2 * x_tables core - Backend for {ip,ip6,arp}_tables
4 * Copyright (C) 2006-2006 Harald Welte <laforge@netfilter.org>
6 * Based on existing ip_tables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 * Copyright (C) 2000-2005 Netfilter Core Team <coreteam@netfilter.org>
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License version 2 as
12 * published by the Free Software Foundation.
16 #include <linux/kernel.h>
17 #include <linux/socket.h>
18 #include <linux/net.h>
19 #include <linux/proc_fs.h>
20 #include <linux/seq_file.h>
21 #include <linux/string.h>
22 #include <linux/vmalloc.h>
23 #include <linux/mutex.h>
25 #include <net/net_namespace.h>
27 #include <linux/netfilter/x_tables.h>
28 #include <linux/netfilter_arp.h>
31 MODULE_LICENSE("GPL");
32 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
33 MODULE_DESCRIPTION("[ip,ip6,arp]_tables backend module");
35 #define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
39 struct list_head match
;
40 struct list_head target
;
41 struct list_head tables
;
42 struct mutex compat_mutex
;
45 static struct xt_af
*xt
;
47 #ifdef DEBUG_IP_FIREWALL_USER
48 #define duprintf(format, args...) printk(format , ## args)
50 #define duprintf(format, args...)
59 static const char *xt_prefix
[NPROTO
] = {
65 /* Registration hooks for targets. */
67 xt_register_target(struct xt_target
*target
)
69 int ret
, af
= target
->family
;
71 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
74 list_add(&target
->list
, &xt
[af
].target
);
75 mutex_unlock(&xt
[af
].mutex
);
78 EXPORT_SYMBOL(xt_register_target
);
81 xt_unregister_target(struct xt_target
*target
)
83 int af
= target
->family
;
85 mutex_lock(&xt
[af
].mutex
);
86 list_del(&target
->list
);
87 mutex_unlock(&xt
[af
].mutex
);
89 EXPORT_SYMBOL(xt_unregister_target
);
92 xt_register_targets(struct xt_target
*target
, unsigned int n
)
97 for (i
= 0; i
< n
; i
++) {
98 err
= xt_register_target(&target
[i
]);
106 xt_unregister_targets(target
, i
);
109 EXPORT_SYMBOL(xt_register_targets
);
112 xt_unregister_targets(struct xt_target
*target
, unsigned int n
)
116 for (i
= 0; i
< n
; i
++)
117 xt_unregister_target(&target
[i
]);
119 EXPORT_SYMBOL(xt_unregister_targets
);
122 xt_register_match(struct xt_match
*match
)
124 int ret
, af
= match
->family
;
126 ret
= mutex_lock_interruptible(&xt
[af
].mutex
);
130 list_add(&match
->list
, &xt
[af
].match
);
131 mutex_unlock(&xt
[af
].mutex
);
135 EXPORT_SYMBOL(xt_register_match
);
138 xt_unregister_match(struct xt_match
*match
)
140 int af
= match
->family
;
142 mutex_lock(&xt
[af
].mutex
);
143 list_del(&match
->list
);
144 mutex_unlock(&xt
[af
].mutex
);
146 EXPORT_SYMBOL(xt_unregister_match
);
149 xt_register_matches(struct xt_match
*match
, unsigned int n
)
154 for (i
= 0; i
< n
; i
++) {
155 err
= xt_register_match(&match
[i
]);
163 xt_unregister_matches(match
, i
);
166 EXPORT_SYMBOL(xt_register_matches
);
169 xt_unregister_matches(struct xt_match
*match
, unsigned int n
)
173 for (i
= 0; i
< n
; i
++)
174 xt_unregister_match(&match
[i
]);
176 EXPORT_SYMBOL(xt_unregister_matches
);
180 * These are weird, but module loading must not be done with mutex
181 * held (since they will register), and we have to have a single
182 * function to use try_then_request_module().
