Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
0ca743a5 PNA |
2 | /* |
3 | * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org> | |
4 | * | |
0ca743a5 PNA |
5 | * This software has been sponsored by Sophos Astaro <http://www.sophos.com> |
6 | */ | |
7 | ||
8 | #include <linux/kernel.h> | |
9 | #include <linux/init.h> | |
10 | #include <linux/module.h> | |
11 | #include <linux/netlink.h> | |
12 | #include <linux/netfilter.h> | |
13 | #include <linux/netfilter/nfnetlink.h> | |
14 | #include <linux/netfilter/nf_tables.h> | |
15 | #include <linux/netfilter/nf_tables_compat.h> | |
16 | #include <linux/netfilter/x_tables.h> | |
17 | #include <linux/netfilter_ipv4/ip_tables.h> | |
18 | #include <linux/netfilter_ipv6/ip6_tables.h> | |
5191f4d8 | 19 | #include <linux/netfilter_bridge/ebtables.h> |
5f158939 | 20 | #include <linux/netfilter_arp/arp_tables.h> |
0ca743a5 | 21 | #include <net/netfilter/nf_tables.h> |
b53deef0 | 22 | #include <net/netfilter/nf_log.h> |
4b512e1c | 23 | |
732a8049 FW |
24 | /* Used for matches where *info is larger than X byte */ |
25 | #define NFT_MATCH_LARGE_THRESH 192 | |
26 | ||
27 | struct nft_xt_match_priv { | |
28 | void *info; | |
29 | }; | |
30 | ||
e4844c9c FW |
31 | static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, |
32 | const char *tablename) | |
f3f5dded | 33 | { |
e4844c9c FW |
34 | enum nft_chain_types type = NFT_CHAIN_T_DEFAULT; |
35 | const struct nft_chain *chain = ctx->chain; | |
f3f5dded PNA |
36 | const struct nft_base_chain *basechain; |
37 | ||
f323d954 PNA |
38 | if (!tablename || |
39 | !nft_is_base_chain(chain)) | |
f3f5dded PNA |
40 | return 0; |
41 | ||
f3f5dded | 42 | basechain = nft_base_chain(chain); |
e4844c9c FW |
43 | if (strcmp(tablename, "nat") == 0) { |
44 | if (ctx->family != NFPROTO_BRIDGE) | |
45 | type = NFT_CHAIN_T_NAT; | |
46 | if (basechain->type->type != type) | |
47 | return -EINVAL; | |
48 | } | |
f3f5dded PNA |
49 | |
50 | return 0; | |
51 | } | |
52 | ||
0ca743a5 PNA |
53 | union nft_entry { |
54 | struct ipt_entry e4; | |
55 | struct ip6t_entry e6; | |
5191f4d8 | 56 | struct ebt_entry ebt; |
5f158939 | 57 | struct arpt_entry arp; |
0ca743a5 PNA |
58 | }; |
59 | ||
60 | static inline void | |
897389de FW |
61 | nft_compat_set_par(struct xt_action_param *par, |
62 | const struct nft_pktinfo *pkt, | |
63 | const void *xt, const void *xt_info) | |
0ca743a5 | 64 | { |
897389de FW |
65 | par->state = pkt->state; |
66 | par->thoff = nft_thoff(pkt); | |
67 | par->fragoff = pkt->fragoff; | |
0ca743a5 PNA |
68 | par->target = xt; |
69 | par->targinfo = xt_info; | |
70 | par->hotdrop = false; | |
71 | } | |
72 | ||
5191f4d8 | 73 | static void nft_target_eval_xt(const struct nft_expr *expr, |
a55e22e9 | 74 | struct nft_regs *regs, |
5191f4d8 | 75 | const struct nft_pktinfo *pkt) |
0ca743a5 PNA |
76 | { |
77 | void *info = nft_expr_priv(expr); | |
78 | struct xt_target *target = expr->ops->data; | |
79 | struct sk_buff *skb = pkt->skb; | |
897389de | 80 | struct xt_action_param xt; |
0ca743a5 PNA |
81 | int ret; |
82 | ||
897389de | 83 | nft_compat_set_par(&xt, pkt, target, info); |
0ca743a5 | 84 | |
897389de | 85 | ret = target->target(skb, &xt); |
0ca743a5 | 86 | |
897389de | 87 | if (xt.hotdrop) |
0ca743a5 PNA |
88 | ret = NF_DROP; |
89 | ||
5191f4d8 | 90 | switch (ret) { |
0ca743a5 | 91 | case XT_CONTINUE: |
a55e22e9 | 92 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 PNA |
93 | break; |
94 | default: | |
a55e22e9 | 95 | regs->verdict.code = ret; |
0ca743a5 PNA |
96 | break; |
97 | } | |
5191f4d8 AB |
98 | } |
99 | ||
100 | static void nft_target_eval_bridge(const struct nft_expr *expr, | |
a55e22e9 | 101 | struct nft_regs *regs, |
5191f4d8 AB |
102 | const struct nft_pktinfo *pkt) |
103 | { | |
104 | void *info = nft_expr_priv(expr); | |
105 | struct xt_target *target = expr->ops->data; | |
106 | struct sk_buff *skb = pkt->skb; | |
897389de | 107 | struct xt_action_param xt; |
5191f4d8 AB |
108 | int ret; |
109 | ||
897389de | 110 | nft_compat_set_par(&xt, pkt, target, info); |
5191f4d8 | 111 | |
897389de | 112 | ret = target->target(skb, &xt); |
5191f4d8 | 113 | |
897389de | 114 | if (xt.hotdrop) |
5191f4d8 AB |
115 | ret = NF_DROP; |
116 | ||
117 | switch (ret) { | |
118 | case EBT_ACCEPT: | |
a55e22e9 | 119 | regs->verdict.code = NF_ACCEPT; |
5191f4d8 AB |
120 | break; |
121 | case EBT_DROP: | |
a55e22e9 | 122 | regs->verdict.code = NF_DROP; |
5191f4d8 AB |
123 | break; |
124 | case EBT_CONTINUE: | |
