2 * Copyright (c) 2008-2009 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2016 Pablo Neira Ayuso <pablo@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
12 #include <linux/kernel.h>
13 #include <linux/init.h>
14 #include <linux/module.h>
15 #include <linux/netlink.h>
16 #include <linux/netfilter.h>
17 #include <linux/netfilter/nf_tables.h>
18 #include <net/netfilter/nf_tables.h>
19 #include <net/netfilter/nf_conntrack.h>
20 #include <net/netfilter/nf_conntrack_acct.h>
21 #include <net/netfilter/nf_conntrack_tuple.h>
22 #include <net/netfilter/nf_conntrack_helper.h>
23 #include <net/netfilter/nf_conntrack_ecache.h>
24 #include <net/netfilter/nf_conntrack_labels.h>
27 enum nft_ct_keys key:8;
28 enum ip_conntrack_dir dir:8;
30 enum nft_registers dreg:8;
31 enum nft_registers sreg:8;
35 struct nft_ct_helper_obj {
36 struct nf_conntrack_helper *helper4;
37 struct nf_conntrack_helper *helper6;
41 #ifdef CONFIG_NF_CONNTRACK_ZONES
42 static DEFINE_PER_CPU(struct nf_conn *, nft_ct_pcpu_template);
43 static unsigned int nft_ct_pcpu_template_refcnt __read_mostly;
46 static u64 nft_ct_get_eval_counter(const struct nf_conn_counter *c,
48 enum ip_conntrack_dir d)
50 if (d < IP_CT_DIR_MAX)
51 return k == NFT_CT_BYTES ? atomic64_read(&c[d].bytes) :
52 atomic64_read(&c[d].packets);
54 return nft_ct_get_eval_counter(c, k, IP_CT_DIR_ORIGINAL) +
55 nft_ct_get_eval_counter(c, k, IP_CT_DIR_REPLY);
58 static void nft_ct_get_eval(const struct nft_expr *expr,
59 struct nft_regs *regs,
60 const struct nft_pktinfo *pkt)
62 const struct nft_ct *priv = nft_expr_priv(expr);
63 u32 *dest = ®s->data[priv->dreg];
64 enum ip_conntrack_info ctinfo;
65 const struct nf_conn *ct;
66 const struct nf_conn_help *help;
67 const struct nf_conntrack_tuple *tuple;
68 const struct nf_conntrack_helper *helper;
71 ct = nf_ct_get(pkt->skb, &ctinfo);
76 state = NF_CT_STATE_BIT(ctinfo);
77 else if (ctinfo == IP_CT_UNTRACKED)
78 state = NF_CT_STATE_UNTRACKED_BIT;
80 state = NF_CT_STATE_INVALID_BIT;
91 case NFT_CT_DIRECTION:
92 nft_reg_store8(dest, CTINFO2DIR(ctinfo));
97 #ifdef CONFIG_NF_CONNTRACK_MARK
102 #ifdef CONFIG_NF_CONNTRACK_SECMARK
107 case NFT_CT_EXPIRATION:
108 *dest = jiffies_to_msecs(nf_ct_expires(ct));
111 if (ct->master == NULL)
113 help = nfct_help(ct->master);
116 helper = rcu_dereference(help->helper);
119 strncpy((char *)dest, helper->name, NF_CT_HELPER_NAME_LEN);
121 #ifdef CONFIG_NF_CONNTRACK_LABELS
122 case NFT_CT_LABELS: {
123 struct nf_conn_labels *labels = nf_ct_labels_find(ct);
126 memcpy(dest, labels->bits, NF_CT_LABELS_MAX_SIZE);
128 memset(dest, 0, NF_CT_LABELS_MAX_SIZE);
