2 * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License version 2 as
6 * published by the Free Software Foundation.
8 * This software has been sponsored by Sophos Astaro <http://www.sophos.com>
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/netlink.h>
15 #include <linux/netfilter.h>
16 #include <linux/netfilter/nfnetlink.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <linux/netfilter/nf_tables_compat.h>
19 #include <linux/netfilter/x_tables.h>
20 #include <linux/netfilter_ipv4/ip_tables.h>
21 #include <linux/netfilter_ipv6/ip6_tables.h>
22 #include <linux/netfilter_bridge/ebtables.h>
23 #include <net/netfilter/nf_tables.h>
25 static int nft_compat_chain_validate_dependency(const char *tablename
,
26 const struct nft_chain
*chain
)
28 const struct nft_base_chain
*basechain
;
30 if (!tablename
|| !(chain
->flags
& NFT_BASE_CHAIN
))
33 basechain
= nft_base_chain(chain
);
34 if (strcmp(tablename
, "nat") == 0 &&
35 basechain
->type
->type
!= NFT_CHAIN_T_NAT
)
48 nft_compat_set_par(struct xt_action_param
*par
, void *xt
, const void *xt_info
)
51 par
->targinfo
= xt_info
;
55 static void nft_target_eval_xt(const struct nft_expr
*expr
,
56 struct nft_data data
[NFT_REG_MAX
+ 1],
57 const struct nft_pktinfo
*pkt
)
59 void *info
= nft_expr_priv(expr
);
60 struct xt_target
*target
= expr
->ops
->data
;
61 struct sk_buff
*skb
= pkt
->skb
;
64 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
66 ret
= target
->target(skb
, &pkt
->xt
);
73 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
76 data
[NFT_REG_VERDICT
].verdict
= ret
;
81 static void nft_target_eval_bridge(const struct nft_expr
*expr
,
82 struct nft_data data
[NFT_REG_MAX
+ 1],
83 const struct nft_pktinfo
*pkt
)
85 void *info
= nft_expr_priv(expr
);
86 struct xt_target
*target
= expr
->ops
->data
;
87 struct sk_buff
*skb
= pkt
->skb
;
90 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, target
, info
);
92 ret
= target
->target(skb
, &pkt
->xt
);
99 data
[NFT_REG_VERDICT
].verdict
= NF_ACCEPT
;
102 data
[NFT_REG_VERDICT
].verdict
= NF_DROP
;
105 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
108 data
[NFT_REG_VERDICT
].verdict
= NFT_RETURN
;
111 data
[NFT_REG_VERDICT
].verdict
= ret
;
116 static const struct nla_policy nft_target_policy
[NFTA_TARGET_MAX
+ 1] = {
117 [NFTA_TARGET_NAME
] = { .type
= NLA_NUL_STRING
},
118 [NFTA_TARGET_REV
] = { .type
= NLA_U32
},
119 [NFTA_TARGET_INFO
] = { .type
= NLA_BINARY
},
123 nft_target_set_tgchk_param(struct xt_tgchk_param
*par
,
124 const struct nft_ctx
*ctx
,
125 struct xt_target
*target
, void *info
,
126 union nft_entry
*entry
, u16 proto
, bool inv
)
129 par
->table
= ctx
->table
->name
;
130 switch (ctx
->afi
->family
) {
132 entry
->e4
.ip
.proto
= proto
;
133 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
137 entry
->e6
.ipv6
.flags
|= IP6T_F_PROTO
;
139 entry
->e6
.ipv6
.proto
= proto
;
140 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
143 entry
->ebt
.ethproto
= (__force __be16
)proto
;
144 entry
->ebt
.invflags
= inv
? EBT_IPROTO
: 0;
147 par