a55e22e9 | 125 | regs->verdict.code = NFT_CONTINUE; |
5191f4d8 AB |
126 | break; |
127 | case EBT_RETURN: | |
a55e22e9 | 128 | regs->verdict.code = NFT_RETURN; |
5191f4d8 AB |
129 | break; |
130 | default: | |
a55e22e9 | 131 | regs->verdict.code = ret; |
5191f4d8 AB |
132 | break; |
133 | } | |
0ca743a5 PNA |
134 | } |
135 | ||
136 | static const struct nla_policy nft_target_policy[NFTA_TARGET_MAX + 1] = { | |
137 | [NFTA_TARGET_NAME] = { .type = NLA_NUL_STRING }, | |
36fa8d69 | 138 | [NFTA_TARGET_REV] = NLA_POLICY_MAX(NLA_BE32, 255), |
0ca743a5 PNA |
139 | [NFTA_TARGET_INFO] = { .type = NLA_BINARY }, |
140 | }; | |
141 | ||
142 | static void | |
143 | nft_target_set_tgchk_param(struct xt_tgchk_param *par, | |
144 | const struct nft_ctx *ctx, | |
145 | struct xt_target *target, void *info, | |
2156d321 | 146 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 147 | { |
2daf1b4d | 148 | par->net = ctx->net; |
0ca743a5 | 149 | par->table = ctx->table->name; |
36596dad | 150 | switch (ctx->family) { |
0ca743a5 PNA |
151 | case AF_INET: |
152 | entry->e4.ip.proto = proto; | |
153 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
154 | break; | |
155 | case AF_INET6: | |
749177cc PNA |
156 | if (proto) |
157 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
158 | ||
0ca743a5 PNA |
159 | entry->e6.ipv6.proto = proto; |
160 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
161 | break; | |
5191f4d8 | 162 | case NFPROTO_BRIDGE: |
2156d321 | 163 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
164 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
165 | break; | |
5f158939 AB |
166 | case NFPROTO_ARP: |
167 | break; | |
0ca743a5 PNA |
168 | } |
169 | par->entryinfo = entry; | |
170 | par->target = target; | |
171 | par->targinfo = info; | |
f323d954 | 172 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
173 | const struct nft_base_chain *basechain = |
174 | nft_base_chain(ctx->chain); | |
c974a3a3 | 175 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
176 | |
177 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
178 | } else { |
179 | par->hook_mask = 0; | |
0ca743a5 | 180 | } |
36596dad | 181 | par->family = ctx->family; |
55917a21 | 182 | par->nft_compat = true; |
0ca743a5 PNA |
183 | } |
184 | ||
185 | static void target_compat_from_user(struct xt_target *t, void *in, void *out) | |
186 | { | |
756c1b1a | 187 | int pad; |
0ca743a5 | 188 | |
756c1b1a PNA |
189 | memcpy(out, in, t->targetsize); |
190 | pad = XT_ALIGN(t->targetsize) - t->targetsize; | |
191 | if (pad > 0) | |
192 | memset(out + t->targetsize, 0, pad); | |
0ca743a5 PNA |
193 | } |
194 | ||
195 | static const struct nla_policy nft_rule_compat_policy[NFTA_RULE_COMPAT_MAX + 1] = { | |
196 | [NFTA_RULE_COMPAT_PROTO] = { .type = NLA_U32 }, | |
197 | [NFTA_RULE_COMPAT_FLAGS] = { .type = NLA_U32 }, | |
198 | }; | |
199 | ||
2156d321 | 200 | static int nft_parse_compat(const struct nlattr *attr, u16 *proto, bool *inv) |
0ca743a5 PNA |
201 | { |
202 | struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1]; | |
d694b754 | 203 | u32 l4proto; |
0ca743a5 PNA |
204 | u32 flags; |
205 | int err; | |
206 | ||
8cb08174 JB |
207 | err = nla_parse_nested_deprecated(tb, NFTA_RULE_COMPAT_MAX, attr, |
208 | nft_rule_compat_policy, NULL); | |
0ca743a5 PNA |
209 | if (err < 0) |
210 | return err; | |
211 | ||
212 | if (!tb[NFTA_RULE_COMPAT_PROTO] || !tb[NFTA_RULE_COMPAT_FLAGS]) | |
213 | return -EINVAL; | |
214 | ||
215 | flags = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_FLAGS])); | |
292781c3 PNA |
216 | if (flags & NFT_RULE_COMPAT_F_UNUSED || |
217 | flags & ~NFT_RULE_COMPAT_F_MASK) | |
0ca743a5 PNA |
218 | return -EINVAL; |
219 | if (flags & NFT_RULE_COMPAT_F_INV) | |
220 | *inv = true; | |
221 | ||
d694b754 PNA |
222 | l4proto = ntohl(nla_get_be32(tb[NFTA_RULE_COMPAT_PROTO])); |
223 | if (l4proto > U16_MAX) | |
224 | return -EINVAL; | |
225 | ||
226 | *proto = l4proto; | |
227 | ||
8691a9a3 | 228 | return 0; |
0ca743a5 PNA |
229 | } |
230 | ||
2f941622 FW |
231 | static void nft_compat_wait_for_destructors(void) |
232 | { | |
233 | /* xtables matches or targets can have side effects, e.g. | |
234 | * creation/destruction of /proc files. | |
235 | * The xt ->destroy functions are run asynchronously from | |
236 | * work queue. If we have pending invocations we thus | |
237 | * need to wait for those to finish. | |
238 | */ | |
239 | nf_tables_trans_destroy_flush_work(); | |
240 | } | |
241 | ||
0ca743a5 PNA |
242 | static int |