132 case NFT_CT_BYTES: /* fallthrough */
134 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
138 count = nft_ct_get_eval_counter(acct->counter,
139 priv->key, priv->dir);
140 memcpy(dest, &count, sizeof(count));
143 case NFT_CT_AVGPKT: {
144 const struct nf_conn_acct *acct = nf_conn_acct_find(ct);
145 u64 avgcnt = 0, bcnt = 0, pcnt = 0;
148 pcnt = nft_ct_get_eval_counter(acct->counter,
149 NFT_CT_PKTS, priv->dir);
150 bcnt = nft_ct_get_eval_counter(acct->counter,
151 NFT_CT_BYTES, priv->dir);
153 avgcnt = div64_u64(bcnt, pcnt);
156 memcpy(dest, &avgcnt, sizeof(avgcnt));
159 case NFT_CT_L3PROTOCOL:
160 nft_reg_store8(dest, nf_ct_l3num(ct));
162 case NFT_CT_PROTOCOL:
163 nft_reg_store8(dest, nf_ct_protonum(ct));
165 #ifdef CONFIG_NF_CONNTRACK_ZONES
167 const struct nf_conntrack_zone *zone = nf_ct_zone(ct);
170 if (priv->dir < IP_CT_DIR_MAX)
171 zoneid = nf_ct_zone_id(zone, priv->dir);
175 nft_reg_store16(dest, zoneid);
183 tuple = &ct->tuplehash[priv->dir].tuple;
186 memcpy(dest, tuple->src.u3.all,
187 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
190 memcpy(dest, tuple->dst.u3.all,
191 nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);
193 case NFT_CT_PROTO_SRC:
194 nft_reg_store16(dest, (__force u16)tuple->src.u.all);
196 case NFT_CT_PROTO_DST:
197 nft_reg_store16(dest, (__force u16)tuple->dst.u.all);
200 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
202 *dest = tuple->src.u3.ip;
205 if (nf_ct_l3num(ct) != NFPROTO_IPV4)
207 *dest = tuple->dst.u3.ip;
210 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
212 memcpy(dest, tuple->src.u3.ip6, sizeof(struct in6_addr));
215 if (nf_ct_l3num(ct) != NFPROTO_IPV6)
217 memcpy(dest, tuple->dst.u3.ip6, sizeof(struct in6_addr));
224 regs->verdict.code = NFT_BREAK;
227 #ifdef CONFIG_NF_CONNTRACK_ZONES
228 static void nft_ct_set_zone_eval(const struct nft_expr *expr,
229 struct nft_regs *regs,
230 const struct nft_pktinfo *pkt)
232 struct nf_conntrack_zone zone = { .dir = NF_CT_DEFAULT_ZONE_DIR };
233 const struct nft_ct *priv = nft_expr_priv(expr);
234 struct sk_buff *skb = pkt->skb;
235 enum ip_conntrack_info ctinfo;
236 u16 value = nft_reg_load16(®s->data[priv->sreg]);
239 ct = nf_ct_get(skb, &ctinfo);
240 if (ct) /* already tracked */
246 case IP_CT_DIR_ORIGINAL:
247 zone.dir = NF_CT_ZONE_DIR_ORIG;
249 case IP_CT_DIR_REPLY:
250 zone.dir = NF_CT_ZONE_DIR_REPL;
256 ct = this_cpu_read(nft_ct_pcpu_template);
258 if (likely(atomic_read(&ct->ct_general.use) == 1)) {
259 nf_ct_zone_add(ct, &zone);
261 /* previous skb got queued to userspace */
262 ct = nf_ct_tmpl_alloc(nft_net(pkt), &zone, GFP_ATOMIC);
264 regs->verdict.code = NF_DROP;
