libnl  3.2.24-rc1
exp.c
1 /*
2  * lib/netfilter/exp.c Conntrack Expectation
3  *
4  * This library is free software; you can redistribute it and/or
5  * modify it under the terms of the GNU Lesser General Public
6  * License as published by the Free Software Foundation version 2.1
7  * of the License.
8  *
9  * Copyright (c) 2003-2008 Thomas Graf <tgraf@suug.ch>
10  * Copyright (c) 2007 Philip Craig <philipc@snapgear.com>
11  * Copyright (c) 2007 Secure Computing Corporation
12  * Copyright (c= 2008 Patrick McHardy <kaber@trash.net>
13  * Copyright (c) 2012 Rich Fought <rich.fought@watchguard.com>
14  */
15 
16 /**
17  * @ingroup nfnl
18  * @defgroup exp Expectation
19  * @brief
20  * @{
21  */
22 
23 #include <byteswap.h>
24 #include <sys/types.h>
25 #include <linux/netfilter/nfnetlink_conntrack.h>
26 
27 #include <netlink-private/netlink.h>
28 #include <netlink/attr.h>
29 #include <netlink/netfilter/nfnl.h>
30 #include <netlink/netfilter/exp.h>
31 
32 static struct nl_cache_ops nfnl_exp_ops;
33 
34 static struct nla_policy exp_policy[CTA_EXPECT_MAX+1] = {
35  [CTA_EXPECT_MASTER] = { .type = NLA_NESTED },
36  [CTA_EXPECT_TUPLE] = { .type = NLA_NESTED },
37  [CTA_EXPECT_MASK] = { .type = NLA_NESTED },
38  [CTA_EXPECT_TIMEOUT] = { .type = NLA_U32 },
39  [CTA_EXPECT_ID] = { .type = NLA_U32 },
40  [CTA_EXPECT_HELP_NAME] = { .type = NLA_STRING },
41  [CTA_EXPECT_ZONE] = { .type = NLA_U16 },
42  [CTA_EXPECT_FLAGS] = { .type = NLA_U32 }, // Added in kernel 2.6.37
43  [CTA_EXPECT_CLASS] = { .type = NLA_U32 }, // Added in kernel 3.5
44  [CTA_EXPECT_NAT] = { .type = NLA_NESTED }, // Added in kernel 3.5
45  [CTA_EXPECT_FN] = { .type = NLA_STRING }, // Added in kernel 3.5
46 };
47 
48 static struct nla_policy exp_tuple_policy[CTA_TUPLE_MAX+1] = {
49  [CTA_TUPLE_IP] = { .type = NLA_NESTED },
50  [CTA_TUPLE_PROTO] = { .type = NLA_NESTED },
51 };
52 
53 static struct nla_policy exp_ip_policy[CTA_IP_MAX+1] = {
54  [CTA_IP_V4_SRC] = { .type = NLA_U32 },
55  [CTA_IP_V4_DST] = { .type = NLA_U32 },
56  [CTA_IP_V6_SRC] = { .minlen = 16 },
57  [CTA_IP_V6_DST] = { .minlen = 16 },
58 };
59 
60 static struct nla_policy exp_proto_policy[CTA_PROTO_MAX+1] = {
61  [CTA_PROTO_NUM] = { .type = NLA_U8 },
62  [CTA_PROTO_SRC_PORT] = { .type = NLA_U16 },
63  [CTA_PROTO_DST_PORT] = { .type = NLA_U16 },
64  [CTA_PROTO_ICMP_ID] = { .type = NLA_U16 },
65  [CTA_PROTO_ICMP_TYPE] = { .type = NLA_U8 },
66  [CTA_PROTO_ICMP_CODE] = { .type = NLA_U8 },
67  [CTA_PROTO_ICMPV6_ID] = { .type = NLA_U16 },
68  [CTA_PROTO_ICMPV6_TYPE] = { .type = NLA_U8 },
69  [CTA_PROTO_ICMPV6_CODE] = { .type = NLA_U8 },
70 };
71 
72 static struct nla_policy exp_nat_policy[CTA_EXPECT_NAT_MAX+1] = {
73  [CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 },
74  [CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },
75 };
76 
77 static int exp_parse_ip(struct nfnl_exp *exp, int tuple, struct nlattr *attr)
78 {
79  struct nlattr *tb[CTA_IP_MAX+1];
