Adding upstream version 1.2.6.upstream/1.2.6upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

68 files changed, 19881 insertions, 0 deletions

diff --git a/src/Makefile.am b/src/Makefile.am
new file mode 100644
index 0000000..3cd259c
--- /dev/null
+++ b/src/Makefile.am
@@ -0,0 +1,73 @@
+include $(top_srcdir)/Make_global.am
+lib_LTLIBRARIES = libnftnl.la
+
+libnftnl_la_LIBADD = ${LIBMNL_LIBS}
+libnftnl_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libnftnl.map	\
+		      -version-info $(LIBVERSION)
+
+libnftnl_la_SOURCES = utils.c		\
+		      batch.c		\
+		      flowtable.c	\
+		      common.c		\
+		      gen.c		\
+		      table.c		\
+		      trace.c		\
+		      chain.c		\
+		      object.c		\
+		      rule.c		\
+		      set.c		\
+		      set_elem.c	\
+		      ruleset.c		\
+		      udata.c		\
+		      expr.c		\
+		      expr_ops.c	\
+		      expr/bitwise.c	\
+		      expr/byteorder.c	\
+		      expr/cmp.c	\
+		      expr/range.c	\
+		      expr/connlimit.c	\
+		      expr/counter.c	\
+		      expr/ct.c		\
+		      expr/data_reg.c	\
+		      expr/dup.c	\
+		      expr/exthdr.c	\
+		      expr/flow_offload.c \
+		      expr/fib.c	\
+		      expr/fwd.c	\
+		      expr/last.c	\
+		      expr/limit.c	\
+		      expr/log.c	\
+		      expr/lookup.c	\
+		      expr/dynset.c	\
+		      expr/immediate.c	\
+		      expr/inner.c	\
+		      expr/match.c	\
+		      expr/meta.c	\
+		      expr/numgen.c	\
+		      expr/nat.c	\
+		      expr/tproxy.c	\
+		      expr/objref.c	\
+		      expr/payload.c	\
+		      expr/queue.c	\
+		      expr/quota.c	\
+		      expr/reject.c	\
+		      expr/rt.c		\
+		      expr/target.c	\
+		      expr/tunnel.c	\
+		      expr/masq.c	\
+		      expr/redir.c	\
+		      expr/hash.c	\
+		      expr/socket.c	\
+		      expr/synproxy.c	\
+		      expr/osf.c	\
+		      expr/xfrm.c	\
+		      obj/counter.c	\
+		      obj/ct_helper.c	\
+		      obj/quota.c	\
+		      obj/tunnel.c	\
+		      obj/limit.c	\
+		      obj/synproxy.c	\
+		      obj/ct_timeout.c 	\
+		      obj/secmark.c	\
+		      obj/ct_expect.c 	\
+		      libnftnl.map
diff --git a/src/Makefile.in b/src/Makefile.in
new file mode 100644
index 0000000..03130f7
--- /dev/null
+++ b/src/Makefile.in
@@ -0,0 +1,1071 @@
+# Makefile.in generated by automake 1.16.3 from Makefile.am.
+# @configure_input@
+
+# Copyright (C) 1994-2020 Free Software Foundation, Inc.
+
+# This Makefile.in is free software; the Free Software Foundation
+# gives unlimited permission to copy and/or distribute it,
+# with or without modifications, as long as this notice is preserved.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
+# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+# PARTICULAR PURPOSE.
+
+@SET_MAKE@
+
+VPATH = @srcdir@
+am__is_gnu_make = { \
+  if test -z '$(MAKELEVEL)'; then \
+    false; \
+  elif test -n '$(MAKE_HOST)'; then \
+    true; \
+  elif test -n '$(MAKE_VERSION)' && test -n '$(CURDIR)'; then \
+    true; \
+  else \
+    false; \
+  fi; \
+}
+am__make_running_with_option = \
+  case $${target_option-} in \
+      ?) ;; \
+      *) echo "am__make_running_with_option: internal error: invalid" \
+              "target option '$${target_option-}' specified" >&2; \
+         exit 1;; \
+  esac; \
+  has_opt=no; \
+  sane_makeflags=$$MAKEFLAGS; \
+  if $(am__is_gnu_make); then \
+    sane_makeflags=$$MFLAGS; \
+  else \
+    case $$MAKEFLAGS in \
+      *\\[\ \	]*) \
+        bs=\\; \
+        sane_makeflags=`printf '%s\n' "$$MAKEFLAGS" \