243 | nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
244 | const struct nlattr * const tb[]) | |
245 | { | |
246 | void *info = nft_expr_priv(expr); | |
247 | struct xt_target *target = expr->ops->data; | |
248 | struct xt_tgchk_param par; | |
249 | size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); | |
2156d321 | 250 | u16 proto = 0; |
0ca743a5 PNA |
251 | bool inv = false; |
252 | union nft_entry e = {}; | |
253 | int ret; | |
254 | ||
255 | target_compat_from_user(target, nla_data(tb[NFTA_TARGET_INFO]), info); | |
256 | ||
8691a9a3 PNA |
257 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
258 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
259 | if (ret < 0) | |
b8e9dc1c | 260 | return ret; |
8691a9a3 | 261 | } |
0ca743a5 PNA |
262 | |
263 | nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); | |
264 | ||
2f941622 | 265 | nft_compat_wait_for_destructors(); |
ffe8923f | 266 | |
0ca743a5 | 267 | ret = xt_check_target(&par, size, proto, inv); |
b53deef0 FW |
268 | if (ret < 0) { |
269 | if (ret == -ENOENT) { | |
270 | const char *modname = NULL; | |
271 | ||
272 | if (strcmp(target->name, "LOG") == 0) | |
273 | modname = "nf_log_syslog"; | |
274 | else if (strcmp(target->name, "NFLOG") == 0) | |
275 | modname = "nfnetlink_log"; | |
276 | ||
277 | if (modname && | |
278 | nft_request_module(ctx->net, "%s", modname) == -EAGAIN) | |
279 | return -EAGAIN; | |
280 | } | |
281 | ||
b8e9dc1c | 282 | return ret; |
b53deef0 | 283 | } |
0ca743a5 PNA |
284 | |
285 | /* The standard target cannot be used */ | |
b8e9dc1c FW |
286 | if (!target->target) |
287 | return -EINVAL; | |
0ca743a5 PNA |
288 | |
289 | return 0; | |
0ca743a5 PNA |
290 | } |
291 | ||
ffe8923f FW |
292 | static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr) |
293 | { | |
ffe8923f FW |
294 | module_put(me); |
295 | kfree(expr->ops); | |
296 | } | |
297 | ||
0ca743a5 | 298 | static void |
62472bce | 299 | nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) |
0ca743a5 PNA |
300 | { |
301 | struct xt_target *target = expr->ops->data; | |
3d9b1421 | 302 | void *info = nft_expr_priv(expr); |
753c111f | 303 | struct module *me = target->me; |
3d9b1421 PNA |
304 | struct xt_tgdtor_param par; |
305 | ||
306 | par.net = ctx->net; | |
307 | par.target = target; | |
308 | par.targinfo = info; | |
36596dad | 309 | par.family = ctx->family; |
3d9b1421 PNA |
310 | if (par.target->destroy != NULL) |
311 | par.target->destroy(&par); | |
0ca743a5 | 312 | |
ffe8923f | 313 | __nft_mt_tg_destroy(me, expr); |
0ca743a5 PNA |
314 | } |
315 | ||
d701d811 PNA |
316 | static int nft_extension_dump_info(struct sk_buff *skb, int attr, |
317 | const void *info, | |
318 | unsigned int size, unsigned int user_size) | |
319 | { | |
320 | unsigned int info_size, aligned_size = XT_ALIGN(size); | |
321 | struct nlattr *nla; | |
322 | ||
323 | nla = nla_reserve(skb, attr, aligned_size); | |
324 | if (!nla) | |
325 | return -1; | |
326 | ||
327 | info_size = user_size ? : size; | |
328 | memcpy(nla_data(nla), info, info_size); | |
329 | memset(nla_data(nla) + info_size, 0, aligned_size - info_size); | |
330 | ||
331 | return 0; | |
332 | } | |
333 | ||
7d34aa3e PS |
334 | static int nft_target_dump(struct sk_buff *skb, |
335 | const struct nft_expr *expr, bool reset) | |
0ca743a5 PNA |
336 | { |
337 | const struct xt_target *target = expr->ops->data; | |
338 | void *info = nft_expr_priv(expr); | |
339 | ||
340 | if (nla_put_string(skb, NFTA_TARGET_NAME, target->name) || | |
341 | nla_put_be32(skb, NFTA_TARGET_REV, htonl(target->revision)) || | |
d701d811 PNA |
342 | nft_extension_dump_info(skb, NFTA_TARGET_INFO, info, |
343 | target->targetsize, target->usersize)) | |
0ca743a5 PNA |
344 | goto nla_put_failure; |
345 | ||
346 | return 0; | |
347 | ||
348 | nla_put_failure: | |
349 | return -1; | |
350 | } | |
351 | ||
352 | static int nft_target_validate(const struct nft_ctx *ctx, | |
353 | const struct nft_expr *expr, | |
354 | const struct nft_data **data) | |
355 | { | |
356 | struct xt_target *target = expr->ops->data; | |
357 | unsigned int hook_mask = 0; | |
f3f5dded | 358 | int ret; |
0ca743a5 | 359 | |
d0009eff PNA |
360 | if (ctx->family != NFPROTO_IPV4 && |
361 | ctx->family != NFPROTO_IPV6 && | |
7e0f122c | 362 | ctx->family != NFPROTO_INET && |
d0009eff PNA |
363 | ctx->family != NFPROTO_BRIDGE && |
364 | ctx->family != NFPROTO_ARP) | |
365 | return -EOPNOTSUPP; | |
366 | ||
7e0f122c IK |
367 | ret = nft_chain_validate_hooks(ctx->chain, |
