can be updated at any time. */
252 if (tb
[NFCTH_QUEUE_NUM
])
253 helper
->queue_num
= ntohl(nla_get_be32(tb
[NFCTH_QUEUE_NUM
]));
255 if (tb
[NFCTH_STATUS
]) {
256 int status
= ntohl(nla_get_be32(tb
[NFCTH_STATUS
]));
259 case NFCT_HELPER_STATUS_ENABLED
:
260 helper
->flags
|= NF_CT_HELPER_F_CONFIGURED
;
262 case NFCT_HELPER_STATUS_DISABLED
:
263 helper
->flags
&= ~NF_CT_HELPER_F_CONFIGURED
;
268 ret
= nf_conntrack_helper_register(helper
);
272 list_add_tail(&nfcth
->list
, &nfnl_cthelper_list
);
275 kfree(helper
->expect_policy
);
282 nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy
*policy
,
283 struct nf_conntrack_expect_policy
*new_policy
,
284 const struct nlattr
*attr
)
286 struct nlattr
*tb
[NFCTH_POLICY_MAX
+ 1];
289 err
= nla_parse_nested(tb
, NFCTH_POLICY_MAX
, attr
,
290 nfnl_cthelper_expect_pol
, NULL
);
294 if (!tb
[NFCTH_POLICY_NAME
] ||
295 !tb
[NFCTH_POLICY_EXPECT_MAX
] ||
296 !tb
[NFCTH_POLICY_EXPECT_TIMEOUT
])
299 if (nla_strcmp(tb
[NFCTH_POLICY_NAME
], policy
->name
))
302 new_policy
->max_expected
=
303 ntohl(nla_get_be32(tb
[NFCTH_POLICY_EXPECT_MAX
]));
304 if (new_policy
->max_expected
> NF_CT_EXPECT_MAX_CNT
)
307 new_policy
->timeout
=
308 ntohl(nla_get_be32(tb
[NFCTH_POLICY_EXPECT_TIMEOUT
]));
313 static int nfnl_cthelper_update_policy_all(struct nlattr
*tb
[],
314 struct nf_conntrack_helper
*helper
)
316 struct nf_conntrack_expect_policy new_policy
[helper
->expect_class_max
+ 1];
317 struct nf_conntrack_expect_policy
*policy
;
320 /* Check first that all policy attributes are well-formed, so we don't
321 * leave things in inconsistent state on errors.
323 for (i
= 0; i
< helper
->expect_class_max
+ 1; i
++) {
325 if (!tb
[NFCTH_POLICY_SET
+ i
])
328 err
= nfnl_cthelper_update_policy_one(&helper
->expect_policy
[i
],
330 tb
[NFCTH_POLICY_SET
+ i
]);
334 /* Now we can safely update them. */
335 for (i
= 0; i
< helper
->expect_class_max
+ 1; i
++) {
336 policy
= (struct nf_conntrack_expect_policy
*)
337 &helper
->expect_policy
[i
];
338 policy
->max_expected
= new_policy
->max_expected
;
339 policy
->timeout
= new_policy
->timeout
;
345 static int nfnl_cthelper_update_policy(struct nf_conntrack_helper
*helper
,
346 const struct nlattr
*attr
)
348 struct nlattr
*tb
[NFCTH_POLICY_SET_MAX
+ 1];
349 unsigned int class_max
;
352 err
= nla_parse_nested(tb
, NFCTH_POLICY_SET_MAX
, attr
,
353 nfnl_cthelper_expect_policy_set
, NULL
);
357 if (!tb
[NFCTH_POLICY_SET_NUM
])
360 class_max
= ntohl(nla_get_be32(tb
[NFCTH_POLICY_SET_NUM
]));
361 if (helper
->expect_class_max
+ 1 != class_max
)
364 return nfnl_cthelper_update_policy_all(tb
, helper
);
368 nfnl_cthelper_update(const struct nlattr
* const tb
[],
369 struct nf_conntrack_helper
*helper
)
373 if (tb
[NFCTH_PRIV_DATA_LEN
])
376 if (tb
[NFCTH_POLICY
]) {
377 ret
= nfnl_cthelper_update_policy(helper
, tb
[NFCTH_POLICY
]);
381 if (tb
[NFCTH_QUEUE_NUM