269 atomic_inc(&ct->ct_general.use);
270 nf_ct_set(skb, ct, IP_CT_NEW);
274 static void nft_ct_set_eval(const struct nft_expr *expr,
275 struct nft_regs *regs,
276 const struct nft_pktinfo *pkt)
278 const struct nft_ct *priv = nft_expr_priv(expr);
279 struct sk_buff *skb = pkt->skb;
280 #ifdef CONFIG_NF_CONNTRACK_MARK
281 u32 value = regs->data[priv->sreg];
283 enum ip_conntrack_info ctinfo;
286 ct = nf_ct_get(skb, &ctinfo);
287 if (ct == NULL || nf_ct_is_template(ct))
291 #ifdef CONFIG_NF_CONNTRACK_MARK
293 if (ct->mark != value) {
295 nf_conntrack_event_cache(IPCT_MARK, ct);
299 #ifdef CONFIG_NF_CONNTRACK_LABELS
301 nf_connlabels_replace(ct,
302 ®s->data[priv->sreg],
303 ®s->data[priv->sreg],
304 NF_CT_LABELS_MAX_SIZE / sizeof(u32));
307 #ifdef CONFIG_NF_CONNTRACK_EVENTS
308 case NFT_CT_EVENTMASK: {
309 struct nf_conntrack_ecache *e = nf_ct_ecache_find(ct);
310 u32 ctmask = regs->data[priv->sreg];
313 if (e->ctmask != ctmask)
318 if (ctmask && !nf_ct_is_confirmed(ct))
319 nf_ct_ecache_ext_add(ct, ctmask, 0, GFP_ATOMIC);
328 static const struct nla_policy nft_ct_policy[NFTA_CT_MAX + 1] = {
329 [NFTA_CT_DREG] = { .type = NLA_U32 },
330 [NFTA_CT_KEY] = { .type = NLA_U32 },
331 [NFTA_CT_DIRECTION] = { .type = NLA_U8 },
332 [NFTA_CT_SREG] = { .type = NLA_U32 },
335 #ifdef CONFIG_NF_CONNTRACK_ZONES
336 static void nft_ct_tmpl_put_pcpu(void)
341 for_each_possible_cpu(cpu) {
342 ct = per_cpu(nft_ct_pcpu_template, cpu);
346 per_cpu(nft_ct_pcpu_template, cpu) = NULL;
350 static bool nft_ct_tmpl_alloc_pcpu(void)
352 struct nf_conntrack_zone zone = { .id = 0 };
356 if (nft_ct_pcpu_template_refcnt)
359 for_each_possible_cpu(cpu) {
360 tmp = nf_ct_tmpl_alloc(&init_net, &zone, GFP_KERNEL);
362 nft_ct_tmpl_put_pcpu();
366 atomic_set(&tmp->ct_general.use, 1);
367 per_cpu(nft_ct_pcpu_template, cpu) = tmp;
374 static int nft_ct_get_init(const struct nft_ctx *ctx,
375 const struct nft_expr *expr,
376 const struct nlattr * const tb[])
378 struct nft_ct *priv = nft_expr_priv(expr);
382 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
383 priv->dir = IP_CT_DIR_MAX;
385 case NFT_CT_DIRECTION:
386 if (tb[NFTA_CT_DIRECTION] != NULL)
392 #ifdef CONFIG_NF_CONNTRACK_MARK
395 #ifdef CONFIG_NF_CONNTRACK_SECMARK
398 case NFT_CT_EXPIRATION:
399 if (tb[NFTA_CT_DIRECTION] != NULL)
403 #ifdef CONFIG_NF_CONNTRACK_LABELS
405 if (tb[NFTA_CT_DIRECTION] != NULL)
407 len = NF_CT_LABELS_MAX_SIZE;
411 if (tb[NFTA_CT_DIRECTION] != NULL)
413 len = NF_CT_HELPER_NAME_LEN;
416 case NFT_CT_L3PROTOCOL:
417 case NFT_CT_PROTOCOL:
418 /* For compatibility, do not report error if NFTA_CT_DIRECTION
419 * attribute is specified.