+          | sed "s/$$bs$$bs[$$bs $$bs	]*//g"`;; \
+    esac; \
+  fi; \
+  skip_next=no; \
+  strip_trailopt () \
+  { \
+    flg=`printf '%s\n' "$$flg" | sed "s/$$1.*$$//"`; \
+  }; \
+  for flg in $$sane_makeflags; do \
+    test $$skip_next = yes && { skip_next=no; continue; }; \
+    case $$flg in \
+      *=*|--*) continue;; \
+        -*I) strip_trailopt 'I'; skip_next=yes;; \
+      -*I?*) strip_trailopt 'I';; \
+        -*O) strip_trailopt 'O'; skip_next=yes;; \
+      -*O?*) strip_trailopt 'O';; \
+        -*l) strip_trailopt 'l'; skip_next=yes;; \
+      -*l?*) strip_trailopt 'l';; \
+      -[dEDm]) skip_next=yes;; \
+      -[JT]) skip_next=yes;; \
+    esac; \
+    case $$flg in \
+      *$$target_option*) has_opt=yes; break;; \
+    esac; \
+  done; \
+  test $$has_opt = yes
+am__make_dryrun = (target_option=n; $(am__make_running_with_option))
+am__make_keepgoing = (target_option=k; $(am__make_running_with_option))
+pkgdatadir = $(datadir)/@PACKAGE@
+pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
+am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
+install_sh_DATA = $(install_sh) -c -m 644
+install_sh_PROGRAM = $(install_sh) -c
+install_sh_SCRIPT = $(install_sh) -c
+INSTALL_HEADER = $(INSTALL_DATA)
+transform = $(program_transform_name)
+NORMAL_INSTALL = :
+PRE_INSTALL = :
+POST_INSTALL = :
+NORMAL_UNINSTALL = :
+PRE_UNINSTALL = :
+POST_UNINSTALL = :
+build_triplet = @build@
+host_triplet = @host@
+subdir = src
+ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
+am__aclocal_m4_deps = $(top_srcdir)/m4/gcc4_visibility.m4 \
+	$(top_srcdir)/m4/libtool.m4 $(top_srcdir)/m4/ltoptions.m4 \
+	$(top_srcdir)/m4/ltsugar.m4 $(top_srcdir)/m4/ltversion.m4 \
+	$(top_srcdir)/m4/lt~obsolete.m4 $(top_srcdir)/configure.ac
+am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
+	$(ACLOCAL_M4)
+DIST_COMMON = $(srcdir)/Makefile.am $(am__DIST_COMMON)
+mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
+CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
+am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
+am__vpath_adj = case $$p in \
+    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
+    *) f=$$p;; \
+  esac;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
+am__uninstall_files_from_dir = { \
+  test -z "$$files" \
+    || { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
+    || { echo " ( cd '$$dir' && rm -f" $$files ")"; \
+         $(am__cd) "$$dir" && rm -f $$files; }; \
+  }
+am__installdirs = "$(DESTDIR)$(libdir)"
+LTLIBRARIES = $(lib_LTLIBRARIES)
+am__DEPENDENCIES_1 =
+libnftnl_la_DEPENDENCIES = $(am__DEPENDENCIES_1)
+am__dirstamp = $(am__leading_dot)dirstamp
+am_libnftnl_la_OBJECTS = utils.lo batch.lo flowtable.lo common.lo \
+	gen.lo table.lo trace.lo chain.lo object.lo rule.lo set.lo \
+	set_elem.lo ruleset.lo udata.lo expr.lo expr_ops.lo \
+	expr/bitwise.lo expr/byteorder.lo expr/cmp.lo expr/range.lo \
+	expr/connlimit.lo expr/counter.lo expr/ct.lo expr/data_reg.lo \
+	expr/dup.lo expr/exthdr.lo expr/flow_offload.lo expr/fib.lo \
+	expr/fwd.lo expr/last.lo expr/limit.lo expr/log.lo \
+	expr/lookup.lo expr/dynset.lo expr/immediate.lo expr/inner.lo \
+	expr/match.lo expr/meta.lo expr/numgen.lo expr/nat.lo \
+	expr/tproxy.lo expr/objref.lo expr/payload.lo expr/queue.lo \
+	expr/quota.lo expr/reject.lo expr/rt.lo expr/target.lo \
+	expr/tunnel.lo expr/masq.lo expr/redir.lo expr/hash.lo \
+	expr/socket.lo expr/synproxy.lo expr/osf.lo expr/xfrm.lo \