->entryinfo
= entry
;
148 par
->target
= target
;
149 par
->targinfo
= info
;
150 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
151 const struct nft_base_chain
*basechain
=
152 nft_base_chain(ctx
->chain
);
153 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
155 par
->hook_mask
= 1 << ops
->hooknum
;
159 par
->family
= ctx
->afi
->family
;
162 static void target_compat_from_user(struct xt_target
*t
, void *in
, void *out
)
166 memcpy(out
, in
, t
->targetsize
);
167 pad
= XT_ALIGN(t
->targetsize
) - t
->targetsize
;
169 memset(out
+ t
->targetsize
, 0, pad
);
172 static const struct nla_policy nft_rule_compat_policy
[NFTA_RULE_COMPAT_MAX
+ 1] = {
173 [NFTA_RULE_COMPAT_PROTO
] = { .type
= NLA_U32
},
174 [NFTA_RULE_COMPAT_FLAGS
] = { .type
= NLA_U32
},
177 static int nft_parse_compat(const struct nlattr
*attr
, u16
*proto
, bool *inv
)
179 struct nlattr
*tb
[NFTA_RULE_COMPAT_MAX
+1];
183 err
= nla_parse_nested(tb
, NFTA_RULE_COMPAT_MAX
, attr
,
184 nft_rule_compat_policy
);
188 if (!tb
[NFTA_RULE_COMPAT_PROTO
] || !tb
[NFTA_RULE_COMPAT_FLAGS
])
191 flags
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_FLAGS
]));
192 if (flags
& ~NFT_RULE_COMPAT_F_MASK
)
194 if (flags
& NFT_RULE_COMPAT_F_INV
)
197 *proto
= ntohl(nla_get_be32(tb
[NFTA_RULE_COMPAT_PROTO
]));
202 nft_target_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
203 const struct nlattr
* const tb
[])
205 void *info
= nft_expr_priv(expr
);
206 struct xt_target
*target
= expr
->ops
->data
;
207 struct xt_tgchk_param par
;
208 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_TARGET_INFO
]));
211 union nft_entry e
= {};
214 ret
= nft_compat_chain_validate_dependency(target
->table
, ctx
->chain
);
218 target_compat_from_user(target
, nla_data(tb
[NFTA_TARGET_INFO
]), info
);
220 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
221 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
226 nft_target_set_tgchk_param(&par
, ctx
, target
, info
, &e
, proto
, inv
);
228 ret
= xt_check_target(&par
, size
, proto
, inv
);
232 /* The standard target cannot be used */
233 if (target
->target
== NULL
) {
240 module_put(target
->me
);
245 nft_target_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
247 struct xt_target
*target
= expr
->ops
->data
;
248 void *info
= nft_expr_priv(expr
);
249 struct xt_tgdtor_param par
;
254 par
.family
= ctx
->afi
->family
;
255 if (par
.target
->destroy
!= NULL
)
256 par
.target
->destroy(&par
);
258 module_put(target
->me
);
261 static int nft_target_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
263 const struct xt_target
*target
= expr
->ops
->data
;
264 void *info
= nft_expr_priv(expr
);
266 if (nla_put_string(skb
, NFTA_TARGET_NAME
, target
->name
) ||
267 nla_put_be32(skb
, NFTA_TARGET_REV
, htonl(target
->revision
)) ||
268 nla_put(skb
, NFTA_TARGET_INFO
, XT_ALIGN(target
->targetsize
), info
))
269 goto nla_put_failure
;
277 static int nft_target_validate(const struct nft_ctx
*ctx
,
278 const struct nft_expr
*expr
,
279 const struct nft_data
**data
)
281 struct xt_target
*target