425 if (tb[NFTA_CT_DIRECTION] == NULL)
428 switch (ctx->family) {
430 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
435 len = FIELD_SIZEOF(struct nf_conntrack_tuple,
439 return -EAFNOSUPPORT;
444 if (tb[NFTA_CT_DIRECTION] == NULL)
447 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip);
451 if (tb[NFTA_CT_DIRECTION] == NULL)
454 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u3.ip6);
456 case NFT_CT_PROTO_SRC:
457 case NFT_CT_PROTO_DST:
458 if (tb[NFTA_CT_DIRECTION] == NULL)
460 len = FIELD_SIZEOF(struct nf_conntrack_tuple, src.u.all);
467 #ifdef CONFIG_NF_CONNTRACK_ZONES
476 if (tb[NFTA_CT_DIRECTION] != NULL) {
477 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
479 case IP_CT_DIR_ORIGINAL:
480 case IP_CT_DIR_REPLY:
487 priv->dreg = nft_parse_register(tb[NFTA_CT_DREG]);
488 err = nft_validate_register_store(ctx, priv->dreg, NULL,
489 NFT_DATA_VALUE, len);
493 err = nf_ct_netns_get(ctx->net, ctx->family);
497 if (priv->key == NFT_CT_BYTES ||
498 priv->key == NFT_CT_PKTS ||
499 priv->key == NFT_CT_AVGPKT)
500 nf_ct_set_acct(ctx->net, true);
505 static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv)
508 #ifdef CONFIG_NF_CONNTRACK_LABELS
510 nf_connlabels_put(ctx->net);
513 #ifdef CONFIG_NF_CONNTRACK_ZONES
515 if (--nft_ct_pcpu_template_refcnt == 0)
516 nft_ct_tmpl_put_pcpu();
523 static int nft_ct_set_init(const struct nft_ctx *ctx,
524 const struct nft_expr *expr,
525 const struct nlattr * const tb[])
527 struct nft_ct *priv = nft_expr_priv(expr);
531 priv->dir = IP_CT_DIR_MAX;
532 priv->key = ntohl(nla_get_be32(tb[NFTA_CT_KEY]));
534 #ifdef CONFIG_NF_CONNTRACK_MARK
536 if (tb[NFTA_CT_DIRECTION])
538 len = FIELD_SIZEOF(struct nf_conn, mark);
541 #ifdef CONFIG_NF_CONNTRACK_LABELS
543 if (tb[NFTA_CT_DIRECTION])
545 len = NF_CT_LABELS_MAX_SIZE;
546 err = nf_connlabels_get(ctx->net, (len * BITS_PER_BYTE) - 1);
551 #ifdef CONFIG_NF_CONNTRACK_ZONES
553 if (!nft_ct_tmpl_alloc_pcpu())
555 nft_ct_pcpu_template_refcnt++;
559 #ifdef CONFIG_NF_CONNTRACK_EVENTS
560 case NFT_CT_EVENTMASK:
561 if (tb[NFTA_CT_DIRECTION])
570 if (tb[NFTA_CT_DIRECTION]) {
571 priv->dir = nla_get_u8(tb[NFTA_CT_DIRECTION]);
573 case IP_CT_DIR_ORIGINAL:
574 case IP_CT_DIR_REPLY:
582 priv->sreg = nft_parse_register(tb[NFTA_CT_SREG]);
583 err = nft_validate_register_load(priv->sreg, len);
587 err = nf_ct_netns_get(ctx->net, ctx->family);
594 __nft_ct_set_destroy(ctx, priv);
598 static void nft_ct_get_destroy(const struct nft_ctx *ctx,
599 const struct nft_expr *expr)
601 nf_ct_netns_put(ctx->net, ctx->family);
604 static void nft_ct_set_destroy(const struct nft_ctx *ctx,
605 const struct nft_expr *expr)
607 struct nft_ct *priv = nft_expr_priv(expr);
609 __nft_ct_set_destroy(ctx, priv);
610 nf_ct_netns_put(ctx->net, ctx->family);
613 static int nft_ct_get_dump(struct sk_buff *skb, const struct nft_expr *expr)
615 const struct nft_ct *priv = nft_expr_priv(expr);
617 if (nft_dump_register(skb, NFTA_CT_DREG, priv->dreg))
618 goto nla_put_failure;
619 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
620 goto nla_put_failure;
629 case NFT_CT_PROTO_SRC:
630 case NFT_CT_PROTO_DST:
631 if (nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
632 goto nla_put_failure;
638 if (priv->dir < IP_CT_DIR_MAX &&
639 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
640 goto nla_put_failure;
652 static int nft_ct_set_dump(struct sk_buff *skb, const struct nft_expr *expr)
654 const struct nft_ct *priv = nft_expr_priv(expr);
