Loading...
1/* SPDX-License-Identifier: GPL-2.0 */
2#include <linux/module.h>
3#include <linux/netfilter/nf_tables.h>
4#include <net/netfilter/nf_tables.h>
5#include <net/netfilter/nf_tables_core.h>
6#include <net/netfilter/nf_tproxy.h>
7#include <net/inet_sock.h>
8#include <net/tcp.h>
9#include <linux/if_ether.h>
10#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
11#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
12#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
13#endif
14
15struct nft_tproxy {
16 u8 sreg_addr;
17 u8 sreg_port;
18 u8 family;
19};
20
21static void nft_tproxy_eval_v4(const struct nft_expr *expr,
22 struct nft_regs *regs,
23 const struct nft_pktinfo *pkt)
24{
25 const struct nft_tproxy *priv = nft_expr_priv(expr);
26 struct sk_buff *skb = pkt->skb;
27 const struct iphdr *iph = ip_hdr(skb);
28 struct udphdr _hdr, *hp;
29 __be32 taddr = 0;
30 __be16 tport = 0;
31 struct sock *sk;
32
33 if (pkt->tprot != IPPROTO_TCP &&
34 pkt->tprot != IPPROTO_UDP) {
35 regs->verdict.code = NFT_BREAK;
36 return;
37 }
38
39 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
40 if (!hp) {
41 regs->verdict.code = NFT_BREAK;
42 return;
43 }
44
45 /* check if there's an ongoing connection on the packet addresses, this
46 * happens if the redirect already happened and the current packet
47 * belongs to an already established connection
48 */
49 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
50 iph->saddr, iph->daddr,
51 hp->source, hp->dest,
52 skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
53
54 if (priv->sreg_addr)
55 taddr = regs->data[priv->sreg_addr];
56 taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
57
58 if (priv->sreg_port)
59 tport = nft_reg_load16(®s->data[priv->sreg_port]);
60 if (!tport)
61 tport = hp->dest;
62
63 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
64 if (sk && sk->sk_state == TCP_TIME_WAIT) {
65 /* reopening a TIME_WAIT connection needs special handling */
66 sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
67 } else if (!sk) {
68 /* no, there's no established connection, check if
69 * there's a listener on the redirected addr/port
70 */
71 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
72 iph->saddr, taddr,
73 hp->source, tport,
74 skb->dev, NF_TPROXY_LOOKUP_LISTENER);
75 }
76
77 if (sk && nf_tproxy_sk_is_transparent(sk))
78 nf_tproxy_assign_sock(skb, sk);
79 else
80 regs->verdict.code = NFT_BREAK;
81}
82
83#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
84static void nft_tproxy_eval_v6(const struct nft_expr *expr,
85 struct nft_regs *regs,
86 const struct nft_pktinfo *pkt)
87{
88 const struct nft_tproxy *priv = nft_expr_priv(expr);
89 struct sk_buff *skb = pkt->skb;
90 const struct ipv6hdr *iph = ipv6_hdr(skb);
91 int thoff = nft_thoff(pkt);
92 struct udphdr _hdr, *hp;
93 struct in6_addr taddr;
94 __be16 tport = 0;
95 struct sock *sk;
96 int l4proto;
97
98 memset(&taddr, 0, sizeof(taddr));
99
100 if (pkt->tprot != IPPROTO_TCP &&
101 pkt->tprot != IPPROTO_UDP) {
102 regs->verdict.code = NFT_BREAK;
103 return;
104 }
105 l4proto = pkt->tprot;
106
107 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
108 if (hp == NULL) {
109 regs->verdict.code = NFT_BREAK;
110 return;
111 }
112
113 /* check if there's an ongoing connection on the packet addresses, this
114 * happens if the redirect already happened and the current packet
115 * belongs to an already established connection
116 */
117 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
118 &iph->saddr, &iph->daddr,
119 hp->source, hp->dest,
120 nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
121
122 if (priv->sreg_addr)
123 memcpy(&taddr, ®s->data[priv->sreg_addr], sizeof(taddr));
124 taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