])
382 helper
->queue_num
= ntohl(nla_get_be32(tb
[NFCTH_QUEUE_NUM
]));
384 if (tb
[NFCTH_STATUS
]) {
385 int status
= ntohl(nla_get_be32(tb
[NFCTH_STATUS
]));
388 case NFCT_HELPER_STATUS_ENABLED
:
389 helper
->flags
|= NF_CT_HELPER_F_CONFIGURED
;
391 case NFCT_HELPER_STATUS_DISABLED
:
392 helper
->flags
&= ~NF_CT_HELPER_F_CONFIGURED
;
399 static int nfnl_cthelper_new(struct net
*net
, struct sock
*nfnl
,
400 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
401 const struct nlattr
* const tb
[],
402 struct netlink_ext_ack
*extack
)
404 const char *helper_name
;
405 struct nf_conntrack_helper
*cur
, *helper
= NULL
;
406 struct nf_conntrack_tuple tuple
;
407 struct nfnl_cthelper
*nlcth
;
410 if (!tb
[NFCTH_NAME
] || !tb
[NFCTH_TUPLE
])
413 helper_name
= nla_data(tb
[NFCTH_NAME
]);
415 ret
= nfnl_cthelper_parse_tuple(&tuple
, tb
[NFCTH_TUPLE
]);
419 list_for_each_entry(nlcth
, &nfnl_cthelper_list
, list
) {
420 cur
= &nlcth
->helper
;
422 if (strncmp(cur
->name
, helper_name
, NF_CT_HELPER_NAME_LEN
))
425 if ((tuple
.src
.l3num
!= cur
->tuple
.src
.l3num
||
426 tuple
.dst
.protonum
!= cur
->tuple
.dst
.protonum
))
429 if (nlh
->nlmsg_flags
& NLM_F_EXCL
)
437 ret
= nfnl_cthelper_create(tb
, &tuple
);
439 ret
= nfnl_cthelper_update(tb
, helper
);
445 nfnl_cthelper_dump_tuple(struct sk_buff
*skb
,
446 struct nf_conntrack_helper
*helper
)
448 struct nlattr
*nest_parms
;
450 nest_parms
= nla_nest_start(skb
, NFCTH_TUPLE
| NLA_F_NESTED
);
451 if (nest_parms
== NULL
)
452 goto nla_put_failure
;
454 if (nla_put_be16(skb
, NFCTH_TUPLE_L3PROTONUM
,
455 htons(helper
->tuple
.src
.l3num
)))
456 goto nla_put_failure
;
458 if (nla_put_u8(skb
, NFCTH_TUPLE_L4PROTONUM
, helper
->tuple
.dst
.protonum
))
459 goto nla_put_failure
;
461 nla_nest_end(skb
, nest_parms
);
469 nfnl_cthelper_dump_policy(struct sk_buff
*skb
,
470 struct nf_conntrack_helper
*helper
)
473 struct nlattr
*nest_parms1
, *nest_parms2
;
475 nest_parms1
= nla_nest_start(skb
, NFCTH_POLICY
| NLA_F_NESTED
);
476 if (nest_parms1
== NULL
)
477 goto nla_put_failure
;
479 if (nla_put_be32(skb
, NFCTH_POLICY_SET_NUM
,
480 htonl(helper
->expect_class_max
+ 1)))
481 goto nla_put_failure
;
483 for (i
= 0; i
< helper
->expect_class_max
+ 1; i
++) {
484 nest_parms2
= nla_nest_start(skb
,
485 (NFCTH_POLICY_SET
+i
) | NLA_F_NESTED
);
486 if (nest_parms2
== NULL
)
487 goto nla_put_failure
;
489 if (nla_put_string(skb
, NFCTH_POLICY_NAME
,
490 helper
->expect_policy
[i
].name
))
491 goto nla_put_failure
;
493 if (nla_put_be32(skb
, NFCTH_POLICY_EXPECT_MAX
,
494 htonl(helper
->expect_policy
[i
].max_expected
)))
495 goto nla_put_failure
;
497 if (nla_put_be32(skb
, NFCTH_POLICY_EXPECT_TIMEOUT
,
498 htonl(helper
->expect_policy
[i
].timeout
)))
499 goto nla_put_failure
;
501 nla_nest_end(skb
, nest_parms2
);
503 nla_nest_end(skb
, nest_parms1
);
