nf_tables_offload.c 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651
  1. /* SPDX-License-Identifier: GPL-2.0 */
  2. #include <linux/init.h>
  3. #include <linux/module.h>
  4. #include <linux/netfilter.h>
  5. #include <net/flow_offload.h>
  6. #include <net/netfilter/nf_tables.h>
  7. #include <net/netfilter/nf_tables_offload.h>
  8. #include <net/pkt_cls.h>
  9. static struct nft_flow_rule *nft_flow_rule_alloc(int num_actions)
  10. {
  11. struct nft_flow_rule *flow;
  12. flow = kzalloc(sizeof(struct nft_flow_rule), GFP_KERNEL);
  13. if (!flow)
  14. return NULL;
  15. flow->rule = flow_rule_alloc(num_actions);
  16. if (!flow->rule) {
  17. kfree(flow);
  18. return NULL;
  19. }
  20. flow->rule->match.dissector = &flow->match.dissector;
  21. flow->rule->match.mask = &flow->match.mask;
  22. flow->rule->match.key = &flow->match.key;
  23. return flow;
  24. }
  25. void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow,
  26. enum flow_dissector_key_id addr_type)
  27. {
  28. struct nft_flow_match *match = &flow->match;
  29. struct nft_flow_key *mask = &match->mask;
  30. struct nft_flow_key *key = &match->key;
  31. if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL))
  32. return;
  33. key->control.addr_type = addr_type;
  34. mask->control.addr_type = 0xffff;
  35. match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CONTROL);
  36. match->dissector.offset[FLOW_DISSECTOR_KEY_CONTROL] =
  37. offsetof(struct nft_flow_key, control);
  38. }
  39. struct nft_offload_ethertype {
  40. __be16 value;
  41. __be16 mask;
  42. };
  43. static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx,
  44. struct nft_flow_rule *flow)
  45. {
  46. struct nft_flow_match *match = &flow->match;
  47. struct nft_offload_ethertype ethertype = {
  48. .value = match->key.basic.n_proto,
  49. .mask = match->mask.basic.n_proto,
  50. };
  51. if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_VLAN) &&
  52. (match->key.vlan.vlan_tpid == htons(ETH_P_8021Q) ||
  53. match->key.vlan.vlan_tpid == htons(ETH_P_8021AD))) {
  54. match->key.basic.n_proto = match->key.cvlan.vlan_tpid;
  55. match->mask.basic.n_proto = match->mask.cvlan.vlan_tpid;
  56. match->key.cvlan.vlan_tpid = match->key.vlan.vlan_tpid;
  57. match->mask.cvlan.vlan_tpid = match->mask.vlan.vlan_tpid;
  58. match->key.vlan.vlan_tpid = ethertype.value;
  59. match->mask.vlan.vlan_tpid = ethertype.mask;
  60. match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN] =
  61. offsetof(struct nft_flow_key, cvlan);
  62. match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CVLAN);
  63. } else if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_BASIC) &&
  64. (match->key.basic.n_proto == htons(ETH_P_8021Q) ||
  65. match->key.basic.n_proto == htons(ETH_P_8021AD))) {
  66. match->key.basic.n_proto = match->key.vlan.vlan_tpid;
  67. match->mask.basic.n_proto = match->mask.vlan.vlan_tpid;
  68. match->key.vlan.vlan_tpid = ethertype.value;
  69. match->mask.vlan.vlan_tpid = ethertype.mask;
  70. match->dissector.offset[FLOW_DISSECTOR_KEY_VLAN] =
  71. offsetof(struct nft_flow_key, vlan);
  72. match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_VLAN);
  73. }
  74. }
  75. struct nft_flow_rule *nft_flow_rule_create(struct net *net,
  76. const struct nft_rule *rule)
  77. {
  78. struct nft_offload_ctx *ctx;
  79. struct nft_flow_rule *flow;
  80. int num_actions = 0, err;
  81. struct nft_expr *expr;
  82. expr = nft_expr_first(rule);
  83. while (nft_expr_more(rule, expr)) {
  84. if (expr->ops->offload_action &&
  85. expr->ops->offload_action(expr))
  86. num_actions++;
  87. expr = nft_expr_next(expr);
  88. }
  89. if (num_actions == 0)
  90. return ERR_PTR(-EOPNOTSUPP);