125
126 if (priv->sreg_port)
127 tport = nft_reg_load16(®s->data[priv->sreg_port]);
128 if (!tport)
129 tport = hp->dest;
130
131 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
132 if (sk && sk->sk_state == TCP_TIME_WAIT) {
133 /* reopening a TIME_WAIT connection needs special handling */
134 sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
135 nft_net(pkt),
136 &taddr,
137 tport,
138 sk);
139 } else if (!sk) {
140 /* no there's no established connection, check if
141 * there's a listener on the redirected addr/port
142 */
143 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
144 l4proto, &iph->saddr, &taddr,
145 hp->source, tport,
146 nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
147 }
148
149 /* NOTE: assign_sock consumes our sk reference */
150 if (sk && nf_tproxy_sk_is_transparent(sk))
151 nf_tproxy_assign_sock(skb, sk);
152 else
153 regs->verdict.code = NFT_BREAK;
154}
155#endif
156
157static void nft_tproxy_eval(const struct nft_expr *expr,
158 struct nft_regs *regs,
159 const struct nft_pktinfo *pkt)
160{
161 const struct nft_tproxy *priv = nft_expr_priv(expr);
162
163 switch (nft_pf(pkt)) {
164 case NFPROTO_IPV4:
165 switch (priv->family) {
166 case NFPROTO_IPV4:
167 case NFPROTO_UNSPEC:
168 nft_tproxy_eval_v4(expr, regs, pkt);
169 return;
170 }
171 break;
172#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
173 case NFPROTO_IPV6:
174 switch (priv->family) {
175 case NFPROTO_IPV6:
176 case NFPROTO_UNSPEC:
177 nft_tproxy_eval_v6(expr, regs, pkt);
178 return;
179 }
180#endif
181 }
182 regs->verdict.code = NFT_BREAK;
183}
184
185static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
186 [NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },
187 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
188 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
189};
190
191static int nft_tproxy_init(const struct nft_ctx *ctx,
192 const struct nft_expr *expr,
193 const struct nlattr * const tb[])
194{
195 struct nft_tproxy *priv = nft_expr_priv(expr);
196 unsigned int alen = 0;
197 int err;
198
199 if (!tb[NFTA_TPROXY_FAMILY] ||
200 (!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
201 return -EINVAL;
202
203 priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
204
205 switch (ctx->family) {
206 case NFPROTO_IPV4:
207 if (priv->family != NFPROTO_IPV4)
208 return -EINVAL;
209 break;
210#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
211 case NFPROTO_IPV6:
212 if (priv->family != NFPROTO_IPV6)
213 return -EINVAL;
214 break;
215#endif
216 case NFPROTO_INET:
217 break;
218 default:
219 return -EOPNOTSUPP;
220 }
221
222 /* Address is specified but the rule family is not set accordingly */
223 if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
224 return -EINVAL;
225
226 switch (priv->family) {
227 case NFPROTO_IPV4:
228 alen = sizeof_field(union nf_inet_addr, in);
229 err = nf_defrag_ipv4_enable(ctx->net);
230 if (err)
231 return err;
232 break;
233#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
234 case NFPROTO_IPV6:
235 alen = sizeof_field(union nf_inet_addr, in6);
236 err = nf_defrag_ipv6_enable(ctx->net);
237 if (err)
238 return err;
239 break;
240#endif
241 case NFPROTO_UNSPEC:
242 /* No address is specified here */
243 err = nf_defrag_ipv4_enable(ctx->net);
244 if (err)
245 return err;
246#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
247 err = nf_defrag_ipv6_enable(ctx->net);
248 if (err)
249 return err;
250#endif
251 break;
252 default:
253 return -EOPNOTSUPP;
254 }
255
256 if (tb[NFTA_TPROXY_REG_ADDR]) {
257 err = nft_parse_register_load(tb[NFTA_TPROXY_REG_ADDR],
258 &priv->sreg_addr, alen);
259 if (err < 0)
260 return err;
261 }
262
263 if (tb[NFTA_TPROXY_REG_PORT]) {