185 /* Find match, grabs ref. Returns ERR_PTR() on error. */
186 struct xt_match
*xt_find_match(int af
, const char *name
, u8 revision
)
191 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
192 return ERR_PTR(-EINTR
);
194 list_for_each_entry(m
, &xt
[af
].match
, list
) {
195 if (strcmp(m
->name
, name
) == 0) {
196 if (m
->revision
== revision
) {
197 if (try_module_get(m
->me
)) {
198 mutex_unlock(&xt
[af
].mutex
);
202 err
= -EPROTOTYPE
; /* Found something. */
205 mutex_unlock(&xt
[af
].mutex
);
208 EXPORT_SYMBOL(xt_find_match
);
210 /* Find target, grabs ref. Returns ERR_PTR() on error. */
211 struct xt_target
*xt_find_target(int af
, const char *name
, u8 revision
)
216 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
217 return ERR_PTR(-EINTR
);
219 list_for_each_entry(t
, &xt
[af
].target
, list
) {
220 if (strcmp(t
->name
, name
) == 0) {
221 if (t
->revision
== revision
) {
222 if (try_module_get(t
->me
)) {
223 mutex_unlock(&xt
[af
].mutex
);
227 err
= -EPROTOTYPE
; /* Found something. */
230 mutex_unlock(&xt
[af
].mutex
);
233 EXPORT_SYMBOL(xt_find_target
);
235 struct xt_target
*xt_request_find_target(int af
, const char *name
, u8 revision
)
237 struct xt_target
*target
;
239 target
= try_then_request_module(xt_find_target(af
, name
, revision
),
240 "%st_%s", xt_prefix
[af
], name
);
241 if (IS_ERR(target
) || !target
)
245 EXPORT_SYMBOL_GPL(xt_request_find_target
);
247 static int match_revfn(int af
, const char *name
, u8 revision
, int *bestp
)
252 list_for_each_entry(m
, &xt
[af
].match
, list
) {
253 if (strcmp(m
->name
, name
) == 0) {
254 if (m
->revision
> *bestp
)
255 *bestp
= m
->revision
;
256 if (m
->revision
== revision
)
263 static int target_revfn(int af
, const char *name
, u8 revision
, int *bestp
)
268 list_for_each_entry(t
, &xt
[af
].target
, list
) {
269 if (strcmp(t
->name
, name
) == 0) {
270 if (t
->revision
> *bestp
)
271 *bestp
= t
->revision
;
272 if (t
->revision
== revision
)
279 /* Returns true or false (if no such extension at all) */
280 int xt_find_revision(int af
, const char *name
, u8 revision
, int target
,
283 int have_rev
, best
= -1;
285 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0) {
290 have_rev
= target_revfn(af
, name
, revision
, &best
);
292 have_rev
= match_revfn(af
, name
, revision
, &best
);
293 mutex_unlock(&xt
[af
].mutex
);
295 /* Nothing at all? Return 0 to try loading module. */
303 *err
= -EPROTONOSUPPORT
;
306 EXPORT_SYMBOL_GPL(xt_find_revision
);
308 int xt_check_match(const struct xt_match
*match
, unsigned short family
,
309 unsigned int size
, const char *table
, unsigned int hook_mask
,
310 unsigned short proto
, int inv_proto
)
312 if (XT_ALIGN(match
->matchsize
) != size
) {
313 printk("%s_tables: %s match: invalid size %Zu != %u\n",
314 xt_prefix
[family
], match
->name
,
315 XT_ALIGN(match
->matchsize
), size
);
318 if (match
->table
&& strcmp(match
->table
, table
)) {
319 printk("%s_tables: %s match: only valid in %s table, not %s\n",
320 xt_prefix
[family
], match
->name
, match
->table
, table
);
323 if (match
->hooks
&& (hook_mask
& ~match
->hooks
) != 0) {
324 printk("%s_tables: %s match: bad hook_mask %u/%u\n",
325 xt_prefix