  91. flow = nft_flow_rule_alloc(num_actions);
  92. if (!flow)
  93. return ERR_PTR(-ENOMEM);
  94. expr = nft_expr_first(rule);
  95. ctx = kzalloc(sizeof(struct nft_offload_ctx), GFP_KERNEL);
  96. if (!ctx) {
  97. err = -ENOMEM;
  98. goto err_out;
  99. }
  100. ctx->net = net;
  101. ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
  102. while (nft_expr_more(rule, expr)) {
  103. if (!expr->ops->offload) {
  104. err = -EOPNOTSUPP;
  105. goto err_out;
  106. }
  107. err = expr->ops->offload(ctx, flow, expr);
  108. if (err < 0)
  109. goto err_out;
  110. expr = nft_expr_next(expr);
  111. }
  112. nft_flow_rule_transfer_vlan(ctx, flow);
  113. flow->proto = ctx->dep.l3num;
  114. kfree(ctx);
  115. return flow;
  116. err_out:
  117. kfree(ctx);
  118. nft_flow_rule_destroy(flow);
  119. return ERR_PTR(err);
  120. }
  121. void nft_flow_rule_destroy(struct nft_flow_rule *flow)
  122. {
  123. struct flow_action_entry *entry;
  124. int i;
  125. flow_action_for_each(i, entry, &flow->rule->action) {
  126. switch (entry->id) {
  127. case FLOW_ACTION_REDIRECT:
  128. case FLOW_ACTION_MIRRED:
  129. dev_put(entry->dev);
  130. break;
  131. default:
  132. break;
  133. }
  134. }
  135. kfree(flow->rule);
  136. kfree(flow);
  137. }
  138. void nft_offload_set_dependency(struct nft_offload_ctx *ctx,
  139. enum nft_offload_dep_type type)
  140. {
  141. ctx->dep.type = type;
  142. }
  143. void nft_offload_update_dependency(struct nft_offload_ctx *ctx,
  144. const void *data, u32 len)
  145. {
  146. switch (ctx->dep.type) {
  147. case NFT_OFFLOAD_DEP_NETWORK:
  148. WARN_ON(len != sizeof(__u16));
  149. memcpy(&ctx->dep.l3num, data, sizeof(__u16));
  150. break;
  151. case NFT_OFFLOAD_DEP_TRANSPORT:
  152. WARN_ON(len != sizeof(__u8));
  153. memcpy(&ctx->dep.protonum, data, sizeof(__u8));
  154. break;
  155. default:
  156. break;
  157. }
  158. ctx->dep.type = NFT_OFFLOAD_DEP_UNSPEC;
  159. }
  160. static void nft_flow_offload_common_init(struct flow_cls_common_offload *common,
  161. __be16 proto, int priority,
  162. struct netlink_ext_ack *extack)
  163. {
  164. common->protocol = proto;
  165. common->prio = priority;
  166. common->extack = extack;
  167. }
  168. static int nft_setup_cb_call(enum tc_setup_type type, void *type_data,
  169. struct list_head *cb_list)
  170. {
  171. struct flow_block_cb *block_cb;
  172. int err;
  173. list_for_each_entry(block_cb, cb_list, list) {
  174. err = block_cb->cb(type, type_data, block_cb->cb_priv);
  175. if (err < 0)
  176. return err;
  177. }
  178. return 0;
  179. }
  180. int nft_chain_offload_priority(struct nft_base_chain *basechain)
  181. {
  182. if (basechain->ops.priority <= 0 ||
  183. basechain->ops.priority > USHRT_MAX)
  184. return -1;
  185. return 0;
  186. }
  187. static void nft_flow_cls_offload_setup(struct flow_cls_offload *cls_flow,
  188. const struct nft_base_chain *basechain,
  189. const struct nft_rule *rule,
  190. const struct nft_flow_rule *flow,
  191. struct netlink_ext_ack *extack,
  192. enum flow_cls_command command)
  193. {
  194. __be16 proto = ETH_P_ALL;
  195. memset(cls_flow, 0, sizeof(*cls_flow));
  196. if (flow)
  197. proto = flow->proto;
  198. nft_flow_offload_common_init(&cls_flow->common, proto,
  199. basechain->ops.priority, extack);
  200. cls_flow->command = command;
  201. cls_flow->cookie = (unsigned long) rule;
  202. if (flow)
  203. cls_flow->rule = flow->rule;
  204. }
  205. static int nft_flow_offload_rule(struct nft_chain *chain,
  206. struct nft_rule *rule,
  207. struct nft_flow_rule *flow,
  208. enum flow_cls_command command)
  209. {
  210. struct netlink_ext_ack extack = {};
  211. struct flow_cls_offload cls_flow;