368 | (1 << NF_INET_PRE_ROUTING) | | |
369 | (1 << NF_INET_LOCAL_IN) | | |
370 | (1 << NF_INET_FORWARD) | | |
371 | (1 << NF_INET_LOCAL_OUT) | | |
372 | (1 << NF_INET_POST_ROUTING)); | |
373 | if (ret) | |
374 | return ret; | |
375 | ||
f323d954 | 376 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
377 | const struct nft_base_chain *basechain = |
378 | nft_base_chain(ctx->chain); | |
c974a3a3 | 379 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
380 | |
381 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 382 | if (target->hooks && !(hook_mask & target->hooks)) |
f3f5dded | 383 | return -EINVAL; |
0ca743a5 | 384 | |
e4844c9c | 385 | ret = nft_compat_chain_validate_dependency(ctx, target->table); |
f3f5dded PNA |
386 | if (ret < 0) |
387 | return ret; | |
0ca743a5 PNA |
388 | } |
389 | return 0; | |
390 | } | |
391 | ||
8bdf1647 FW |
392 | static void __nft_match_eval(const struct nft_expr *expr, |
393 | struct nft_regs *regs, | |
394 | const struct nft_pktinfo *pkt, | |
395 | void *info) | |
0ca743a5 | 396 | { |
0ca743a5 PNA |
397 | struct xt_match *match = expr->ops->data; |
398 | struct sk_buff *skb = pkt->skb; | |
897389de | 399 | struct xt_action_param xt; |
0ca743a5 PNA |
400 | bool ret; |
401 | ||
897389de | 402 | nft_compat_set_par(&xt, pkt, match, info); |
0ca743a5 | 403 | |
897389de | 404 | ret = match->match(skb, &xt); |
0ca743a5 | 405 | |
897389de | 406 | if (xt.hotdrop) { |
a55e22e9 | 407 | regs->verdict.code = NF_DROP; |
0ca743a5 PNA |
408 | return; |
409 | } | |
410 | ||
c1f86676 DM |
411 | switch (ret ? 1 : 0) { |
412 | case 1: | |
a55e22e9 | 413 | regs->verdict.code = NFT_CONTINUE; |
0ca743a5 | 414 | break; |
c1f86676 | 415 | case 0: |
a55e22e9 | 416 | regs->verdict.code = NFT_BREAK; |
0ca743a5 PNA |
417 | break; |
418 | } | |
419 | } | |
420 | ||
732a8049 FW |
421 | static void nft_match_large_eval(const struct nft_expr *expr, |
422 | struct nft_regs *regs, | |
423 | const struct nft_pktinfo *pkt) | |
424 | { | |
425 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
426 | ||
427 | __nft_match_eval(expr, regs, pkt, priv->info); | |
428 | } | |
429 | ||
8bdf1647 FW |
430 | static void nft_match_eval(const struct nft_expr *expr, |
431 | struct nft_regs *regs, | |
432 | const struct nft_pktinfo *pkt) | |
433 | { | |
434 | __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr)); | |
435 | } | |
436 | ||
0ca743a5 PNA |
437 | static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { |
438 | [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, | |
36fa8d69 | 439 | [NFTA_MATCH_REV] = NLA_POLICY_MAX(NLA_BE32, 255), |
0ca743a5 PNA |
440 | [NFTA_MATCH_INFO] = { .type = NLA_BINARY }, |
441 | }; | |
442 | ||
443 | /* struct xt_mtchk_param and xt_tgchk_param look very similar */ | |
444 | static void | |
445 | nft_match_set_mtchk_param(struct xt_mtchk_param *par, const struct nft_ctx *ctx, | |
446 | struct xt_match *match, void *info, | |
2156d321 | 447 | union nft_entry *entry, u16 proto, bool inv) |
0ca743a5 | 448 | { |
2daf1b4d | 449 | par->net = ctx->net; |
0ca743a5 | 450 | par->table = ctx->table->name; |
36596dad | 451 | switch (ctx->family) { |
0ca743a5 PNA |
452 | case AF_INET: |
453 | entry->e4.ip.proto = proto; | |
454 | entry->e4.ip.invflags = inv ? IPT_INV_PROTO : 0; | |
455 | break; | |
456 | case AF_INET6: | |
749177cc PNA |
457 | if (proto) |
458 | entry->e6.ipv6.flags |= IP6T_F_PROTO; | |
459 | ||
0ca743a5 PNA |
460 | entry->e6.ipv6.proto = proto; |
461 | entry->e6.ipv6.invflags = inv ? IP6T_INV_PROTO : 0; | |
462 | break; | |
5191f4d8 | 463 | case NFPROTO_BRIDGE: |
2156d321 | 464 | entry->ebt.ethproto = (__force __be16)proto; |
5191f4d8 AB |
465 | entry->ebt.invflags = inv ? EBT_IPROTO : 0; |
466 | break; | |
5f158939 AB |
467 | case NFPROTO_ARP: |
468 | break; | |
0ca743a5 PNA |
469 | } |
470 | par->entryinfo = entry; | |
471 | par->match = match; | |
472 | par->matchinfo = info; | |
f323d954 | 473 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
474 | const struct nft_base_chain *basechain = |
475 | nft_base_chain(ctx->chain); | |
c974a3a3 | 476 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
477 | |
478 | par->hook_mask = 1 << ops->hooknum; | |
493618a9 PNA |
479 | } else { |
480 | par->hook_mask = 0; | |
0ca743a5 | 481 | } |
36596dad | 482 | par->family = ctx->family; |
55917a21 | 483 | par->nft_compat = true; |
0ca743a5 PNA |
484 | } |
485 | ||
486 | static void match_compat_from_user(struct xt_match *m, void *in, void *out) | |