[family
], match
->name
, hook_mask
, match
->hooks
);
328 if (match
->proto
&& (match
->proto
!= proto
|| inv_proto
)) {
329 printk("%s_tables: %s match: only valid for protocol %u\n",
330 xt_prefix
[family
], match
->name
, match
->proto
);
335 EXPORT_SYMBOL_GPL(xt_check_match
);
338 int xt_compat_match_offset(struct xt_match
*match
)
340 u_int16_t csize
= match
->compatsize
? : match
->matchsize
;
341 return XT_ALIGN(match
->matchsize
) - COMPAT_XT_ALIGN(csize
);
343 EXPORT_SYMBOL_GPL(xt_compat_match_offset
);
345 void xt_compat_match_from_user(struct xt_entry_match
*m
, void **dstptr
,
348 struct xt_match
*match
= m
->u
.kernel
.match
;
349 struct compat_xt_entry_match
*cm
= (struct compat_xt_entry_match
*)m
;
350 int pad
, off
= xt_compat_match_offset(match
);
351 u_int16_t msize
= cm
->u
.user
.match_size
;
354 memcpy(m
, cm
, sizeof(*cm
));
355 if (match
->compat_from_user
)
356 match
->compat_from_user(m
->data
, cm
->data
);
358 memcpy(m
->data
, cm
->data
, msize
- sizeof(*cm
));
359 pad
= XT_ALIGN(match
->matchsize
) - match
->matchsize
;
361 memset(m
->data
+ match
->matchsize
, 0, pad
);
364 m
->u
.user
.match_size
= msize
;
369 EXPORT_SYMBOL_GPL(xt_compat_match_from_user
);
371 int xt_compat_match_to_user(struct xt_entry_match
*m
, void __user
**dstptr
,
374 struct xt_match
*match
= m
->u
.kernel
.match
;
375 struct compat_xt_entry_match __user
*cm
= *dstptr
;
376 int off
= xt_compat_match_offset(match
);
377 u_int16_t msize
= m
->u
.user
.match_size
- off
;
379 if (copy_to_user(cm
, m
, sizeof(*cm
)) ||
380 put_user(msize
, &cm
->u
.user
.match_size
) ||
381 copy_to_user(cm
->u
.user
.name
, m
->u
.kernel
.match
->name
,
382 strlen(m
->u
.kernel
.match
->name
) + 1))
385 if (match
->compat_to_user
) {
386 if (match
->compat_to_user((void __user
*)cm
->data
, m
->data
))
389 if (copy_to_user(cm
->data
, m
->data
, msize
- sizeof(*cm
)))
397 EXPORT_SYMBOL_GPL(xt_compat_match_to_user
);
398 #endif /* CONFIG_COMPAT */
400 int xt_check_target(const struct xt_target
*target
, unsigned short family
,
401 unsigned int size
, const char *table
, unsigned int hook_mask
,
402 unsigned short proto
, int inv_proto
)
404 if (XT_ALIGN(target
->targetsize
) != size
) {
405 printk("%s_tables: %s target: invalid size %Zu != %u\n",
406 xt_prefix
[family
], target
->name
,
407 XT_ALIGN(target
->targetsize
), size
);
410 if (target
->table
&& strcmp(target
->table
, table
)) {
411 printk("%s_tables: %s target: only valid in %s table, not %s\n",
412 xt_prefix
[family
], target
->name
, target
->table
, table
);
415 if (target
->hooks
&& (hook_mask
& ~target
->hooks
) != 0) {
416 printk("%s_tables: %s target: bad hook_mask %u/%u\n",
417 xt_prefix
[family
], target
->name
, hook_mask
,
421 if (target
->proto
&& (target
->proto
!= proto
|| inv_proto
)) {
422 printk("%s_tables: %s target: only valid for protocol %u\n",
423 xt_prefix
[family
], target
->name
, target
->proto
);
428 EXPORT_SYMBOL_GPL(xt_check_target
);
431 int xt_compat_target_offset(struct xt_target
*target
)
433 u_int16_t csize
= target
->compatsize
? : target
->targetsize
;
434 return XT_ALIGN(target
->targetsize
) - COMPAT_XT_ALIGN(csize
);
436 EXPORT_SYMBOL_GPL(xt_compat_target_offset