  212. struct nft_base_chain *basechain;
  213. if (!nft_is_base_chain(chain))
  214. return -EOPNOTSUPP;
  215. basechain = nft_base_chain(chain);
  216. nft_flow_cls_offload_setup(&cls_flow, basechain, rule, flow, &extack,
  217. command);
  218. return nft_setup_cb_call(TC_SETUP_CLSFLOWER, &cls_flow,
  219. &basechain->flow_block.cb_list);
  220. }
  221. static int nft_flow_offload_bind(struct flow_block_offload *bo,
  222. struct nft_base_chain *basechain)
  223. {
  224. list_splice(&bo->cb_list, &basechain->flow_block.cb_list);
  225. return 0;
  226. }
  227. static int nft_flow_offload_unbind(struct flow_block_offload *bo,
  228. struct nft_base_chain *basechain)
  229. {
  230. struct flow_block_cb *block_cb, *next;
  231. struct flow_cls_offload cls_flow;
  232. struct netlink_ext_ack extack;
  233. struct nft_chain *chain;
  234. struct nft_rule *rule;
  235. chain = &basechain->chain;
  236. list_for_each_entry(rule, &chain->rules, list) {
  237. memset(&extack, 0, sizeof(extack));
  238. nft_flow_cls_offload_setup(&cls_flow, basechain, rule, NULL,
  239. &extack, FLOW_CLS_DESTROY);
  240. nft_setup_cb_call(TC_SETUP_CLSFLOWER, &cls_flow, &bo->cb_list);
  241. }
  242. list_for_each_entry_safe(block_cb, next, &bo->cb_list, list) {
  243. list_del(&block_cb->list);
  244. flow_block_cb_free(block_cb);
  245. }
  246. return 0;
  247. }
  248. static int nft_block_setup(struct nft_base_chain *basechain,
  249. struct flow_block_offload *bo,
  250. enum flow_block_command cmd)
  251. {
  252. int err;
  253. switch (cmd) {
  254. case FLOW_BLOCK_BIND:
  255. err = nft_flow_offload_bind(bo, basechain);
  256. break;
  257. case FLOW_BLOCK_UNBIND:
  258. err = nft_flow_offload_unbind(bo, basechain);
  259. break;
  260. default:
  261. WARN_ON_ONCE(1);
  262. err = -EOPNOTSUPP;
  263. }
  264. return err;
  265. }
  266. static void nft_flow_block_offload_init(struct flow_block_offload *bo,
  267. struct net *net,
  268. enum flow_block_command cmd,
  269. struct nft_base_chain *basechain,
  270. struct netlink_ext_ack *extack)
  271. {
  272. memset(bo, 0, sizeof(*bo));
  273. bo->net = net;
  274. bo->block = &basechain->flow_block;
  275. bo->command = cmd;
  276. bo->binder_type = FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS;
  277. bo->extack = extack;
  278. bo->cb_list_head = &basechain->flow_block.cb_list;
  279. INIT_LIST_HEAD(&bo->cb_list);
  280. }
  281. static int nft_block_offload_cmd(struct nft_base_chain *chain,
  282. struct net_device *dev,
  283. enum flow_block_command cmd)
  284. {
  285. struct netlink_ext_ack extack = {};
  286. struct flow_block_offload bo;
  287. int err;
  288. nft_flow_block_offload_init(&bo, dev_net(dev), cmd, chain, &extack);
  289. err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
  290. if (err < 0)
  291. return err;
  292. return nft_block_setup(chain, &bo, cmd);
  293. }
  294. static void nft_indr_block_cleanup(struct flow_block_cb *block_cb)
  295. {
  296. struct nft_base_chain *basechain = block_cb->indr.data;
  297. struct net_device *dev = block_cb->indr.dev;
  298. struct netlink_ext_ack extack = {};
  299. struct net *net = dev_net(dev);
  300. struct flow_block_offload bo;
  301. nft_flow_block_offload_init(&bo, dev_net(dev), FLOW_BLOCK_UNBIND,
  302. basechain, &extack);
  303. mutex_lock(&net->nft.commit_mutex);
  304. list_del(&block_cb->driver_list);
  305. list_move(&block_cb->list, &bo.cb_list);
  306. nft_flow_offload_unbind(&bo, basechain);
  307. mutex_unlock(&net->nft.commit_mutex);
  308. }
  309. static int nft_indr_block_offload_cmd(struct nft_base_chain *basechain,
  310. struct net_device *dev,
  311. enum flow_block_command cmd)
  312. {