= expr
->ops
->data
;
282 unsigned int hook_mask
= 0;
285 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
286 const struct nft_base_chain
*basechain
=
287 nft_base_chain(ctx
->chain
);
288 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
290 hook_mask
= 1 << ops
->hooknum
;
291 if (!(hook_mask
& target
->hooks
))
294 ret
= nft_compat_chain_validate_dependency(target
->table
,
302 static void nft_match_eval(const struct nft_expr
*expr
,
303 struct nft_data data
[NFT_REG_MAX
+ 1],
304 const struct nft_pktinfo
*pkt
)
306 void *info
= nft_expr_priv(expr
);
307 struct xt_match
*match
= expr
->ops
->data
;
308 struct sk_buff
*skb
= pkt
->skb
;
311 nft_compat_set_par((struct xt_action_param
*)&pkt
->xt
, match
, info
);
313 ret
= match
->match(skb
, (struct xt_action_param
*)&pkt
->xt
);
315 if (pkt
->xt
.hotdrop
) {
316 data
[NFT_REG_VERDICT
].verdict
= NF_DROP
;
322 data
[NFT_REG_VERDICT
].verdict
= NFT_CONTINUE
;
325 data
[NFT_REG_VERDICT
].verdict
= NFT_BREAK
;
330 static const struct nla_policy nft_match_policy
[NFTA_MATCH_MAX
+ 1] = {
331 [NFTA_MATCH_NAME
] = { .type
= NLA_NUL_STRING
},
332 [NFTA_MATCH_REV
] = { .type
= NLA_U32
},
333 [NFTA_MATCH_INFO
] = { .type
= NLA_BINARY
},
336 /* struct xt_mtchk_param and xt_tgchk_param look very similar */
338 nft_match_set_mtchk_param(struct xt_mtchk_param
*par
, const struct nft_ctx
*ctx
,
339 struct xt_match
*match
, void *info
,
340 union nft_entry
*entry
, u16 proto
, bool inv
)
343 par
->table
= ctx
->table
->name
;
344 switch (ctx
->afi
->family
) {
346 entry
->e4
.ip
.proto
= proto
;
347 entry
->e4
.ip
.invflags
= inv
? IPT_INV_PROTO
: 0;
351 entry
->e6
.ipv6
.flags
|= IP6T_F_PROTO
;
353 entry
->e6
.ipv6
.proto
= proto
;
354 entry
->e6
.ipv6
.invflags
= inv
? IP6T_INV_PROTO
: 0;
357 entry
->ebt
.ethproto
= (__force __be16
)proto
;
358 entry
->ebt
.invflags
= inv
? EBT_IPROTO
: 0;
361 par
->entryinfo
= entry
;
363 par
->matchinfo
= info
;
364 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
365 const struct nft_base_chain
*basechain
=
366 nft_base_chain(ctx
->chain
);
367 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
369 par
->hook_mask
= 1 << ops
->hooknum
;
373 par
->family
= ctx
->afi
->family
;
376 static void match_compat_from_user(struct xt_match
*m
, void *in
, void *out
)
380 memcpy(out
, in
, m
->matchsize
);
381 pad
= XT_ALIGN(m
->matchsize
) - m
->matchsize
;
383 memset(out
+ m
->matchsize
, 0, pad
);
387 nft_match_init(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
,
388 const struct nlattr
* const tb
[])
390 void *info
= nft_expr_priv(expr
);
391 struct xt_match
*match
= expr
->ops
->data
;
392 struct xt_mtchk_param par
;
393 size_t size
= XT_ALIGN(nla_len(tb
[NFTA_MATCH_INFO
]));
396 union nft_entry e
= {};
399 ret
= nft_compat_chain_validate_dependency(match
->table
, ctx
->chain
);
403 match_compat_from_user(match
, nla_data(tb
[NFTA_MATCH_INFO
]), info
);
405 if (ctx
->nla
[NFTA_RULE_COMPAT
]) {
406 ret
= nft_parse_compat(ctx
->nla
[NFTA_RULE_COMPAT
], &proto
, &inv
);
411 nft_match_set_mtchk_param(&par