487 | { | |
756c1b1a PNA |
488 | int pad; |
489 | ||
490 | memcpy(out, in, m->matchsize); | |
491 | pad = XT_ALIGN(m->matchsize) - m->matchsize; | |
492 | if (pad > 0) | |
493 | memset(out + m->matchsize, 0, pad); | |
0ca743a5 PNA |
494 | } |
495 | ||
496 | static int | |
8bdf1647 FW |
497 | __nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, |
498 | const struct nlattr * const tb[], | |
499 | void *info) | |
0ca743a5 | 500 | { |
0ca743a5 PNA |
501 | struct xt_match *match = expr->ops->data; |
502 | struct xt_mtchk_param par; | |
503 | size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); | |
2156d321 | 504 | u16 proto = 0; |
0ca743a5 PNA |
505 | bool inv = false; |
506 | union nft_entry e = {}; | |
507 | int ret; | |
508 | ||
509 | match_compat_from_user(match, nla_data(tb[NFTA_MATCH_INFO]), info); | |
510 | ||
8691a9a3 PNA |
511 | if (ctx->nla[NFTA_RULE_COMPAT]) { |
512 | ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); | |
513 | if (ret < 0) | |
b8e9dc1c | 514 | return ret; |
8691a9a3 | 515 | } |
0ca743a5 PNA |
516 | |
517 | nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); | |
518 | ||
2f941622 FW |
519 | nft_compat_wait_for_destructors(); |
520 | ||
b8e20400 | 521 | return xt_check_match(&par, size, proto, inv); |
0ca743a5 PNA |
522 | } |
523 | ||
8bdf1647 FW |
524 | static int |
525 | nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
526 | const struct nlattr * const tb[]) | |
527 | { | |
528 | return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr)); | |
529 | } | |
530 | ||
732a8049 FW |
531 | static int |
532 | nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, | |
533 | const struct nlattr * const tb[]) | |
534 | { | |
535 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
536 | struct xt_match *m = expr->ops->data; | |
537 | int ret; | |
538 | ||
539 | priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); | |
540 | if (!priv->info) | |
541 | return -ENOMEM; | |
542 | ||
543 | ret = __nft_match_init(ctx, expr, tb, priv->info); | |
544 | if (ret) | |
545 | kfree(priv->info); | |
546 | return ret; | |
547 | } | |
548 | ||
0ca743a5 | 549 | static void |
8bdf1647 FW |
550 | __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, |
551 | void *info) | |
0ca743a5 PNA |
552 | { |
553 | struct xt_match *match = expr->ops->data; | |
29e38801 | 554 | struct module *me = match->me; |
3d9b1421 PNA |
555 | struct xt_mtdtor_param par; |
556 | ||
557 | par.net = ctx->net; | |
558 | par.match = match; | |
559 | par.matchinfo = info; | |
36596dad | 560 | par.family = ctx->family; |
3d9b1421 PNA |
561 | if (par.match->destroy != NULL) |
562 | par.match->destroy(&par); | |
0ca743a5 | 563 | |
ffe8923f | 564 | __nft_mt_tg_destroy(me, expr); |
0ca743a5 PNA |
565 | } |
566 | ||
8bdf1647 FW |
567 | static void |
568 | nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
569 | { | |
570 | __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); | |
571 | } | |
572 | ||
732a8049 FW |
573 | static void |
574 | nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) | |
575 | { | |
576 | struct nft_xt_match_priv *priv = nft_expr_priv(expr); | |
577 | ||
578 | __nft_match_destroy(ctx, expr, priv->info); | |
579 | kfree(priv->info); | |
580 | } | |
581 | ||
8bdf1647 FW |
582 | static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, |
583 | void *info) | |
0ca743a5 | 584 | { |
0ca743a5 PNA |
585 | struct xt_match *match = expr->ops->data; |
586 | ||
587 | if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) || | |
588 | nla_put_be32(skb, NFTA_MATCH_REV, htonl(match->revision)) || | |
d701d811 PNA |
589 | nft_extension_dump_info(skb, NFTA_MATCH_INFO, info, |
590 | match->matchsize, match->usersize)) | |
0ca743a5 PNA |
591 | goto nla_put_failure; |
592 | ||
593 | return 0; | |
594 | ||
595 | nla_put_failure: | |
596 | return -1; | |
597 | } | |
598 | ||
7d34aa3e PS |
599 | static int nft_match_dump(struct sk_buff *skb, |
600 | const struct nft_expr *expr, bool reset) | |
8bdf1647 FW |
601 | { |
602 | return __nft_match_dump(skb, expr, nft_expr_priv(expr)); | |
603 | } | |
604 | ||
7d34aa3e PS |
605 | static int nft_match_large_dump(struct sk_buff *skb, |
606 | const struct nft_expr *e, bool reset) | |
732a8049 FW |
607 | { |
608 | struct nft_xt_match_priv *priv = nft_expr_priv(e); | |
609 | ||
610 | return __nft_match_dump(skb, e, priv->info); | |
611 | } | |
612 | ||
0ca743a5 PNA |
613 | static int nft_match_validate(const struct nft_ctx *ctx, |