656 if (nft_dump_register(skb, NFTA_CT_SREG, priv->sreg))
657 goto nla_put_failure;
658 if (nla_put_be32(skb, NFTA_CT_KEY, htonl(priv->key)))
659 goto nla_put_failure;
663 if (priv->dir < IP_CT_DIR_MAX &&
664 nla_put_u8(skb, NFTA_CT_DIRECTION, priv->dir))
665 goto nla_put_failure;
677 static struct nft_expr_type nft_ct_type;
678 static const struct nft_expr_ops nft_ct_get_ops = {
679 .type = &nft_ct_type,
680 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
681 .eval = nft_ct_get_eval,
682 .init = nft_ct_get_init,
683 .destroy = nft_ct_get_destroy,
684 .dump = nft_ct_get_dump,
687 static const struct nft_expr_ops nft_ct_set_ops = {
688 .type = &nft_ct_type,
689 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
690 .eval = nft_ct_set_eval,
691 .init = nft_ct_set_init,
692 .destroy = nft_ct_set_destroy,
693 .dump = nft_ct_set_dump,
696 #ifdef CONFIG_NF_CONNTRACK_ZONES
697 static const struct nft_expr_ops nft_ct_set_zone_ops = {
698 .type = &nft_ct_type,
699 .size = NFT_EXPR_SIZE(sizeof(struct nft_ct)),
700 .eval = nft_ct_set_zone_eval,
701 .init = nft_ct_set_init,
702 .destroy = nft_ct_set_destroy,
703 .dump = nft_ct_set_dump,
707 static const struct nft_expr_ops *
708 nft_ct_select_ops(const struct nft_ctx *ctx,
709 const struct nlattr * const tb[])
711 if (tb[NFTA_CT_KEY] == NULL)
712 return ERR_PTR(-EINVAL);
714 if (tb[NFTA_CT_DREG] && tb[NFTA_CT_SREG])
715 return ERR_PTR(-EINVAL);
717 if (tb[NFTA_CT_DREG])
718 return &nft_ct_get_ops;
720 if (tb[NFTA_CT_SREG]) {
721 #ifdef CONFIG_NF_CONNTRACK_ZONES
722 if (nla_get_be32(tb[NFTA_CT_KEY]) == htonl(NFT_CT_ZONE))
723 return &nft_ct_set_zone_ops;
725 return &nft_ct_set_ops;
728 return ERR_PTR(-EINVAL);
731 static struct nft_expr_type nft_ct_type __read_mostly = {
733 .select_ops = nft_ct_select_ops,
734 .policy = nft_ct_policy,
735 .maxattr = NFTA_CT_MAX,
736 .owner = THIS_MODULE,
739 static void nft_notrack_eval(const struct nft_expr *expr,
740 struct nft_regs *regs,
741 const struct nft_pktinfo *pkt)
743 struct sk_buff *skb = pkt->skb;
744 enum ip_conntrack_info ctinfo;
747 ct = nf_ct_get(pkt->skb, &ctinfo);
748 /* Previously seen (loopback or untracked)? Ignore. */
749 if (ct || ctinfo == IP_CT_UNTRACKED)
752 nf_ct_set(skb, ct, IP_CT_UNTRACKED);
755 static struct nft_expr_type nft_notrack_type;
756 static const struct nft_expr_ops nft_notrack_ops = {
757 .type = &nft_notrack_type,
758 .size = NFT_EXPR_SIZE(0),
759 .eval = nft_notrack_eval,
762 static struct nft_expr_type nft_notrack_type __read_mostly = {
764 .ops = &nft_notrack_ops,
765 .owner = THIS_MODULE,
768 static int nft_ct_helper_obj_init(const struct nft_ctx *ctx,
769 const struct nlattr * const tb[],
770 struct nft_object *obj)
772 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
773 struct nf_conntrack_helper *help4, *help6;
774 char name[NF_CT_HELPER_NAME_LEN];
775 int family = ctx->family;
777 if (!tb[NFTA_CT_HELPER_NAME] || !tb[NFTA_CT_HELPER_L4PROTO])
780 priv->l4proto = nla_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
784 nla_strlcpy(name, tb[NFTA_CT_HELPER_NAME], sizeof(name));
786 if (tb[NFTA_CT_HELPER_L3PROTO])
787 family = ntohs(nla_get_be16(tb[NFTA_CT_HELPER_L3PROTO]));
794 if (ctx->family == NFPROTO_IPV6)
797 help4 = nf_conntrack_helper_try_module_get(name, family,
801 if (ctx->family == NFPROTO_IPV4)
804 help6 = nf_conntrack_helper_try_module_get(name, family,
807 case NFPROTO_NETDEV: /* fallthrough */
808 case NFPROTO_BRIDGE: /* same */