80  struct nl_addr *addr;
81  int err;
82 
83  err = nla_parse_nested(tb, CTA_IP_MAX, attr, exp_ip_policy);
84  if (err < 0)
85  goto errout;
86 
87  if (tb[CTA_IP_V4_SRC]) {
88  addr = nl_addr_alloc_attr(tb[CTA_IP_V4_SRC], AF_INET);
89  if (addr == NULL)
90  goto errout_enomem;
91  err = nfnl_exp_set_src(exp, tuple, addr);
92  nl_addr_put(addr);
93  if (err < 0)
94  goto errout;
95  }
96  if (tb[CTA_IP_V4_DST]) {
97  addr = nl_addr_alloc_attr(tb[CTA_IP_V4_DST], AF_INET);
98  if (addr == NULL)
99  goto errout_enomem;
100  err = nfnl_exp_set_dst(exp, tuple, addr);
101  nl_addr_put(addr);
102  if (err < 0)
103  goto errout;
104  }
105  if (tb[CTA_IP_V6_SRC]) {
106  addr = nl_addr_alloc_attr(tb[CTA_IP_V6_SRC], AF_INET6);
107  if (addr == NULL)
108  goto errout_enomem;
109  err = nfnl_exp_set_src(exp, tuple, addr);
110  nl_addr_put(addr);
111  if (err < 0)
112  goto errout;
113  }
114  if (tb[CTA_IP_V6_DST]) {
115  addr = nl_addr_alloc_attr(tb[CTA_IP_V6_DST], AF_INET6);
116  if (addr == NULL)
117  goto errout_enomem;
118  err = nfnl_exp_set_dst(exp, tuple, addr);
119  nl_addr_put(addr);
120  if (err < 0)
121  goto errout;
122  }
123 
124  return 0;
125 
126 errout_enomem:
127  err = -NLE_NOMEM;
128 errout:
129  return err;
130 }
131 
132 static int exp_parse_proto(struct nfnl_exp *exp, int tuple, struct nlattr *attr)
133 {
134  struct nlattr *tb[CTA_PROTO_MAX+1];
135  int err;
136  uint16_t srcport = 0, dstport = 0, icmpid = 0;
137  uint8_t icmptype = 0, icmpcode = 0;
138 
139  err = nla_parse_nested(tb, CTA_PROTO_MAX, attr, exp_proto_policy);
140  if (err < 0)
141  return err;
142 
143  if (tb[CTA_PROTO_NUM])
144  nfnl_exp_set_l4protonum(exp, tuple, nla_get_u8(tb[CTA_PROTO_NUM]));
145 
146  if (tb[CTA_PROTO_SRC_PORT])
147  srcport = ntohs(nla_get_u16(tb[CTA_PROTO_SRC_PORT]));
148  if (tb[CTA_PROTO_DST_PORT])
149  dstport = ntohs(nla_get_u16(tb[CTA_PROTO_DST_PORT]));
150  if (tb[CTA_PROTO_SRC_PORT] || tb[CTA_PROTO_DST_PORT])
151  nfnl_exp_set_ports(exp, tuple, srcport, dstport);
152 
153  if (tb[CTA_PROTO_ICMP_ID])
154  icmpid = ntohs(nla_get_u16(tb[CTA_PROTO_ICMP_ID]));
155  if (tb[CTA_PROTO_ICMP_TYPE])
156  icmptype = nla_get_u8(tb[CTA_PROTO_ICMP_TYPE]);
157  if (tb[CTA_PROTO_ICMP_CODE])
158  icmpcode = nla_get_u8(tb[CTA_PROTO_ICMP_CODE]);
159  if (tb[CTA_PROTO_ICMP_ID] || tb[CTA_PROTO_ICMP_TYPE] || tb[CTA_PROTO_ICMP_CODE])
160  nfnl_exp_set_icmp(exp, tuple, icmpid, icmptype, icmpcode);
161  return 0;
162 }
163 
164 static int exp_parse_tuple(struct nfnl_exp *exp, int tuple, struct nlattr *attr)
165 {
166  struct nlattr *tb[CTA_TUPLE_MAX+1];
167  int err;
168 
169  err = nla_parse_nested(tb, CTA_TUPLE_MAX, attr, exp_tuple_policy);
170  if (err < 0)
171  return err;
172 
173  if (tb[CTA_TUPLE_IP]) {
174  err = exp_parse_ip(exp, tuple, tb[CTA_TUPLE_IP]);
175  if (err < 0)
176  return err;
177  }
178 
179  if (tb[CTA_TUPLE_PROTO]) {
180  err = exp_parse_proto(exp, tuple, tb[CTA_TUPLE_PROTO]);