, ctx
, match
, info
, &e
, proto
, inv
);
413 ret
= xt_check_match(&par
, size
, proto
, inv
);
419 module_put(match
->me
);
424 nft_match_destroy(const struct nft_ctx
*ctx
, const struct nft_expr
*expr
)
426 struct xt_match
*match
= expr
->ops
->data
;
427 void *info
= nft_expr_priv(expr
);
428 struct xt_mtdtor_param par
;
432 par
.matchinfo
= info
;
433 par
.family
= ctx
->afi
->family
;
434 if (par
.match
->destroy
!= NULL
)
435 par
.match
->destroy(&par
);
437 module_put(match
->me
);
440 static int nft_match_dump(struct sk_buff
*skb
, const struct nft_expr
*expr
)
442 void *info
= nft_expr_priv(expr
);
443 struct xt_match
*match
= expr
->ops
->data
;
445 if (nla_put_string(skb
, NFTA_MATCH_NAME
, match
->name
) ||
446 nla_put_be32(skb
, NFTA_MATCH_REV
, htonl(match
->revision
)) ||
447 nla_put(skb
, NFTA_MATCH_INFO
, XT_ALIGN(match
->matchsize
), info
))
448 goto nla_put_failure
;
456 static int nft_match_validate(const struct nft_ctx
*ctx
,
457 const struct nft_expr
*expr
,
458 const struct nft_data
**data
)
460 struct xt_match
*match
= expr
->ops
->data
;
461 unsigned int hook_mask
= 0;
464 if (ctx
->chain
->flags
& NFT_BASE_CHAIN
) {
465 const struct nft_base_chain
*basechain
=
466 nft_base_chain(ctx
->chain
);
467 const struct nf_hook_ops
*ops
= &basechain
->ops
[0];
469 hook_mask
= 1 << ops
->hooknum
;
470 if (!(hook_mask
& match
->hooks
))
473 ret
= nft_compat_chain_validate_dependency(match
->table
,
482 nfnl_compat_fill_info(struct sk_buff
*skb
, u32 portid
, u32 seq
, u32 type
,
483 int event
, u16 family
, const char *name
,
486 struct nlmsghdr
*nlh
;
487 struct nfgenmsg
*nfmsg
;
488 unsigned int flags
= portid
? NLM_F_MULTI
: 0;
490 event
|= NFNL_SUBSYS_NFT_COMPAT
<< 8;
491 nlh
= nlmsg_put(skb
, portid
, seq
, event
, sizeof(*nfmsg
), flags
);
495 nfmsg
= nlmsg_data(nlh
);
496 nfmsg
->nfgen_family
= family
;
497 nfmsg
->version
= NFNETLINK_V0
;
500 if (nla_put_string(skb
, NFTA_COMPAT_NAME
, name
) ||
501 nla_put_be32(skb
, NFTA_COMPAT_REV
, htonl(rev
)) ||
502 nla_put_be32(skb
, NFTA_COMPAT_TYPE
, htonl(target
)))
503 goto nla_put_failure
;
510 nlmsg_cancel(skb
, nlh
);
515 nfnl_compat_get(struct sock
*nfnl
, struct sk_buff
*skb
,
516 const struct nlmsghdr
*nlh
, const struct nlattr
* const tb
[])
519 struct nfgenmsg
*nfmsg
;
523 struct sk_buff
*skb2
;
525 if (tb
[NFTA_COMPAT_NAME
] == NULL
||
526 tb
[NFTA_COMPAT_REV
] == NULL
||
527 tb
[NFTA_COMPAT_TYPE
] == NULL
)
530 name
= nla_data(tb
[NFTA_COMPAT_NAME
]);
531 rev
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_REV
]));
532 target
= ntohl(nla_get_be32(tb
[NFTA_COMPAT_TYPE
]));
534 nfmsg
= nlmsg_data(nlh
);
536 switch(nfmsg
->nfgen_family
) {
547 pr_err("nft_compat: unsupported protocol %d\n",
548 nfmsg
->nfgen_family
);
552 try_then_request_module(xt_find_revision(nfmsg
->nfgen_family
, name
,
559 skb2
= nlmsg_new(NLMSG_DEFAULT_SIZE
, GFP_KERNEL
);
563 /* include the best revision for this extension in the message */
564 if (nfnl_compat_fill_info(skb2
, NETLINK_CB(skb
).portid
,
566 NFNL_MSG_TYPE(nlh
->nlmsg_type
),
569 name