  313. struct netlink_ext_ack extack = {};
  314. struct flow_block_offload bo;
  315. int err;
  316. nft_flow_block_offload_init(&bo, dev_net(dev), cmd, basechain, &extack);
  317. err = flow_indr_dev_setup_offload(dev, NULL, TC_SETUP_BLOCK, basechain, &bo,
  318. nft_indr_block_cleanup);
  319. if (err < 0)
  320. return err;
  321. if (list_empty(&bo.cb_list))
  322. return -EOPNOTSUPP;
  323. return nft_block_setup(basechain, &bo, cmd);
  324. }
  325. static int nft_chain_offload_cmd(struct nft_base_chain *basechain,
  326. struct net_device *dev,
  327. enum flow_block_command cmd)
  328. {
  329. int err;
  330. if (dev->netdev_ops->ndo_setup_tc)
  331. err = nft_block_offload_cmd(basechain, dev, cmd);
  332. else
  333. err = nft_indr_block_offload_cmd(basechain, dev, cmd);
  334. return err;
  335. }
  336. static int nft_flow_block_chain(struct nft_base_chain *basechain,
  337. const struct net_device *this_dev,
  338. enum flow_block_command cmd)
  339. {
  340. struct net_device *dev;
  341. struct nft_hook *hook;
  342. int err, i = 0;
  343. list_for_each_entry(hook, &basechain->hook_list, list) {
  344. dev = hook->ops.dev;
  345. if (this_dev && this_dev != dev)
  346. continue;
  347. err = nft_chain_offload_cmd(basechain, dev, cmd);
  348. if (err < 0 && cmd == FLOW_BLOCK_BIND) {
  349. if (!this_dev)
  350. goto err_flow_block;
  351. return err;
  352. }
  353. i++;
  354. }
  355. return 0;
  356. err_flow_block:
  357. list_for_each_entry(hook, &basechain->hook_list, list) {
  358. if (i-- <= 0)
  359. break;
  360. dev = hook->ops.dev;
  361. nft_chain_offload_cmd(basechain, dev, FLOW_BLOCK_UNBIND);
  362. }
  363. return err;
  364. }
  365. static int nft_flow_offload_chain(struct nft_chain *chain, u8 *ppolicy,
  366. enum flow_block_command cmd)
  367. {
  368. struct nft_base_chain *basechain;
  369. u8 policy;
  370. if (!nft_is_base_chain(chain))
  371. return -EOPNOTSUPP;
  372. basechain = nft_base_chain(chain);
  373. policy = ppolicy ? *ppolicy : basechain->policy;
  374. /* Only default policy to accept is supported for now. */
  375. if (cmd == FLOW_BLOCK_BIND && policy == NF_DROP)
  376. return -EOPNOTSUPP;
  377. return nft_flow_block_chain(basechain, NULL, cmd);
  378. }
  379. static void nft_flow_rule_offload_abort(struct net *net,
  380. struct nft_trans *trans)
  381. {
  382. int err = 0;
  383. list_for_each_entry_continue_reverse(trans, &net->nft.commit_list, list) {
  384. if (trans->ctx.family != NFPROTO_NETDEV)
  385. continue;
  386. switch (trans->msg_type) {
  387. case NFT_MSG_NEWCHAIN:
  388. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
  389. nft_trans_chain_update(trans))
  390. continue;
  391. err = nft_flow_offload_chain(trans->ctx.chain, NULL,
  392. FLOW_BLOCK_UNBIND);
  393. break;
  394. case NFT_MSG_DELCHAIN:
  395. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  396. continue;
  397. err = nft_flow_offload_chain(trans->ctx.chain, NULL,
  398. FLOW_BLOCK_BIND);
  399. break;
  400. case NFT_MSG_NEWRULE:
  401. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  402. continue;
  403. err = nft_flow_offload_rule(trans->ctx.chain,
  404. nft_trans_rule(trans),
  405. NULL, FLOW_CLS_DESTROY);
  406. break;
  407. case NFT_MSG_DELRULE:
  408. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  409. continue;
  410. err = nft_flow_offload_rule(trans->ctx.chain,
  411. nft_trans_rule(trans),
  412. nft_trans_flow_rule(trans),
  413. FLOW_CLS_REPLACE);
  414. break;
  415. }
  416. if (WARN_ON_ONCE(err))
  417. break;
  418. }
  419. }
  420. int nft_flow_rule_offload_commit(struct net *net)
  421. {
  422. struct nft_trans *trans;
  423. int err = 0;
  424. u8 policy;
  425. list_for_each_entry(trans, &net->nft.commit_list, list) {