511 nfnl_cthelper_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
512 int event
, struct nf_conntrack_helper
*helper
)
514 struct nlmsghdr
*nlh
;
515 struct nfgenmsg
*nfmsg
;
516 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
519 event
= nfnl_msg_type(NFNL_SUBSYS_CTHELPER
, event
);
520 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
524 nfmsg
= nlmsg_data(nlh
);
525 nfmsg
->nfgen_family
= AF_UNSPEC
;
526 nfmsg
->version
= NFNETLINK_V0
;
529 if (nla_put_string(skb
, NFCTH_NAME
, helper
->name
))
530 goto nla_put_failure
;
532 if (nla_put_be32(skb
, NFCTH_QUEUE_NUM
, htonl(helper
->queue_num
)))
533 goto nla_put_failure
;
535 if (nfnl_cthelper_dump_tuple(skb
, helper
) < 0)
536 goto nla_put_failure
;
538 if (nfnl_cthelper_dump_policy(skb
, helper
) < 0)
539 goto nla_put_failure
;
541 if (nla_put_be32(skb
, NFCTH_PRIV_DATA_LEN
, htonl(helper
->data_len
)))
542 goto nla_put_failure
;
544 if (helper
->flags
& NF_CT_HELPER_F_CONFIGURED
)
545 status
= NFCT_HELPER_STATUS_ENABLED
;
547 status
= NFCT_HELPER_STATUS_DISABLED
;
549 if (nla_put_be32(skb
, NFCTH_STATUS
, htonl(status
)))
550 goto nla_put_failure
;
557 nlmsg_cancel(skb
, nlh
);
562 nfnl_cthelper_dump_table(struct sk_buff
*skb
, struct netlink_callback
*cb
)
564 struct nf_conntrack_helper
*cur
, *last
;
567 last
= (struct nf_conntrack_helper
*)cb
->args
[1];
568 for (; cb
->args
[0] < nf_ct_helper_hsize
; cb
->args
[0]++) {
570 hlist_for_each_entry_rcu(cur
,
571 &nf_ct_helper_hash
[cb
->args
[0]], hnode
) {
573 /* skip non-userspace conntrack helpers. */
574 if (!(cur
->flags
& NF_CT_HELPER_F_USERSPACE
))
582 if (nfnl_cthelper_fill_info(skb
,
583 NETLINK_CB(cb
->skb
).portid
,
585 NFNL_MSG_TYPE(cb
->nlh
->nlmsg_type
),
586 NFNL_MSG_CTHELPER_NEW
, cur
) < 0) {
587 cb
->args
[1] = (unsigned long)cur
;
601 static int nfnl_cthelper_get(struct net
*net
, struct sock
*nfnl
,
602 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
603 const struct nlattr
* const tb
[],
604 struct netlink_ext_ack
*extack
)
607 struct nf_conntrack_helper
*cur
;
608 struct sk_buff
*skb2
;
609 char *helper_name
= NULL
;
610 struct nf_conntrack_tuple tuple
;
611 struct nfnl_cthelper
*nlcth
;
612 bool tuple_set
= false;
614 if (nlh
->nlmsg_flags
& NLM_F_DUMP
) {
615 struct netlink_dump_control c
= {
616 .dump
= nfnl_cthelper_dump_table
,
618 return netlink_dump_start(nfnl
, skb
, nlh
, &c
);
622 helper_name
= nla_data(tb
[NFCTH_NAME
]);
624 if (tb
[NFCTH_TUPLE
]) {
625 ret
= nfnl_cthelper_parse_tuple(&tuple
, tb
[NFCTH_TUPLE
]);
632 list_for_each_entry(nlcth
, &nfnl_cthelper_list
, list
) {
633 cur
= &nlcth
->helper
;
635 strncmp(cur
->name
, helper_name
, NF_CT_HELPER_NAME_LEN
))
639 (tuple
.src
.l3num
!= cur
->tuple
.src
.l3num
||
640 tuple
.dst
.protonum
!= cur
->tuple
.dst
.protonum
))
643 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
649 ret
= nfnl_cthelper_fill_info(skb2
, NETLINK_CB(skb