614 | const struct nft_expr *expr, | |
615 | const struct nft_data **data) | |
616 | { | |
617 | struct xt_match *match = expr->ops->data; | |
618 | unsigned int hook_mask = 0; | |
f3f5dded | 619 | int ret; |
0ca743a5 | 620 | |
d0009eff PNA |
621 | if (ctx->family != NFPROTO_IPV4 && |
622 | ctx->family != NFPROTO_IPV6 && | |
7e0f122c | 623 | ctx->family != NFPROTO_INET && |
d0009eff PNA |
624 | ctx->family != NFPROTO_BRIDGE && |
625 | ctx->family != NFPROTO_ARP) | |
626 | return -EOPNOTSUPP; | |
627 | ||
7e0f122c IK |
628 | ret = nft_chain_validate_hooks(ctx->chain, |
629 | (1 << NF_INET_PRE_ROUTING) | | |
630 | (1 << NF_INET_LOCAL_IN) | | |
631 | (1 << NF_INET_FORWARD) | | |
632 | (1 << NF_INET_LOCAL_OUT) | | |
633 | (1 << NF_INET_POST_ROUTING)); | |
634 | if (ret) | |
635 | return ret; | |
636 | ||
f323d954 | 637 | if (nft_is_base_chain(ctx->chain)) { |
0ca743a5 PNA |
638 | const struct nft_base_chain *basechain = |
639 | nft_base_chain(ctx->chain); | |
c974a3a3 | 640 | const struct nf_hook_ops *ops = &basechain->ops; |
0ca743a5 PNA |
641 | |
642 | hook_mask = 1 << ops->hooknum; | |
f7fb77fc | 643 | if (match->hooks && !(hook_mask & match->hooks)) |
f3f5dded | 644 | return -EINVAL; |
0ca743a5 | 645 | |
e4844c9c | 646 | ret = nft_compat_chain_validate_dependency(ctx, match->table); |
f3f5dded PNA |
647 | if (ret < 0) |
648 | return ret; | |
0ca743a5 PNA |
649 | } |
650 | return 0; | |
651 | } | |
652 | ||
653 | static int | |
654 | nfnl_compat_fill_info(struct sk_buff *skb, u32 portid, u32 seq, u32 type, | |
655 | int event, u16 family, const char *name, | |
656 | int rev, int target) | |
657 | { | |
658 | struct nlmsghdr *nlh; | |
0ca743a5 PNA |
659 | unsigned int flags = portid ? NLM_F_MULTI : 0; |
660 | ||
dedb67c4 | 661 | event = nfnl_msg_type(NFNL_SUBSYS_NFT_COMPAT, event); |
19c28b13 PNA |
662 | nlh = nfnl_msg_put(skb, portid, seq, event, flags, family, |
663 | NFNETLINK_V0, 0); | |
664 | if (!nlh) | |
0ca743a5 PNA |
665 | goto nlmsg_failure; |
666 | ||
0ca743a5 PNA |
667 | if (nla_put_string(skb, NFTA_COMPAT_NAME, name) || |
668 | nla_put_be32(skb, NFTA_COMPAT_REV, htonl(rev)) || | |
669 | nla_put_be32(skb, NFTA_COMPAT_TYPE, htonl(target))) | |
670 | goto nla_put_failure; | |
671 | ||
672 | nlmsg_end(skb, nlh); | |
673 | return skb->len; | |
674 | ||
675 | nlmsg_failure: | |
676 | nla_put_failure: | |
677 | nlmsg_cancel(skb, nlh); | |
678 | return -1; | |
679 | } | |
680 | ||
797d4980 PNA |
681 | static int nfnl_compat_get_rcu(struct sk_buff *skb, |
682 | const struct nfnl_info *info, | |
683 | const struct nlattr * const tb[]) | |
0ca743a5 | 684 | { |
ef4b65e5 | 685 | u8 family = info->nfmsg->nfgen_family; |
797d4980 | 686 | const char *name, *fmt; |
0ca743a5 | 687 | struct sk_buff *skb2; |
797d4980 PNA |
688 | int ret = 0, target; |
689 | u32 rev; | |
0ca743a5 PNA |
690 | |
691 | if (tb[NFTA_COMPAT_NAME] == NULL || | |
692 | tb[NFTA_COMPAT_REV] == NULL || | |
693 | tb[NFTA_COMPAT_TYPE] == NULL) | |
694 | return -EINVAL; | |
695 | ||
696 | name = nla_data(tb[NFTA_COMPAT_NAME]); | |
697 | rev = ntohl(nla_get_be32(tb[NFTA_COMPAT_REV])); | |
698 | target = ntohl(nla_get_be32(tb[NFTA_COMPAT_TYPE])); | |
699 | ||
ef4b65e5 | 700 | switch(family) { |
0ca743a5 PNA |
701 | case AF_INET: |
702 | fmt = "ipt_%s"; | |
703 | break; | |
704 | case AF_INET6: | |
705 | fmt = "ip6t_%s"; | |
706 | break; | |
5191f4d8 AB |
707 | case NFPROTO_BRIDGE: |
708 | fmt = "ebt_%s"; | |
709 | break; | |
5f158939 AB |
710 | case NFPROTO_ARP: |
711 | fmt = "arpt_%s"; | |
712 | break; | |
0ca743a5 | 713 | default: |
ef4b65e5 | 714 | pr_err("nft_compat: unsupported protocol %d\n", family); |
0ca743a5 PNA |
715 | return -EINVAL; |
716 | } | |
717 | ||
eb1fb147 FW |
718 | if (!try_module_get(THIS_MODULE)) |
719 | return -EINVAL; | |
720 | ||
721 | rcu_read_unlock(); | |
ef4b65e5 PNA |
722 | try_then_request_module(xt_find_revision(family, name, rev, target, &ret), |
723 | fmt, name); | |
0ca743a5 | 724 | if (ret < 0) |
eb1fb147 | 725 | goto out_put; |
0ca743a5 PNA |
726 | |
727 | skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); | |
eb1fb147 FW |
728 | if (skb2 == NULL) { |
729 | ret = -ENOMEM; | |
730 | goto out_put; | |
731 | } | |
0ca743a5 PNA |
732 | |
733 | /* include the best revision for this extension in the message */ | |
734 | if (nfnl_compat_fill_info(skb2, NETLINK_CB(skb).portid, | |
797d4980 PNA |
735 | info->nlh->nlmsg_seq, |
736 | NFNL_MSG_TYPE(info->nlh->nlmsg_type), | |
0ca743a5 | 737 | NFNL_MSG_COMPAT_GET, |