181  if (err < 0)
182  return err;
183  }
184 
185  return 0;
186 }
187 
188 static int exp_parse_nat(struct nfnl_exp *exp, struct nlattr *attr)
189 {
190  struct nlattr *tb[CTA_EXPECT_NAT_MAX+1];
191  int err;
192 
193  err = nla_parse_nested(tb, CTA_EXPECT_NAT_MAX, attr, exp_nat_policy);
194  if (err < 0)
195  return err;
196 
197  if (tb[CTA_EXPECT_NAT_DIR])
198  nfnl_exp_set_nat_dir(exp, nla_get_u32(tb[CTA_EXPECT_NAT_DIR]));
199 
200  if (tb[CTA_EXPECT_NAT_TUPLE]) {
201  err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_NAT, tb[CTA_EXPECT_NAT_TUPLE]);
202  if (err < 0)
203  return err;
204  }
205 
206  return 0;
207 }
208 
209 int nfnlmsg_exp_group(struct nlmsghdr *nlh)
210 {
211  switch (nfnlmsg_subtype(nlh)) {
212  case IPCTNL_MSG_EXP_NEW:
213  if (nlh->nlmsg_flags & (NLM_F_CREATE|NLM_F_EXCL))
214  return NFNLGRP_CONNTRACK_EXP_NEW;
215  else
216  return NFNLGRP_CONNTRACK_EXP_UPDATE;
217  case IPCTNL_MSG_EXP_DELETE:
218  return NFNLGRP_CONNTRACK_EXP_DESTROY;
219  default:
220  return NFNLGRP_NONE;
221  }
222 }
223 
224 int nfnlmsg_exp_parse(struct nlmsghdr *nlh, struct nfnl_exp **result)
225 {
226  struct nfnl_exp *exp;
227  struct nlattr *tb[CTA_MAX+1];
228  int err;
229 
230  exp = nfnl_exp_alloc();
231  if (!exp)
232  return -NLE_NOMEM;
233 
234  exp->ce_msgtype = nlh->nlmsg_type;
235 
236  err = nlmsg_parse(nlh, sizeof(struct nfgenmsg), tb, CTA_EXPECT_MAX,
237  exp_policy);
238  if (err < 0)
239  goto errout;
240 
241  nfnl_exp_set_family(exp, nfnlmsg_family(nlh));
242 
243  if (tb[CTA_EXPECT_TUPLE]) {
244  err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_EXPECT, tb[CTA_EXPECT_TUPLE]);
245  if (err < 0)
246  goto errout;
247  }
248  if (tb[CTA_EXPECT_MASTER]) {
249  err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_MASTER, tb[CTA_EXPECT_MASTER]);
250  if (err < 0)
251  goto errout;
252  }
253  if (tb[CTA_EXPECT_MASK]) {
254  err = exp_parse_tuple(exp, NFNL_EXP_TUPLE_MASK, tb[CTA_EXPECT_MASK]);
255  if (err < 0)
256  goto errout;
257  }
258 
259  if (tb[CTA_EXPECT_NAT]) {
260  err = exp_parse_nat(exp, tb[CTA_EXPECT_MASK]);
261  if (err < 0)
262  goto errout;
263  }
264 
265  if (tb[CTA_EXPECT_CLASS])
266  nfnl_exp_set_class(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_CLASS])));
267 
268  if (tb[CTA_EXPECT_FN])
269  nfnl_exp_set_fn(exp, nla_data(tb[CTA_EXPECT_FN]));
270 
271  if (tb[CTA_EXPECT_TIMEOUT])
272  nfnl_exp_set_timeout(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_TIMEOUT])));
273 
274  if (tb[CTA_EXPECT_ID])
275  nfnl_exp_set_id(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_ID])));
276 
277  if (tb[CTA_EXPECT_HELP_NAME])
278  nfnl_exp_set_helper_name(exp, nla_data(tb[CTA_EXPECT_HELP_NAME]));
279 
280  if (tb[CTA_EXPECT_ZONE])
281  nfnl_exp_set_zone(exp, ntohs(nla_get_u16(tb[CTA_EXPECT_ZONE])));
282 
283  if (tb[CTA_EXPECT_FLAGS])
284  nfnl_exp_set_flags(exp, ntohl(nla_get_u32(tb[CTA_EXPECT_FLAGS])));