264 err = nft_parse_register_load(tb[NFTA_TPROXY_REG_PORT],
265 &priv->sreg_port, sizeof(u16));
266 if (err < 0)
267 return err;
268 }
269
270 return 0;
271}
272
273static void nft_tproxy_destroy(const struct nft_ctx *ctx,
274 const struct nft_expr *expr)
275{
276 const struct nft_tproxy *priv = nft_expr_priv(expr);
277
278 switch (priv->family) {
279 case NFPROTO_IPV4:
280 nf_defrag_ipv4_disable(ctx->net);
281 break;
282#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
283 case NFPROTO_IPV6:
284 nf_defrag_ipv6_disable(ctx->net);
285 break;
286#endif
287 case NFPROTO_UNSPEC:
288 nf_defrag_ipv4_disable(ctx->net);
289#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
290 nf_defrag_ipv6_disable(ctx->net);
291#endif
292 break;
293 }
294}
295
296static int nft_tproxy_dump(struct sk_buff *skb,
297 const struct nft_expr *expr)
298{
299 const struct nft_tproxy *priv = nft_expr_priv(expr);
300
301 if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
302 return -1;
303
304 if (priv->sreg_addr &&
305 nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
306 return -1;
307
308 if (priv->sreg_port &&
309 nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
310 return -1;
311
312 return 0;
313}
314
315static struct nft_expr_type nft_tproxy_type;
316static const struct nft_expr_ops nft_tproxy_ops = {
317 .type = &nft_tproxy_type,
318 .size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
319 .eval = nft_tproxy_eval,
320 .init = nft_tproxy_init,
321 .destroy = nft_tproxy_destroy,
322 .dump = nft_tproxy_dump,
323};
324
325static struct nft_expr_type nft_tproxy_type __read_mostly = {
326 .name = "tproxy",
327 .ops = &nft_tproxy_ops,
328 .policy = nft_tproxy_policy,
329 .maxattr = NFTA_TPROXY_MAX,
330 .owner = THIS_MODULE,
331};
332
333static int __init nft_tproxy_module_init(void)
334{
335 return nft_register_expr(&nft_tproxy_type);
336}
337
338static void __exit nft_tproxy_module_exit(void)
339{
340 nft_unregister_expr(&nft_tproxy_type);
341}
342
343module_init(nft_tproxy_module_init);
344module_exit(nft_tproxy_module_exit);
345
346MODULE_LICENSE("GPL");
347MODULE_AUTHOR("Máté Eckl");
348MODULE_DESCRIPTION("nf_tables tproxy support module");
349MODULE_ALIAS_NFT_EXPR("tproxy");
1/* SPDX-License-Identifier: GPL-2.0 */
2#include <linux/module.h>
3#include <linux/netfilter/nf_tables.h>
4#include <net/netfilter/nf_tables.h>
5#include <net/netfilter/nf_tables_core.h>
6#include <net/netfilter/nf_tproxy.h>
7#include <net/inet_sock.h>
8#include <net/tcp.h>
9#include <linux/if_ether.h>
10#include <net/netfilter/ipv4/nf_defrag_ipv4.h>
11#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
12#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
13#endif
14
15struct nft_tproxy {
16 enum nft_registers sreg_addr:8;
17 enum nft_registers sreg_port:8;
18 u8 family;
19};
20
21static void nft_tproxy_eval_v4(const struct nft_expr *expr,
22 struct nft_regs *regs,
23 const struct nft_pktinfo *pkt)
24{
25 const struct nft_tproxy *priv = nft_expr_priv(expr);
26 struct sk_buff *skb = pkt->skb;
27 const struct iphdr *iph = ip_hdr(skb);
28 struct udphdr _hdr, *hp;
29 __be32 taddr = 0;
30 __be16 tport = 0;
31 struct sock *sk;
32
33 hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr);
34 if (!hp) {
35 regs->verdict.code = NFT_BREAK;
36 return;
37 }
38
39 /* check if there's an ongoing connection on the packet addresses, this
40 * happens if the redirect already happened and the current packet
41 * belongs to an already established connection
42 */
43 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
44 iph->saddr, iph->daddr,
45 hp->source, hp->dest,
46 skb->dev, NF_TPROXY_LOOKUP_ESTABLISHED);
47
48 if (priv->sreg_addr)
49 taddr = regs->data[priv->sreg_addr];