ef4b65e5 | 738 | family, name, ret, target) <= 0) { |
0ca743a5 | 739 | kfree_skb(skb2); |
eb1fb147 | 740 | goto out_put; |
0ca743a5 PNA |
741 | } |
742 | ||
241d1af4 | 743 | ret = nfnetlink_unicast(skb2, info->net, NETLINK_CB(skb).portid); |
eb1fb147 FW |
744 | out_put: |
745 | rcu_read_lock(); | |
746 | module_put(THIS_MODULE); | |
241d1af4 PNA |
747 | |
748 | return ret; | |
0ca743a5 PNA |
749 | } |
750 | ||
751 | static const struct nla_policy nfnl_compat_policy_get[NFTA_COMPAT_MAX+1] = { | |
752 | [NFTA_COMPAT_NAME] = { .type = NLA_NUL_STRING, | |
753 | .len = NFT_COMPAT_NAME_MAX-1 }, | |
36fa8d69 | 754 | [NFTA_COMPAT_REV] = NLA_POLICY_MAX(NLA_BE32, 255), |
0ca743a5 PNA |
755 | [NFTA_COMPAT_TYPE] = { .type = NLA_U32 }, |
756 | }; | |
757 | ||
758 | static const struct nfnl_callback nfnl_nft_compat_cb[NFNL_MSG_COMPAT_MAX] = { | |
50f2db9e PNA |
759 | [NFNL_MSG_COMPAT_GET] = { |
760 | .call = nfnl_compat_get_rcu, | |
761 | .type = NFNL_CB_RCU, | |
762 | .attr_count = NFTA_COMPAT_MAX, | |
763 | .policy = nfnl_compat_policy_get | |
764 | }, | |
0ca743a5 PNA |
765 | }; |
766 | ||
767 | static const struct nfnetlink_subsystem nfnl_compat_subsys = { | |
768 | .name = "nft-compat", | |
769 | .subsys_id = NFNL_SUBSYS_NFT_COMPAT, | |
770 | .cb_count = NFNL_MSG_COMPAT_MAX, | |
771 | .cb = nfnl_nft_compat_cb, | |
772 | }; | |
773 | ||
b8e20400 | 774 | static struct nft_expr_type nft_match_type; |
ba378ca9 | 775 | |
c828414a FW |
776 | static bool nft_match_reduce(struct nft_regs_track *track, |
777 | const struct nft_expr *expr) | |
778 | { | |
779 | const struct xt_match *match = expr->ops->data; | |
780 | ||
781 | return strcmp(match->name, "comment") == 0; | |
782 | } | |
783 | ||
0ca743a5 PNA |
784 | static const struct nft_expr_ops * |
785 | nft_match_select_ops(const struct nft_ctx *ctx, | |
786 | const struct nlattr * const tb[]) | |
787 | { | |
b8e20400 | 788 | struct nft_expr_ops *ops; |
0ca743a5 | 789 | struct xt_match *match; |
732a8049 | 790 | unsigned int matchsize; |
0ca743a5 | 791 | char *mt_name; |
ba378ca9 | 792 | u32 rev, family; |
2bf4fade | 793 | int err; |
0ca743a5 PNA |
794 | |
795 | if (tb[NFTA_MATCH_NAME] == NULL || | |
796 | tb[NFTA_MATCH_REV] == NULL || | |
797 | tb[NFTA_MATCH_INFO] == NULL) | |
798 | return ERR_PTR(-EINVAL); | |
799 | ||
800 | mt_name = nla_data(tb[NFTA_MATCH_NAME]); | |
801 | rev = ntohl(nla_get_be32(tb[NFTA_MATCH_REV])); | |
36596dad | 802 | family = ctx->family; |
0ca743a5 | 803 | |
0ca743a5 PNA |
804 | match = xt_request_find_match(family, mt_name, rev); |
805 | if (IS_ERR(match)) | |
806 | return ERR_PTR(-ENOENT); | |
807 | ||
2bf4fade LZ |
808 | if (match->matchsize > nla_len(tb[NFTA_MATCH_INFO])) { |
809 | err = -EINVAL; | |
810 | goto err; | |
811 | } | |
f0716cd6 | 812 | |
b8e20400 PNA |
813 | ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); |
814 | if (!ops) { | |
2bf4fade LZ |
815 | err = -ENOMEM; |
816 | goto err; | |
817 | } | |
0ca743a5 | 818 | |
b8e20400 PNA |
819 | ops->type = &nft_match_type; |
820 | ops->eval = nft_match_eval; | |
821 | ops->init = nft_match_init; | |
822 | ops->destroy = nft_match_destroy; | |
823 | ops->dump = nft_match_dump; | |
824 | ops->validate = nft_match_validate; | |
825 | ops->data = match; | |
c828414a | 826 | ops->reduce = nft_match_reduce; |
0ca743a5 | 827 | |
732a8049 FW |
828 | matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); |
829 | if (matchsize > NFT_MATCH_LARGE_THRESH) { | |
830 | matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); | |
831 | ||
b8e20400 PNA |
832 | ops->eval = nft_match_large_eval; |
833 | ops->init = nft_match_large_init; | |
834 | ops->destroy = nft_match_large_destroy; | |
835 | ops->dump = nft_match_large_dump; | |
732a8049 FW |
836 | } |
837 | ||
b8e20400 | 838 | ops->size = matchsize; |
732a8049 | 839 | |
b8e20400 | 840 | return ops; |
2bf4fade LZ |
841 | err: |
842 | module_put(match->me); | |
843 | return ERR_PTR(err); | |
0ca743a5 PNA |
844 | } |
845 | ||
b8e20400 PNA |
846 | static void nft_match_release_ops(const struct nft_expr_ops *ops) |
847 | { | |
848 | struct xt_match *match = ops->data; | |
849 | ||
850 | module_put(match->me); | |
851 | kfree(ops); | |
852 | } | |
853 | ||
0ca743a5 PNA |
854 | static struct nft_expr_type nft_match_type __read_mostly = { |
855 | .name = "match", | |
856 | .select_ops = nft_match_select_ops, | |
b8e20400 | 857 | .release_ops = nft_match_release_ops, |
0ca743a5 PNA |
858 | .policy = nft_match_policy, |
859 | .maxattr = NFTA_MATCH_MAX, | |