, ret
, target
) <= 0) {
574 ret
= netlink_unicast(nfnl
, skb2
, NETLINK_CB(skb
).portid
,
579 return ret
== -EAGAIN
? -ENOBUFS
: ret
;
582 static const struct nla_policy nfnl_compat_policy_get
[NFTA_COMPAT_MAX
+1] = {
583 [NFTA_COMPAT_NAME
] = { .type
= NLA_NUL_STRING
,
584 .len
= NFT_COMPAT_NAME_MAX
-1 },
585 [NFTA_COMPAT_REV
] = { .type
= NLA_U32
},
586 [NFTA_COMPAT_TYPE
] = { .type
= NLA_U32
},
589 static const struct nfnl_callback nfnl_nft_compat_cb
[NFNL_MSG_COMPAT_MAX
] = {
590 [NFNL_MSG_COMPAT_GET
] = { .call
= nfnl_compat_get
,
591 .attr_count
= NFTA_COMPAT_MAX
,
592 .policy
= nfnl_compat_policy_get
},
595 static const struct nfnetlink_subsystem nfnl_compat_subsys
= {
596 .name
= "nft-compat",
597 .subsys_id
= NFNL_SUBSYS_NFT_COMPAT
,
598 .cb_count
= NFNL_MSG_COMPAT_MAX
,
599 .cb
= nfnl_nft_compat_cb
,
602 static LIST_HEAD(nft_match_list
);
605 struct list_head head
;
606 struct nft_expr_ops ops
;
609 static struct nft_expr_type nft_match_type
;
611 static const struct nft_expr_ops
*
612 nft_match_select_ops(const struct nft_ctx
*ctx
,
613 const struct nlattr
* const tb
[])
615 struct nft_xt
*nft_match
;
616 struct xt_match
*match
;
620 if (tb
[NFTA_MATCH_NAME
] == NULL
||
621 tb
[NFTA_MATCH_REV
] == NULL
||
622 tb
[NFTA_MATCH_INFO
] == NULL
)
623 return ERR_PTR(-EINVAL
);
625 mt_name
= nla_data(tb
[NFTA_MATCH_NAME
]);
626 rev
= ntohl(nla_get_be32(tb
[NFTA_MATCH_REV
]));
627 family
= ctx
->afi
->family
;
629 /* Re-use the existing match if it's already loaded. */
630 list_for_each_entry(nft_match
, &nft_match_list
, head
) {
631 struct xt_match
*match
= nft_match
->ops
.data
;
633 if (strcmp(match
->name
, mt_name
) == 0 &&
634 match
->revision
== rev
&& match
->family
== family
) {
635 if (!try_module_get(match
->me
))
636 return ERR_PTR(-ENOENT
);
638 return &nft_match
->ops
;
642 match
= xt_request_find_match(family
, mt_name
, rev
);
644 return ERR_PTR(-ENOENT
);
646 /* This is the first time we use this match, allocate operations */
647 nft_match
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
648 if (nft_match
== NULL
)
649 return ERR_PTR(-ENOMEM
);
651 nft_match
->ops
.type
= &nft_match_type
;
652 nft_match
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(match
->matchsize
));
653 nft_match
->ops
.eval
= nft_match_eval
;
654 nft_match
->ops
.init
= nft_match_init
;
655 nft_match
->ops
.destroy
= nft_match_destroy
;
656 nft_match
->ops
.dump
= nft_match_dump
;
657 nft_match
->ops
.validate
= nft_match_validate
;
658 nft_match
->ops
.data
= match
;
660 list_add(&nft_match
->head
, &nft_match_list
);
662 return &nft_match
->ops
;
665 static void nft_match_release(void)
667 struct nft_xt
*nft_match
, *tmp
;
669 list_for_each_entry_safe(nft_match
, tmp
, &nft_match_list
, head
)
673 static struct nft_expr_type nft_match_type __read_mostly
= {
675 .select_ops
= nft_match_select_ops
,
676 .policy
= nft_match_policy
,
677 .maxattr
= NFTA_MATCH_MAX
,
678 .owner
= THIS_MODULE
,
681 static LIST_HEAD(nft_target_list
);
683 static struct nft_expr_type nft_target_type
;