50 taddr = nf_tproxy_laddr4(skb, taddr, iph->daddr);
51
52 if (priv->sreg_port)
53 tport = nft_reg_load16(®s->data[priv->sreg_port]);
54 if (!tport)
55 tport = hp->dest;
56
57 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
58 if (sk && sk->sk_state == TCP_TIME_WAIT) {
59 /* reopening a TIME_WAIT connection needs special handling */
60 sk = nf_tproxy_handle_time_wait4(nft_net(pkt), skb, taddr, tport, sk);
61 } else if (!sk) {
62 /* no, there's no established connection, check if
63 * there's a listener on the redirected addr/port
64 */
65 sk = nf_tproxy_get_sock_v4(nft_net(pkt), skb, iph->protocol,
66 iph->saddr, taddr,
67 hp->source, tport,
68 skb->dev, NF_TPROXY_LOOKUP_LISTENER);
69 }
70
71 if (sk && nf_tproxy_sk_is_transparent(sk))
72 nf_tproxy_assign_sock(skb, sk);
73 else
74 regs->verdict.code = NFT_BREAK;
75}
76
77#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
78static void nft_tproxy_eval_v6(const struct nft_expr *expr,
79 struct nft_regs *regs,
80 const struct nft_pktinfo *pkt)
81{
82 const struct nft_tproxy *priv = nft_expr_priv(expr);
83 struct sk_buff *skb = pkt->skb;
84 const struct ipv6hdr *iph = ipv6_hdr(skb);
85 struct in6_addr taddr;
86 int thoff = pkt->xt.thoff;
87 struct udphdr _hdr, *hp;
88 __be16 tport = 0;
89 struct sock *sk;
90 int l4proto;
91
92 memset(&taddr, 0, sizeof(taddr));
93
94 if (!pkt->tprot_set) {
95 regs->verdict.code = NFT_BREAK;
96 return;
97 }
98 l4proto = pkt->tprot;
99
100 hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr);
101 if (hp == NULL) {
102 regs->verdict.code = NFT_BREAK;
103 return;
104 }
105
106 /* check if there's an ongoing connection on the packet addresses, this
107 * happens if the redirect already happened and the current packet
108 * belongs to an already established connection
109 */
110 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff, l4proto,
111 &iph->saddr, &iph->daddr,
112 hp->source, hp->dest,
113 nft_in(pkt), NF_TPROXY_LOOKUP_ESTABLISHED);
114
115 if (priv->sreg_addr)
116 memcpy(&taddr, ®s->data[priv->sreg_addr], sizeof(taddr));
117 taddr = *nf_tproxy_laddr6(skb, &taddr, &iph->daddr);
118
119 if (priv->sreg_port)
120 tport = nft_reg_load16(®s->data[priv->sreg_port]);
121 if (!tport)
122 tport = hp->dest;
123
124 /* UDP has no TCP_TIME_WAIT state, so we never enter here */
125 if (sk && sk->sk_state == TCP_TIME_WAIT) {
126 /* reopening a TIME_WAIT connection needs special handling */
127 sk = nf_tproxy_handle_time_wait6(skb, l4proto, thoff,
128 nft_net(pkt),
129 &taddr,
130 tport,
131 sk);
132 } else if (!sk) {
133 /* no there's no established connection, check if
134 * there's a listener on the redirected addr/port
135 */
136 sk = nf_tproxy_get_sock_v6(nft_net(pkt), skb, thoff,
137 l4proto, &iph->saddr, &taddr,
138 hp->source, tport,
139 nft_in(pkt), NF_TPROXY_LOOKUP_LISTENER);
140 }
141
142 /* NOTE: assign_sock consumes our sk reference */
143 if (sk && nf_tproxy_sk_is_transparent(sk))
144 nf_tproxy_assign_sock(skb, sk);
145 else
146 regs->verdict.code = NFT_BREAK;
147}
148#endif
149
150static void nft_tproxy_eval(const struct nft_expr *expr,
151 struct nft_regs *regs,
152 const struct nft_pktinfo *pkt)
153{
154 const struct nft_tproxy *priv = nft_expr_priv(expr);
155
156 switch (nft_pf(pkt)) {
157 case NFPROTO_IPV4:
158 switch (priv->family) {
159 case NFPROTO_IPV4:
160 case NFPROTO_UNSPEC:
161 nft_tproxy_eval_v4(expr, regs, pkt);
162 return;
163 }
164 break;
165#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
166 case NFPROTO_IPV6:
167 switch (priv->family) {
168 case NFPROTO_IPV6:
169 case NFPROTO_UNSPEC:
170 nft_tproxy_eval_v6(expr, regs, pkt);
171 return;
172 }
173#endif
174 }
175 regs->verdict.code = NFT_BREAK;
176}
177
178static const struct nla_policy nft_tproxy_policy[NFTA_TPROXY_MAX + 1] = {