).portid
,
651 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
652 NFNL_MSG_CTHELPER_NEW
, cur
);
658 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
663 /* this avoids a loop in nfnetlink. */
664 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
669 static int nfnl_cthelper_del(struct net
*net
, struct sock
*nfnl
,
670 struct sk_buff
*skb
, const struct nlmsghdr
*nlh
,
671 const struct nlattr
* const tb
[],
672 struct netlink_ext_ack
*extack
)
674 char *helper_name
= NULL
;
675 struct nf_conntrack_helper
*cur
;
676 struct nf_conntrack_tuple tuple
;
677 bool tuple_set
= false, found
= false;
678 struct nfnl_cthelper
*nlcth
, *n
;
682 helper_name
= nla_data(tb
[NFCTH_NAME
]);
684 if (tb
[NFCTH_TUPLE
]) {
685 ret
= nfnl_cthelper_parse_tuple(&tuple
, tb
[NFCTH_TUPLE
]);
693 list_for_each_entry_safe(nlcth
, n
, &nfnl_cthelper_list
, list
) {
694 cur
= &nlcth
->helper
;
698 strncmp(cur
->name
, helper_name
, NF_CT_HELPER_NAME_LEN
))
702 (tuple
.src
.l3num
!= cur
->tuple
.src
.l3num
||
703 tuple
.dst
.protonum
!= cur
->tuple
.dst
.protonum
))
706 if (refcount_dec_if_one(&cur
->refcnt
)) {
708 nf_conntrack_helper_unregister(cur
);
709 kfree(cur
->expect_policy
);
711 list_del(&nlcth
->list
);
718 /* Make sure we return success if we flush and there is no helpers */
719 return (found
|| j
== 0) ? 0 : ret
;
722 static const struct nla_policy nfnl_cthelper_policy
[NFCTH_MAX
+1] = {
723 [NFCTH_NAME
] = { .type
= NLA_NUL_STRING
,
724 .len
= NF_CT_HELPER_NAME_LEN
-1 },
725 [NFCTH_QUEUE_NUM
] = { .type
= NLA_U32
, },
728 static const struct nfnl_callback nfnl_cthelper_cb
[NFNL_MSG_CTHELPER_MAX
] = {
729 [NFNL_MSG_CTHELPER_NEW
] = { .call
= nfnl_cthelper_new
,
730 .attr_count
= NFCTH_MAX
,
731 .policy
= nfnl_cthelper_policy
},
732 [NFNL_MSG_CTHELPER_GET
] = { .call
= nfnl_cthelper_get
,
733 .attr_count
= NFCTH_MAX
,
734 .policy
= nfnl_cthelper_policy
},
735 [NFNL_MSG_CTHELPER_DEL
] = { .call
= nfnl_cthelper_del
,
736 .attr_count
= NFCTH_MAX
,
737 .policy
= nfnl_cthelper_policy
},
740 static const struct nfnetlink_subsystem nfnl_cthelper_subsys
= {
742 .subsys_id
= NFNL_SUBSYS_CTHELPER
,
743 .cb_count
= NFNL_MSG_CTHELPER_MAX
,
744 .cb
= nfnl_cthelper_cb
,
747 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_CTHELPER
);
749 static int __init
nfnl_cthelper_init(void)
753 ret
= nfnetlink_subsys_register(&nfnl_cthelper_subsys
);
755 pr_err("nfnl_cthelper: cannot register with nfnetlink.\n");
763 static void __exit
nfnl_cthelper_exit(void)
765 struct nf_conntrack_helper
*cur
;
766 struct nfnl_cthelper
*nlcth
, *n
;
768 nfnetlink_subsys_unregister(&nfnl_cthelper_subsys
);
770 list_for_each_entry_safe(nlcth
, n
, &nfnl_cthelper_list
, list
) {
771 cur
= &nlcth
->helper
;
773 nf_conntrack_helper_unregister(cur
);
774 kfree(cur
->expect_policy
);
779 module_init(nfnl_cthelper_init
);
780 module_exit(nfnl_cthelper_exit
);