);
438 void xt_compat_target_from_user(struct xt_entry_target
*t
, void **dstptr
,
441 struct xt_target
*target
= t
->u
.kernel
.target
;
442 struct compat_xt_entry_target
*ct
= (struct compat_xt_entry_target
*)t
;
443 int pad
, off
= xt_compat_target_offset(target
);
444 u_int16_t tsize
= ct
->u
.user
.target_size
;
447 memcpy(t
, ct
, sizeof(*ct
));
448 if (target
->compat_from_user
)
449 target
->compat_from_user(t
->data
, ct
->data
);
451 memcpy(t
->data
, ct
->data
, tsize
- sizeof(*ct
));
452 pad
= XT_ALIGN(target
->targetsize
) - target
->targetsize
;
454 memset(t
->data
+ target
->targetsize
, 0, pad
);
457 t
->u
.user
.target_size
= tsize
;
462 EXPORT_SYMBOL_GPL(xt_compat_target_from_user
);
464 int xt_compat_target_to_user(struct xt_entry_target
*t
, void __user
**dstptr
,
467 struct xt_target
*target
= t
->u
.kernel
.target
;
468 struct compat_xt_entry_target __user
*ct
= *dstptr
;
469 int off
= xt_compat_target_offset(target
);
470 u_int16_t tsize
= t
->u
.user
.target_size
- off
;
472 if (copy_to_user(ct
, t
, sizeof(*ct
)) ||
473 put_user(tsize
, &ct
->u
.user
.target_size
) ||
474 copy_to_user(ct
->u
.user
.name
, t
->u
.kernel
.target
->name
,
475 strlen(t
->u
.kernel
.target
->name
) + 1))
478 if (target
->compat_to_user
) {
479 if (target
->compat_to_user((void __user
*)ct
->data
, t
->data
))
482 if (copy_to_user(ct
->data
, t
->data
, tsize
- sizeof(*ct
)))
490 EXPORT_SYMBOL_GPL(xt_compat_target_to_user
);
493 struct xt_table_info
*xt_alloc_table_info(unsigned int size
)
495 struct xt_table_info
*newinfo
;
498 /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
499 if ((SMP_ALIGN(size
) >> PAGE_SHIFT
) + 2 > num_physpages
)
502 newinfo
= kzalloc(XT_TABLE_INFO_SZ
, GFP_KERNEL
);
506 newinfo
->size
= size
;
508 for_each_possible_cpu(cpu
) {
509 if (size
<= PAGE_SIZE
)
510 newinfo
->entries
[cpu
] = kmalloc_node(size
,
514 newinfo
->entries
[cpu
] = vmalloc_node(size
,
517 if (newinfo
->entries
[cpu
] == NULL
) {
518 xt_free_table_info(newinfo
);
525 EXPORT_SYMBOL(xt_alloc_table_info
);
527 void xt_free_table_info(struct xt_table_info
*info
)
531 for_each_possible_cpu(cpu
) {
532 if (info
->size
<= PAGE_SIZE
)
533 kfree(info
->entries
[cpu
]);
535 vfree(info
->entries
[cpu
]);
539 EXPORT_SYMBOL(xt_free_table_info
);
541 /* Find table by name, grabs mutex & ref. Returns ERR_PTR() on error. */
542 struct xt_table
*xt_find_table_lock(int af
, const char *name
)
546 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
547 return ERR_PTR(-EINTR
);
549 list_for_each_entry(t
, &xt
[af
].tables
, list
)
550 if (strcmp(t
->name
, name
) == 0 && try_module_get(t
->me
))
552 mutex_unlock(&xt
[af
].mutex
);
555 EXPORT_SYMBOL_GPL(xt_find_table_lock
);
557 void xt_table_unlock(struct xt_table
*table
)
559 mutex_unlock(&xt
[table
->af
].mutex
);
561 EXPORT_SYMBOL_GPL(xt_table_unlock
);
564 void xt_compat_lock(int af
)
566 mutex_lock(&xt
[af
].compat_mutex
);
568 EXPORT_SYMBOL_GPL(xt_compat_lock
);
570 void xt_compat_unlock(int af
)
572 mutex_unlock(&xt
[af
].compat_mutex
);
574 EXPORT_SYMBOL_GPL(xt_compat_unlock
);
577 struct xt_table_info
*
578 xt_replace_table(struct xt_table
*table
,
579 unsigned int num_counters