860 | .owner = THIS_MODULE, | |
861 | }; | |
862 | ||
b8e20400 | 863 | static struct nft_expr_type nft_target_type; |
ba378ca9 | 864 | |
0ca743a5 PNA |
865 | static const struct nft_expr_ops * |
866 | nft_target_select_ops(const struct nft_ctx *ctx, | |
867 | const struct nlattr * const tb[]) | |
868 | { | |
b8e20400 | 869 | struct nft_expr_ops *ops; |
0ca743a5 PNA |
870 | struct xt_target *target; |
871 | char *tg_name; | |
ba378ca9 | 872 | u32 rev, family; |
2bf4fade | 873 | int err; |
0ca743a5 PNA |
874 | |
875 | if (tb[NFTA_TARGET_NAME] == NULL || | |
876 | tb[NFTA_TARGET_REV] == NULL || | |
877 | tb[NFTA_TARGET_INFO] == NULL) | |
878 | return ERR_PTR(-EINVAL); | |
879 | ||
880 | tg_name = nla_data(tb[NFTA_TARGET_NAME]); | |
881 | rev = ntohl(nla_get_be32(tb[NFTA_TARGET_REV])); | |
36596dad | 882 | family = ctx->family; |
0ca743a5 | 883 | |
21d5e078 FW |
884 | if (strcmp(tg_name, XT_ERROR_TARGET) == 0 || |
885 | strcmp(tg_name, XT_STANDARD_TARGET) == 0 || | |
886 | strcmp(tg_name, "standard") == 0) | |
887 | return ERR_PTR(-EINVAL); | |
888 | ||
0ca743a5 PNA |
889 | target = xt_request_find_target(family, tg_name, rev); |
890 | if (IS_ERR(target)) | |
891 | return ERR_PTR(-ENOENT); | |
892 | ||
21d5e078 FW |
893 | if (!target->target) { |
894 | err = -EINVAL; | |
895 | goto err; | |
896 | } | |
897 | ||
2bf4fade LZ |
898 | if (target->targetsize > nla_len(tb[NFTA_TARGET_INFO])) { |
899 | err = -EINVAL; | |
900 | goto err; | |
901 | } | |
f0716cd6 | 902 | |
b8e20400 PNA |
903 | ops = kzalloc(sizeof(struct nft_expr_ops), GFP_KERNEL); |
904 | if (!ops) { | |
2bf4fade LZ |
905 | err = -ENOMEM; |
906 | goto err; | |
907 | } | |
0ca743a5 | 908 | |
b8e20400 PNA |
909 | ops->type = &nft_target_type; |
910 | ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); | |
911 | ops->init = nft_target_init; | |
912 | ops->destroy = nft_target_destroy; | |
913 | ops->dump = nft_target_dump; | |
914 | ops->validate = nft_target_validate; | |
915 | ops->data = target; | |
b2d30654 | 916 | ops->reduce = NFT_REDUCE_READONLY; |
0ca743a5 | 917 | |
5191f4d8 | 918 | if (family == NFPROTO_BRIDGE) |
b8e20400 | 919 | ops->eval = nft_target_eval_bridge; |
5191f4d8 | 920 | else |
b8e20400 | 921 | ops->eval = nft_target_eval_xt; |
0ca743a5 | 922 | |
b8e20400 | 923 | return ops; |
2bf4fade LZ |
924 | err: |
925 | module_put(target->me); | |
926 | return ERR_PTR(err); | |
0ca743a5 PNA |
927 | } |
928 | ||
b8e20400 PNA |
929 | static void nft_target_release_ops(const struct nft_expr_ops *ops) |
930 | { | |
931 | struct xt_target *target = ops->data; | |
932 | ||
933 | module_put(target->me); | |
934 | kfree(ops); | |
935 | } | |
936 | ||
0ca743a5 PNA |
937 | static struct nft_expr_type nft_target_type __read_mostly = { |
938 | .name = "target", | |
939 | .select_ops = nft_target_select_ops, | |
b8e20400 | 940 | .release_ops = nft_target_release_ops, |
0ca743a5 PNA |
941 | .policy = nft_target_policy, |
942 | .maxattr = NFTA_TARGET_MAX, | |
943 | .owner = THIS_MODULE, | |
944 | }; | |
945 | ||
946 | static int __init nft_compat_module_init(void) | |
947 | { | |
948 | int ret; | |
949 | ||
950 | ret = nft_register_expr(&nft_match_type); | |
951 | if (ret < 0) | |
b8e20400 | 952 | return ret; |
0ca743a5 PNA |
953 | |
954 | ret = nft_register_expr(&nft_target_type); | |
955 | if (ret < 0) | |
956 | goto err_match; | |
957 | ||
958 | ret = nfnetlink_subsys_register(&nfnl_compat_subsys); | |
959 | if (ret < 0) { | |
960 | pr_err("nft_compat: cannot register with nfnetlink.\n"); | |
961 | goto err_target; | |
962 | } | |
963 | ||
0ca743a5 | 964 | return ret; |
0ca743a5 PNA |
965 | err_target: |
966 | nft_unregister_expr(&nft_target_type); | |
967 | err_match: | |
968 | nft_unregister_expr(&nft_match_type); | |
969 | return ret; | |
970 | } | |
971 | ||
972 | static void __exit nft_compat_module_exit(void) | |
973 | { | |
974 | nfnetlink_subsys_unregister(&nfnl_compat_subsys); | |
975 | nft_unregister_expr(&nft_target_type); | |
976 | nft_unregister_expr(&nft_match_type); | |
0ca743a5 PNA |
977 | } |
978 | ||
979 | MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); | |
980 | ||
981 | module_init(nft_compat_module_init); | |
982 | module_exit(nft_compat_module_exit); | |
983 | ||
984 | MODULE_LICENSE("GPL"); | |
985 | MODULE_AUTHOR("Pablo Neira Ayuso <pablo@netfilter.org>"); | |
986 | MODULE_ALIAS_NFT_EXPR("match"); | |
987 | MODULE_ALIAS_NFT_EXPR("target"); | |
4cacc395 | 988 | MODULE_DESCRIPTION("x_tables over nftables support"); |