685 static const struct nft_expr_ops
*
686 nft_target_select_ops(const struct nft_ctx
*ctx
,
687 const struct nlattr
* const tb
[])
689 struct nft_xt
*nft_target
;
690 struct xt_target
*target
;
694 if (tb
[NFTA_TARGET_NAME
] == NULL
||
695 tb
[NFTA_TARGET_REV
] == NULL
||
696 tb
[NFTA_TARGET_INFO
] == NULL
)
697 return ERR_PTR(-EINVAL
);
699 tg_name
= nla_data(tb
[NFTA_TARGET_NAME
]);
700 rev
= ntohl(nla_get_be32(tb
[NFTA_TARGET_REV
]));
701 family
= ctx
->afi
->family
;
703 /* Re-use the existing target if it's already loaded. */
704 list_for_each_entry(nft_target
, &nft_target_list
, head
) {
705 struct xt_target
*target
= nft_target
->ops
.data
;
707 if (strcmp(target
->name
, tg_name
) == 0 &&
708 target
->revision
== rev
&& target
->family
== family
) {
709 if (!try_module_get(target
->me
))
710 return ERR_PTR(-ENOENT
);
712 return &nft_target
->ops
;
716 target
= xt_request_find_target(family
, tg_name
, rev
);
718 return ERR_PTR(-ENOENT
);
720 /* This is the first time we use this target, allocate operations */
721 nft_target
= kzalloc(sizeof(struct nft_xt
), GFP_KERNEL
);
722 if (nft_target
== NULL
)
723 return ERR_PTR(-ENOMEM
);
725 nft_target
->ops
.type
= &nft_target_type
;
726 nft_target
->ops
.size
= NFT_EXPR_SIZE(XT_ALIGN(target
->targetsize
));
727 nft_target
->ops
.init
= nft_target_init
;
728 nft_target
->ops
.destroy
= nft_target_destroy
;
729 nft_target
->ops
.dump
= nft_target_dump
;
730 nft_target
->ops
.validate
= nft_target_validate
;
731 nft_target
->ops
.data
= target
;
733 if (family
== NFPROTO_BRIDGE
)
734 nft_target
->ops
.eval
= nft_target_eval_bridge
;
736 nft_target
->ops
.eval
= nft_target_eval_xt
;
738 list_add(&nft_target
->head
, &nft_target_list
);
740 return &nft_target
->ops
;
743 static void nft_target_release(void)
745 struct nft_xt
*nft_target
, *tmp
;
747 list_for_each_entry_safe(nft_target
, tmp
, &nft_target_list
, head
)
751 static struct nft_expr_type nft_target_type __read_mostly
= {
753 .select_ops
= nft_target_select_ops
,
754 .policy
= nft_target_policy
,
755 .maxattr
= NFTA_TARGET_MAX
,
756 .owner
= THIS_MODULE
,
759 static int __init
nft_compat_module_init(void)
763 ret
= nft_register_expr(&nft_match_type
);
767 ret
= nft_register_expr(&nft_target_type
);
771 ret
= nfnetlink_subsys_register(&nfnl_compat_subsys
);
773 pr_err("nft_compat: cannot register with nfnetlink.\n");
777 pr_info("nf_tables_compat: (c) 2012 Pablo Neira Ayuso <pablo@netfilter.org>\n");
782 nft_unregister_expr(&nft_target_type
);
784 nft_unregister_expr(&nft_match_type
);
788 static void __exit
nft_compat_module_exit(void)
790 nfnetlink_subsys_unregister(&nfnl_compat_subsys
);
791 nft_unregister_expr(&nft_target_type
);
792 nft_unregister_expr(&nft_match_type
);
794 nft_target_release();
797 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT
);
799 module_init(nft_compat_module_init
);
800 module_exit(nft_compat_module_exit
);
802 MODULE_LICENSE("GPL");
803 MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>");
804 MODULE_ALIAS_NFT_EXPR("match");
805 MODULE_ALIAS_NFT_EXPR("target");