,
580 struct xt_table_info
*newinfo
,
583 struct xt_table_info
*oldinfo
, *private;
585 /* Do the substitution. */
586 write_lock_bh(&table
->lock
);
587 private = table
->private;
588 /* Check inside lock: is the old number correct? */
589 if (num_counters
!= private->number
) {
590 duprintf("num_counters != table->private->number (%u/%u)\n",
591 num_counters
, private->number
);
592 write_unlock_bh(&table
->lock
);
597 table
->private = newinfo
;
598 newinfo
->initial_entries
= oldinfo
->initial_entries
;
599 write_unlock_bh(&table
->lock
);
603 EXPORT_SYMBOL_GPL(xt_replace_table
);
605 int xt_register_table(struct xt_table
*table
,
606 struct xt_table_info
*bootstrap
,
607 struct xt_table_info
*newinfo
)
610 struct xt_table_info
*private;
613 ret
= mutex_lock_interruptible(&xt
[table
->af
].mutex
);
617 /* Don't autoload: we'd eat our tail... */
618 list_for_each_entry(t
, &xt
[table
->af
].tables
, list
) {
619 if (strcmp(t
->name
, table
->name
) == 0) {
625 /* Simplifies replace_table code. */
626 table
->private = bootstrap
;
627 rwlock_init(&table
->lock
);
628 if (!xt_replace_table(table
, 0, newinfo
, &ret
))
631 private = table
->private;
632 duprintf("table->private->number = %u\n", private->number
);
634 /* save number of initial entries */
635 private->initial_entries
= private->number
;
637 list_add(&table
->list
, &xt
[table
->af
].tables
);
641 mutex_unlock(&xt
[table
->af
].mutex
);
644 EXPORT_SYMBOL_GPL(xt_register_table
);
646 void *xt_unregister_table(struct xt_table
*table
)
648 struct xt_table_info
*private;
650 mutex_lock(&xt
[table
->af
].mutex
);
651 private = table
->private;
652 list_del(&table
->list
);
653 mutex_unlock(&xt
[table
->af
].mutex
);
657 EXPORT_SYMBOL_GPL(xt_unregister_table
);
659 #ifdef CONFIG_PROC_FS
660 static struct list_head
*xt_get_idx(struct list_head
*list
, struct seq_file
*seq
, loff_t pos
)
662 struct list_head
*head
= list
->next
;
664 if (!head
|| list_empty(list
))
667 while (pos
&& (head
= head
->next
)) {
672 return pos
? NULL
: head
;
675 static struct list_head
*type2list(u_int16_t af
, u_int16_t type
)
677 struct list_head
*list
;
681 list
= &xt
[af
].target
;
684 list
= &xt
[af
].match
;
687 list
= &xt
[af
].tables
;
697 static void *xt_tgt_seq_start(struct seq_file
*seq
, loff_t
*pos
)
699 struct proc_dir_entry
*pde
= (struct proc_dir_entry
*) seq
->private;
700 u_int16_t af
= (unsigned long)pde
->data
& 0xffff;
701 u_int16_t type
= (unsigned long)pde
->data
>> 16;
702 struct list_head
*list
;
707 list
= type2list(af
, type
);
711 if (mutex_lock_interruptible(&xt
[af
].mutex
) != 0)
714 return xt_get_idx(list
, seq
, *pos
);
717 static void *xt_tgt_seq_next(struct seq_file
*seq
, void *v
, loff_t
*pos
)
719 struct proc_dir_entry
*pde
= seq
->private;
720 u_int16_t af
= (unsigned long)pde
->data
& 0xffff;
721 u_int16_t type
= (unsigned long)pde
->data
>> 16;
722 struct list_head
*list
;
727 list
= type2list(af
, type
);
732 return xt_get_idx(list
, seq
, *pos
);
735 static void xt_tgt_seq_stop(struct seq_file
*seq
, void *v
)
737 struct proc_dir_entry
*pde
= seq
->private;
738 u_int16_t af
= (unsigned long)pde
->data
& 0xffff;
740 mutex_unlock(&xt
[af
].mutex
);