285 
286  *result = exp;
287  return 0;
288 
289 errout:
290  nfnl_exp_put(exp);
291  return err;
292 }
293 
294 static int exp_msg_parser(struct nl_cache_ops *ops, struct sockaddr_nl *who,
295  struct nlmsghdr *nlh, struct nl_parser_param *pp)
296 {
297  struct nfnl_exp *exp;
298  int err;
299 
300  if ((err = nfnlmsg_exp_parse(nlh, &exp)) < 0)
301  goto errout;
302 
303  err = pp->pp_cb((struct nl_object *) exp, pp);
304 errout:
305  nfnl_exp_put(exp);
306  return err;
307 }
308 
309 int nfnl_exp_dump_request(struct nl_sock *sk)
310 {
311  return nfnl_send_simple(sk, NFNL_SUBSYS_CTNETLINK_EXP, IPCTNL_MSG_EXP_GET,
312  NLM_F_DUMP, AF_UNSPEC, 0);
313 }
314 
315 static int exp_request_update(struct nl_cache *cache, struct nl_sock *sk)
316 {
317  return nfnl_exp_dump_request(sk);
318 }
319 
320 static int exp_get_tuple_attr(int tuple)
321 {
322  int attr = 0;
323 
324  switch (tuple) {
325  case CTA_EXPECT_MASTER:
326  attr = NFNL_EXP_TUPLE_MASTER;
327  break;
328  case CTA_EXPECT_MASK:
329  attr = NFNL_EXP_TUPLE_MASK;
330  break;
331  case CTA_EXPECT_NAT:
332  attr = NFNL_EXP_TUPLE_NAT;
333  break;
334  case CTA_EXPECT_TUPLE:
335  default :
336  attr = NFNL_EXP_TUPLE_EXPECT;
337  break;
338  }
339 
340  return attr;
341 }
342 
343 static int nfnl_exp_build_tuple(struct nl_msg *msg, const struct nfnl_exp *exp,
344  int cta)
345 {
346  struct nlattr *tuple, *ip, *proto;
347  struct nl_addr *addr;
348  int family;
349 
350  family = nfnl_exp_get_family(exp);
351 
352  int type = exp_get_tuple_attr(cta);
353 
354  if (cta == CTA_EXPECT_NAT)
355  tuple = nla_nest_start(msg, CTA_EXPECT_NAT_TUPLE);
356  else
357  tuple = nla_nest_start(msg, cta);
358 
359  if (!tuple)
360  goto nla_put_failure;
361 
362  ip = nla_nest_start(msg, CTA_TUPLE_IP);
363  if (!ip)
364  goto nla_put_failure;
365 
366  addr = nfnl_exp_get_src(exp, type);
367  if (addr)
368  NLA_PUT_ADDR(msg,
369  family == AF_INET ? CTA_IP_V4_SRC : CTA_IP_V6_SRC,
370  addr);
371 
372  addr = nfnl_exp_get_dst(exp, type);
373  if (addr)
374  NLA_PUT_ADDR(msg,
375  family == AF_INET ? CTA_IP_V4_DST : CTA_IP_V6_DST,
376  addr);
377 
378  nla_nest_end(msg, ip);
379 
380  proto = nla_nest_start(msg, CTA_TUPLE_PROTO);
381  if (!proto)
382  goto nla_put_failure;
383 
384  if (nfnl_exp_test_l4protonum(exp, type))
385  NLA_PUT_U8(msg, CTA_PROTO_NUM, nfnl_exp_get_l4protonum(exp, type));
386 
387  if (nfnl_exp_test_ports(exp, type)) {
388  NLA_PUT_U16(msg, CTA_PROTO_SRC_PORT,
389  htons(nfnl_exp_get_src_port(exp, type)));
390 
391  NLA_PUT_U16(msg, CTA_PROTO_DST_PORT,
392  htons(nfnl_exp_get_dst_port(exp, type)));
393  }
394 
395  if (nfnl_exp_test_icmp(exp, type)) {
396  NLA_PUT_U16(msg, CTA_PROTO_ICMP_ID,
397  htons(nfnl_exp_get_icmp_id(exp, type)));
398 
399  NLA_PUT_U8(msg, CTA_PROTO_ICMP_TYPE,
400  nfnl_exp_get_icmp_type(exp, type));
401 
402  NLA_PUT_U8(msg, CTA_PROTO_ICMP_CODE,
403  nfnl_exp_get_icmp_code(exp, type));