179 [NFTA_TPROXY_FAMILY] = { .type = NLA_U32 },
180 [NFTA_TPROXY_REG_ADDR] = { .type = NLA_U32 },
181 [NFTA_TPROXY_REG_PORT] = { .type = NLA_U32 },
182};
183
184static int nft_tproxy_init(const struct nft_ctx *ctx,
185 const struct nft_expr *expr,
186 const struct nlattr * const tb[])
187{
188 struct nft_tproxy *priv = nft_expr_priv(expr);
189 unsigned int alen = 0;
190 int err;
191
192 if (!tb[NFTA_TPROXY_FAMILY] ||
193 (!tb[NFTA_TPROXY_REG_ADDR] && !tb[NFTA_TPROXY_REG_PORT]))
194 return -EINVAL;
195
196 priv->family = ntohl(nla_get_be32(tb[NFTA_TPROXY_FAMILY]));
197
198 switch (ctx->family) {
199 case NFPROTO_IPV4:
200 if (priv->family != NFPROTO_IPV4)
201 return -EINVAL;
202 break;
203#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
204 case NFPROTO_IPV6:
205 if (priv->family != NFPROTO_IPV6)
206 return -EINVAL;
207 break;
208#endif
209 case NFPROTO_INET:
210 break;
211 default:
212 return -EOPNOTSUPP;
213 }
214
215 /* Address is specified but the rule family is not set accordingly */
216 if (priv->family == NFPROTO_UNSPEC && tb[NFTA_TPROXY_REG_ADDR])
217 return -EINVAL;
218
219 switch (priv->family) {
220 case NFPROTO_IPV4:
221 alen = sizeof_field(union nf_inet_addr, in);
222 err = nf_defrag_ipv4_enable(ctx->net);
223 if (err)
224 return err;
225 break;
226#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
227 case NFPROTO_IPV6:
228 alen = sizeof_field(union nf_inet_addr, in6);
229 err = nf_defrag_ipv6_enable(ctx->net);
230 if (err)
231 return err;
232 break;
233#endif
234 case NFPROTO_UNSPEC:
235 /* No address is specified here */
236 err = nf_defrag_ipv4_enable(ctx->net);
237 if (err)
238 return err;
239#if IS_ENABLED(CONFIG_NF_TABLES_IPV6)
240 err = nf_defrag_ipv6_enable(ctx->net);
241 if (err)
242 return err;
243#endif
244 break;
245 default:
246 return -EOPNOTSUPP;
247 }
248
249 if (tb[NFTA_TPROXY_REG_ADDR]) {
250 priv->sreg_addr = nft_parse_register(tb[NFTA_TPROXY_REG_ADDR]);
251 err = nft_validate_register_load(priv->sreg_addr, alen);
252 if (err < 0)
253 return err;
254 }
255
256 if (tb[NFTA_TPROXY_REG_PORT]) {
257 priv->sreg_port = nft_parse_register(tb[NFTA_TPROXY_REG_PORT]);
258 err = nft_validate_register_load(priv->sreg_port, sizeof(u16));
259 if (err < 0)
260 return err;
261 }
262
263 return 0;
264}
265
266static int nft_tproxy_dump(struct sk_buff *skb,
267 const struct nft_expr *expr)
268{
269 const struct nft_tproxy *priv = nft_expr_priv(expr);
270
271 if (nla_put_be32(skb, NFTA_TPROXY_FAMILY, htonl(priv->family)))
272 return -1;
273
274 if (priv->sreg_addr &&
275 nft_dump_register(skb, NFTA_TPROXY_REG_ADDR, priv->sreg_addr))
276 return -1;
277
278 if (priv->sreg_port &&
279 nft_dump_register(skb, NFTA_TPROXY_REG_PORT, priv->sreg_port))
280 return -1;
281
282 return 0;
283}
284
285static struct nft_expr_type nft_tproxy_type;
286static const struct nft_expr_ops nft_tproxy_ops = {
287 .type = &nft_tproxy_type,
288 .size = NFT_EXPR_SIZE(sizeof(struct nft_tproxy)),
289 .eval = nft_tproxy_eval,
290 .init = nft_tproxy_init,
291 .dump = nft_tproxy_dump,
292};
293
294static struct nft_expr_type nft_tproxy_type __read_mostly = {
295 .name = "tproxy",
296 .ops = &nft_tproxy_ops,
297 .policy = nft_tproxy_policy,
298 .maxattr = NFTA_TPROXY_MAX,
299 .owner = THIS_MODULE,
300};
301
302static int __init nft_tproxy_module_init(void)
303{
304 return nft_register_expr(&nft_tproxy_type);
305}
306
307static void __exit nft_tproxy_module_exit(void)
308{
309 nft_unregister_expr(&nft_tproxy_type);
310}
311
312module_init(nft_tproxy_module_init);
313module_exit(nft_tproxy_module_exit);
314
315MODULE_LICENSE("GPL");
316MODULE_AUTHOR("Máté Eckl");
317MODULE_DESCRIPTION("nf_tables tproxy support module");
318MODULE_ALIAS_NFT_EXPR("tproxy");