743 static int xt_name_seq_show(struct seq_file
*seq
, void *v
)
745 char *name
= (char *)v
+ sizeof(struct list_head
);
748 return seq_printf(seq
, "%s\n", name
);
753 static const struct seq_operations xt_tgt_seq_ops
= {
754 .start
= xt_tgt_seq_start
,
755 .next
= xt_tgt_seq_next
,
756 .stop
= xt_tgt_seq_stop
,
757 .show
= xt_name_seq_show
,
760 static int xt_tgt_open(struct inode
*inode
, struct file
*file
)
764 ret
= seq_open(file
, &xt_tgt_seq_ops
);
766 struct seq_file
*seq
= file
->private_data
;
767 struct proc_dir_entry
*pde
= PDE(inode
);
775 static const struct file_operations xt_file_ops
= {
776 .owner
= THIS_MODULE
,
780 .release
= seq_release
,
783 #define FORMAT_TABLES "_tables_names"
784 #define FORMAT_MATCHES "_tables_matches"
785 #define FORMAT_TARGETS "_tables_targets"
787 #endif /* CONFIG_PROC_FS */
789 int xt_proto_init(int af
)
791 #ifdef CONFIG_PROC_FS
792 char buf
[XT_FUNCTION_MAXNAMELEN
];
793 struct proc_dir_entry
*proc
;
800 #ifdef CONFIG_PROC_FS
801 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
802 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
803 proc
= proc_net_fops_create(&init_net
, buf
, 0440, &xt_file_ops
);
806 proc
->data
= (void *) ((unsigned long) af
| (TABLE
<< 16));
809 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
810 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
811 proc
= proc_net_fops_create(&init_net
, buf
, 0440, &xt_file_ops
);
813 goto out_remove_tables
;
814 proc
->data
= (void *) ((unsigned long) af
| (MATCH
<< 16));
816 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
817 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
818 proc
= proc_net_fops_create(&init_net
, buf
, 0440, &xt_file_ops
);
820 goto out_remove_matches
;
821 proc
->data
= (void *) ((unsigned long) af
| (TARGET
<< 16));
826 #ifdef CONFIG_PROC_FS
828 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
829 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
830 proc_net_remove(&init_net
, buf
);
833 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
834 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
835 proc_net_remove(&init_net
, buf
);
840 EXPORT_SYMBOL_GPL(xt_proto_init
);
842 void xt_proto_fini(int af
)
844 #ifdef CONFIG_PROC_FS
845 char buf
[XT_FUNCTION_MAXNAMELEN
];
847 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
848 strlcat(buf
, FORMAT_TABLES
, sizeof(buf
));
849 proc_net_remove(&init_net
, buf
);
851 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
852 strlcat(buf
, FORMAT_TARGETS
, sizeof(buf
));
853 proc_net_remove(&init_net
, buf
);
855 strlcpy(buf
, xt_prefix
[af
], sizeof(buf
));
856 strlcat(buf
, FORMAT_MATCHES
, sizeof(buf
));
857 proc_net_remove(&init_net
, buf
);
858 #endif /*CONFIG_PROC_FS*/
860 EXPORT_SYMBOL_GPL(xt_proto_fini
);
863 static int __init
xt_init(void)
867 xt
= kmalloc(sizeof(struct xt_af
) * NPROTO
, GFP_KERNEL
);
871 for (i
= 0; i
< NPROTO
; i
++) {
872 mutex_init(&xt
[i
].mutex
);
874 mutex_init(&xt
[i
].compat_mutex
);
876 INIT_LIST_HEAD(&xt
[i
].target
);
877 INIT_LIST_HEAD(&xt
[i
].match
);
878 INIT_LIST_HEAD(&xt
[i
].tables
);
883 static void __exit
xt_fini(void)
888 module_init(xt_init
);
889 module_exit(xt_fini
);