404  }
405 
406  nla_nest_end(msg, proto);
407 
408  nla_nest_end(msg, tuple);
409  return 0;
410 
411 nla_put_failure:
412  return -NLE_MSGSIZE;
413 }
414 
415 static int nfnl_exp_build_nat(struct nl_msg *msg, const struct nfnl_exp *exp)
416 {
417  struct nlattr *nat;
418  int err;
419 
420  nat = nla_nest_start(msg, CTA_EXPECT_NAT);
421 
422  if (nfnl_exp_test_nat_dir(exp)) {
423  NLA_PUT_U32(msg, CTA_EXPECT_NAT_DIR,
424  nfnl_exp_get_nat_dir(exp));
425  }
426 
427  if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_NAT)) < 0)
428  goto nla_put_failure;
429 
430  nla_nest_end(msg, nat);
431  return 0;
432 
433 nla_put_failure:
434  return -NLE_MSGSIZE;
435 }
436 
437 static int nfnl_exp_build_message(const struct nfnl_exp *exp, int cmd, int flags,
438  struct nl_msg **result)
439 {
440  struct nl_msg *msg;
441  int err;
442 
443  msg = nfnlmsg_alloc_simple(NFNL_SUBSYS_CTNETLINK_EXP, cmd, flags,
444  nfnl_exp_get_family(exp), 0);
445  if (msg == NULL)
446  return -NLE_NOMEM;
447 
448  if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_TUPLE)) < 0)
449  goto err_out;
450 
451  if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_MASTER)) < 0)
452  goto err_out;
453 
454  if ((err = nfnl_exp_build_tuple(msg, exp, CTA_EXPECT_MASK)) < 0)
455  goto err_out;
456 
457  if (nfnl_exp_test_src(exp, NFNL_EXP_TUPLE_NAT)) {
458  if ((err = nfnl_exp_build_nat(msg, exp)) < 0)
459  goto err_out;
460  }
461 
462  if (nfnl_exp_test_class(exp))
463  NLA_PUT_U32(msg, CTA_EXPECT_CLASS, htonl(nfnl_exp_get_class(exp)));
464 
465  if (nfnl_exp_test_fn(exp))
466  NLA_PUT_STRING(msg, CTA_EXPECT_FN, nfnl_exp_get_fn(exp));
467 
468  if (nfnl_exp_test_id(exp))
469  NLA_PUT_U32(msg, CTA_EXPECT_ID, htonl(nfnl_exp_get_id(exp)));
470 
471  if (nfnl_exp_test_timeout(exp))
472  NLA_PUT_U32(msg, CTA_EXPECT_TIMEOUT, htonl(nfnl_exp_get_timeout(exp)));
473 
474  if (nfnl_exp_test_helper_name(exp))
475  NLA_PUT_STRING(msg, CTA_EXPECT_HELP_NAME, nfnl_exp_get_helper_name(exp));
476 
477  if (nfnl_exp_test_zone(exp))
478  NLA_PUT_U16(msg, CTA_EXPECT_ZONE, htons(nfnl_exp_get_zone(exp)));
479 
480  if (nfnl_exp_test_flags(exp))
481  NLA_PUT_U32(msg, CTA_EXPECT_FLAGS, htonl(nfnl_exp_get_flags(exp)));
482 
483  *result = msg;
484  return 0;
485 
486 nla_put_failure:
487 err_out:
488  nlmsg_free(msg);
489  return err;
490 }
491 
492 int nfnl_exp_build_add_request(const struct nfnl_exp *exp, int flags,
493  struct nl_msg **result)
494 {
495  return nfnl_exp_build_message(exp, IPCTNL_MSG_EXP_NEW, flags, result);
496 }
497 
498 int nfnl_exp_add(struct nl_sock *sk, const struct nfnl_exp *exp, int flags)
499 {
500  struct nl_msg *msg;
501  int err;
502 
503  if ((err = nfnl_exp_build_add_request(exp, flags, &msg)) < 0)
504  return err;
505 
506  err = nl_send_auto_complete(sk, msg);
507  nlmsg_free(msg);
508  if (err < 0)
509  return err;
510 
511  return wait_for_ack(sk);
512 }
513 