810 help4 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV4,
812 help6 = nf_conntrack_helper_try_module_get(name, NFPROTO_IPV6,
816 return -EAFNOSUPPORT;
819 /* && is intentional; only error if INET found neither ipv4 or ipv6 */
820 if (!help4 && !help6)
823 priv->helper4 = help4;
824 priv->helper6 = help6;
829 static void nft_ct_helper_obj_destroy(struct nft_object *obj)
831 struct nft_ct_helper_obj *priv = nft_obj_data(obj);
834 nf_conntrack_helper_put(priv->helper4);
836 nf_conntrack_helper_put(priv->helper6);
839 static void nft_ct_helper_obj_eval(struct nft_object *obj,
840 struct nft_regs *regs,
841 const struct nft_pktinfo *pkt)
843 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
844 struct nf_conn *ct = (struct nf_conn *)skb_nfct(pkt->skb);
845 struct nf_conntrack_helper *to_assign = NULL;
846 struct nf_conn_help *help;
849 nf_ct_is_confirmed(ct) ||
850 nf_ct_is_template(ct) ||
851 priv->l4proto != nf_ct_protonum(ct))
854 switch (nf_ct_l3num(ct)) {
856 to_assign = priv->helper4;
859 to_assign = priv->helper6;
869 if (test_bit(IPS_HELPER_BIT, &ct->status))
872 help = nf_ct_helper_ext_add(ct, to_assign, GFP_ATOMIC);
874 rcu_assign_pointer(help->helper, to_assign);
875 set_bit(IPS_HELPER_BIT, &ct->status);
879 static int nft_ct_helper_obj_dump(struct sk_buff *skb,
880 struct nft_object *obj, bool reset)
882 const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
883 const struct nf_conntrack_helper *helper = priv->helper4;
886 if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
889 if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
892 if (priv->helper4 && priv->helper6)
893 family = NFPROTO_INET;
894 else if (priv->helper6)
895 family = NFPROTO_IPV6;
897 family = NFPROTO_IPV4;
899 if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
905 static const struct nla_policy nft_ct_helper_policy[NFTA_CT_HELPER_MAX + 1] = {
906 [NFTA_CT_HELPER_NAME] = { .type = NLA_STRING,
907 .len = NF_CT_HELPER_NAME_LEN - 1 },
908 [NFTA_CT_HELPER_L3PROTO] = { .type = NLA_U16 },
909 [NFTA_CT_HELPER_L4PROTO] = { .type = NLA_U8 },
912 static struct nft_object_type nft_ct_helper_obj_type;
913 static const struct nft_object_ops nft_ct_helper_obj_ops = {
914 .type = &nft_ct_helper_obj_type,
915 .size = sizeof(struct nft_ct_helper_obj),
916 .eval = nft_ct_helper_obj_eval,
917 .init = nft_ct_helper_obj_init,
918 .destroy = nft_ct_helper_obj_destroy,
919 .dump = nft_ct_helper_obj_dump,
922 static struct nft_object_type nft_ct_helper_obj_type __read_mostly = {
923 .type = NFT_OBJECT_CT_HELPER,
924 .ops = &nft_ct_helper_obj_ops,
925 .maxattr = NFTA_CT_HELPER_MAX,
926 .policy = nft_ct_helper_policy,
927 .owner = THIS_MODULE,
930 static int __init nft_ct_module_init(void)
934 BUILD_BUG_ON(NF_CT_LABELS_MAX_SIZE > NFT_REG_SIZE);
936 err = nft_register_expr(&nft_ct_type);
940 err = nft_register_expr(&nft_notrack_type);
944 err = nft_register_obj(&nft_ct_helper_obj_type);
951 nft_unregister_expr(&nft_notrack_type);
953 nft_unregister_expr(&nft_ct_type);
957 static void __exit nft_ct_module_exit(void)
959 nft_unregister_obj(&nft_ct_helper_obj_type);
960 nft_unregister_expr(&nft_notrack_type);
961 nft_unregister_expr(&nft_ct_type);
964 module_init(nft_ct_module_init);
965 module_exit(nft_ct_module_exit);
967 MODULE_LICENSE("GPL");
968 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
969 MODULE_ALIAS_NFT_EXPR("ct");
970 MODULE_ALIAS_NFT_EXPR("notrack");
971 MODULE_ALIAS_NFT_OBJ(NFT_OBJECT_CT_HELPER);