  426. if (trans->ctx.family != NFPROTO_NETDEV)
  427. continue;
  428. switch (trans->msg_type) {
  429. case NFT_MSG_NEWCHAIN:
  430. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD) ||
  431. nft_trans_chain_update(trans))
  432. continue;
  433. policy = nft_trans_chain_policy(trans);
  434. err = nft_flow_offload_chain(trans->ctx.chain, &policy,
  435. FLOW_BLOCK_BIND);
  436. break;
  437. case NFT_MSG_DELCHAIN:
  438. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  439. continue;
  440. policy = nft_trans_chain_policy(trans);
  441. err = nft_flow_offload_chain(trans->ctx.chain, &policy,
  442. FLOW_BLOCK_UNBIND);
  443. break;
  444. case NFT_MSG_NEWRULE:
  445. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  446. continue;
  447. if (trans->ctx.flags & NLM_F_REPLACE ||
  448. !(trans->ctx.flags & NLM_F_APPEND)) {
  449. err = -EOPNOTSUPP;
  450. break;
  451. }
  452. err = nft_flow_offload_rule(trans->ctx.chain,
  453. nft_trans_rule(trans),
  454. nft_trans_flow_rule(trans),
  455. FLOW_CLS_REPLACE);
  456. break;
  457. case NFT_MSG_DELRULE:
  458. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  459. continue;
  460. err = nft_flow_offload_rule(trans->ctx.chain,
  461. nft_trans_rule(trans),
  462. NULL, FLOW_CLS_DESTROY);
  463. break;
  464. }
  465. if (err) {
  466. nft_flow_rule_offload_abort(net, trans);
  467. break;
  468. }
  469. }
  470. list_for_each_entry(trans, &net->nft.commit_list, list) {
  471. if (trans->ctx.family != NFPROTO_NETDEV)
  472. continue;
  473. switch (trans->msg_type) {
  474. case NFT_MSG_NEWRULE:
  475. case NFT_MSG_DELRULE:
  476. if (!(trans->ctx.chain->flags & NFT_CHAIN_HW_OFFLOAD))
  477. continue;
  478. nft_flow_rule_destroy(nft_trans_flow_rule(trans));
  479. break;
  480. default:
  481. break;
  482. }
  483. }
  484. return err;
  485. }
  486. static struct nft_chain *__nft_offload_get_chain(struct net_device *dev)
  487. {
  488. struct nft_base_chain *basechain;
  489. struct net *net = dev_net(dev);
  490. struct nft_hook *hook, *found;
  491. const struct nft_table *table;
  492. struct nft_chain *chain;
  493. list_for_each_entry(table, &net->nft.tables, list) {
  494. if (table->family != NFPROTO_NETDEV)
  495. continue;
  496. list_for_each_entry(chain, &table->chains, list) {
  497. if (!nft_is_base_chain(chain) ||
  498. !(chain->flags & NFT_CHAIN_HW_OFFLOAD))
  499. continue;
  500. found = NULL;
  501. basechain = nft_base_chain(chain);
  502. list_for_each_entry(hook, &basechain->hook_list, list) {
  503. if (hook->ops.dev != dev)
  504. continue;
  505. found = hook;
  506. break;
  507. }
  508. if (!found)
  509. continue;
  510. return chain;
  511. }
  512. }
  513. return NULL;
  514. }
  515. static int nft_offload_netdev_event(struct notifier_block *this,
  516. unsigned long event, void *ptr)
  517. {
  518. struct net_device *dev = netdev_notifier_info_to_dev(ptr);
  519. struct net *net = dev_net(dev);
  520. struct nft_chain *chain;
  521. if (event != NETDEV_UNREGISTER)
  522. return NOTIFY_DONE;
  523. mutex_lock(&net->nft.commit_mutex);
  524. chain = __nft_offload_get_chain(dev);
  525. if (chain)
  526. nft_flow_block_chain(nft_base_chain(chain), dev,
  527. FLOW_BLOCK_UNBIND);
  528. mutex_unlock(&net->nft.commit_mutex);
  529. return NOTIFY_DONE;
  530. }
  531. static struct notifier_block nft_offload_netdev_notifier = {
  532. .notifier_call = nft_offload_netdev_event,
  533. };
  534. int nft_offload_init(void)
  535. {
  536. return register_netdevice_notifier(&nft_offload_netdev_notifier);
  537. }
  538. void nft_offload_exit(void)
  539. {
  540. unregister_netdevice_notifier(&nft_offload_netdev_notifier);
  541. }