514 int nfnl_exp_build_delete_request(const struct nfnl_exp *exp, int flags,
515  struct nl_msg **result)
516 {
517  return nfnl_exp_build_message(exp, IPCTNL_MSG_EXP_DELETE, flags, result);
518 }
519 
520 int nfnl_exp_del(struct nl_sock *sk, const struct nfnl_exp *exp, int flags)
521 {
522  struct nl_msg *msg;
523  int err;
524 
525  if ((err = nfnl_exp_build_delete_request(exp, flags, &msg)) < 0)
526  return err;
527 
528  err = nl_send_auto_complete(sk, msg);
529  nlmsg_free(msg);
530  if (err < 0)
531  return err;
532 
533  return wait_for_ack(sk);
534 }
535 
536 int nfnl_exp_build_query_request(const struct nfnl_exp *exp, int flags,
537  struct nl_msg **result)
538 {
539  return nfnl_exp_build_message(exp, IPCTNL_MSG_EXP_GET, flags, result);
540 }
541 
542 int nfnl_exp_query(struct nl_sock *sk, const struct nfnl_exp *exp, int flags)
543 {
544  struct nl_msg *msg;
545  int err;
546 
547  if ((err = nfnl_exp_build_query_request(exp, flags, &msg)) < 0)
548  return err;
549 
550  err = nl_send_auto_complete(sk, msg);
551  nlmsg_free(msg);
552  if (err < 0)
553  return err;
554 
555  return wait_for_ack(sk);
556 }
557 
558 /**
559  * @name Cache Management
560  * @{
561  */
562 
563 /**
564  * Build a expectation cache holding all expectations currently in the kernel
565  * @arg sk Netlink socket.
566  * @arg result Pointer to store resulting cache.
567  *
568  * Allocates a new cache, initializes it properly and updates it to
569  * contain all expectations currently in the kernel.
570  *
571  * @return 0 on success or a negative error code.
572  */
573 int nfnl_exp_alloc_cache(struct nl_sock *sk, struct nl_cache **result)
574 {
575  return nl_cache_alloc_and_fill(&nfnl_exp_ops, sk, result);
576 }
577 
578 /** @} */
579 
580 /**
581  * @name Expectation Addition
582  * @{
583  */
584 
585 /** @} */
586 
587 static struct nl_af_group exp_groups[] = {
588  { AF_UNSPEC, NFNLGRP_CONNTRACK_EXP_NEW },
589  { AF_UNSPEC, NFNLGRP_CONNTRACK_EXP_UPDATE },
590  { AF_UNSPEC, NFNLGRP_CONNTRACK_EXP_DESTROY },
591  { END_OF_GROUP_LIST },
592 };
593 
594 #define NFNLMSG_EXP_TYPE(type) NFNLMSG_TYPE(NFNL_SUBSYS_CTNETLINK_EXP, (type))
595 static struct nl_cache_ops nfnl_exp_ops = {
596  .co_name = "netfilter/exp",
597  .co_hdrsize = NFNL_HDRLEN,
598  .co_msgtypes = {
599  { NFNLMSG_EXP_TYPE(IPCTNL_MSG_EXP_NEW), NL_ACT_NEW, "new" },
600  { NFNLMSG_EXP_TYPE(IPCTNL_MSG_EXP_GET), NL_ACT_GET, "get" },
601  { NFNLMSG_EXP_TYPE(IPCTNL_MSG_EXP_DELETE), NL_ACT_DEL, "del" },
602  END_OF_MSGTYPES_LIST,
603  },
604  .co_protocol = NETLINK_NETFILTER,
605  .co_groups = exp_groups,
606  .co_request_update = exp_request_update,
607  .co_msg_parser = exp_msg_parser,
608  .co_obj_ops = &exp_obj_ops,
609 };
610 
611 static void __init exp_init(void)
612 {
613  nl_cache_mngt_register(&nfnl_exp_ops);
614 }
615 
616 static void __exit exp_exit(void)
617 {
618  nl_cache_mngt_unregister(&nfnl_exp_ops);
619 }
620 
621 /** @} */