+	obj/counter.lo obj/ct_helper.lo obj/quota.lo obj/tunnel.lo \
+	obj/limit.lo obj/synproxy.lo obj/ct_timeout.lo obj/secmark.lo \
+	obj/ct_expect.lo
+libnftnl_la_OBJECTS = $(am_libnftnl_la_OBJECTS)
+AM_V_lt = $(am__v_lt_@AM_V@)
+am__v_lt_ = $(am__v_lt_@AM_DEFAULT_V@)
+am__v_lt_0 = --silent
+am__v_lt_1 = 
+libnftnl_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(libnftnl_la_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_P = $(am__v_P_@AM_V@)
+am__v_P_ = $(am__v_P_@AM_DEFAULT_V@)
+am__v_P_0 = false
+am__v_P_1 = :
+AM_V_GEN = $(am__v_GEN_@AM_V@)
+am__v_GEN_ = $(am__v_GEN_@AM_DEFAULT_V@)
+am__v_GEN_0 = @echo "  GEN     " $@;
+am__v_GEN_1 = 
+AM_V_at = $(am__v_at_@AM_V@)
+am__v_at_ = $(am__v_at_@AM_DEFAULT_V@)
+am__v_at_0 = @
+am__v_at_1 = 
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
+depcomp = $(SHELL) $(top_srcdir)/build-aux/depcomp
+am__maybe_remake_depfiles = depfiles
+am__depfiles_remade = ./$(DEPDIR)/batch.Plo ./$(DEPDIR)/chain.Plo \
+	./$(DEPDIR)/common.Plo ./$(DEPDIR)/expr.Plo \
+	./$(DEPDIR)/expr_ops.Plo ./$(DEPDIR)/flowtable.Plo \
+	./$(DEPDIR)/gen.Plo ./$(DEPDIR)/object.Plo \
+	./$(DEPDIR)/rule.Plo ./$(DEPDIR)/ruleset.Plo \
+	./$(DEPDIR)/set.Plo ./$(DEPDIR)/set_elem.Plo \
+	./$(DEPDIR)/table.Plo ./$(DEPDIR)/trace.Plo \
+	./$(DEPDIR)/udata.Plo ./$(DEPDIR)/utils.Plo \
+	expr/$(DEPDIR)/bitwise.Plo expr/$(DEPDIR)/byteorder.Plo \
+	expr/$(DEPDIR)/cmp.Plo expr/$(DEPDIR)/connlimit.Plo \
+	expr/$(DEPDIR)/counter.Plo expr/$(DEPDIR)/ct.Plo \
+	expr/$(DEPDIR)/data_reg.Plo expr/$(DEPDIR)/dup.Plo \
+	expr/$(DEPDIR)/dynset.Plo expr/$(DEPDIR)/exthdr.Plo \
+	expr/$(DEPDIR)/fib.Plo expr/$(DEPDIR)/flow_offload.Plo \
+	expr/$(DEPDIR)/fwd.Plo expr/$(DEPDIR)/hash.Plo \
+	expr/$(DEPDIR)/immediate.Plo expr/$(DEPDIR)/inner.Plo \
+	expr/$(DEPDIR)/last.Plo expr/$(DEPDIR)/limit.Plo \
+	expr/$(DEPDIR)/log.Plo expr/$(DEPDIR)/lookup.Plo \
+	expr/$(DEPDIR)/masq.Plo expr/$(DEPDIR)/match.Plo \
+	expr/$(DEPDIR)/meta.Plo expr/$(DEPDIR)/nat.Plo \
+	expr/$(DEPDIR)/numgen.Plo expr/$(DEPDIR)/objref.Plo \
+	expr/$(DEPDIR)/osf.Plo expr/$(DEPDIR)/payload.Plo \
+	expr/$(DEPDIR)/queue.Plo expr/$(DEPDIR)/quota.Plo \
+	expr/$(DEPDIR)/range.Plo expr/$(DEPDIR)/redir.Plo \
+	expr/$(DEPDIR)/reject.Plo expr/$(DEPDIR)/rt.Plo \
+	expr/$(DEPDIR)/socket.Plo expr/$(DEPDIR)/synproxy.Plo \
+	expr/$(DEPDIR)/target.Plo expr/$(DEPDIR)/tproxy.Plo \
+	expr/$(DEPDIR)/tunnel.Plo expr/$(DEPDIR)/xfrm.Plo \
+	obj/$(DEPDIR)/counter.Plo obj/$(DEPDIR)/ct_expect.Plo \
+	obj/$(DEPDIR)/ct_helper.Plo obj/$(DEPDIR)/ct_timeout.Plo \
+	obj/$(DEPDIR)/limit.Plo obj/$(DEPDIR)/quota.Plo \
+	obj/$(DEPDIR)/secmark.Plo obj/$(DEPDIR)/synproxy.Plo \
+	obj/$(DEPDIR)/tunnel.Plo
+am__mv = mv -f
+COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
+	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
+LTCOMPILE = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) \
+	$(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) \
+	$(AM_CFLAGS) $(CFLAGS)
+AM_V_CC = $(am__v_CC_@AM_V@)
+am__v_CC_ = $(am__v_CC_@AM_DEFAULT_V@)
+am__v_CC_0 = @echo "  CC      " $@;
+am__v_CC_1 = 
+CCLD = $(CC)
+LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) \
+	$(AM_LDFLAGS) $(LDFLAGS) -o $@
+AM_V_CCLD = $(am__v_CCLD_@AM_V@)
+am__v_CCLD_ = $(am__v_CCLD_@AM_DEFAULT_V@)
+am__v_CCLD_0 = @echo "  CCLD    " $@;
+am__v_CCLD_1 = 
+SOURCES = $(libnftnl_la_SOURCES)
+DIST_SOURCES = $(libnftnl_la_SOURCES)
+am__can_run_installinfo = \
+  case $$AM_UPDATE_INFO_DIR in \
+    n|no|NO) false;; \
+    *) (install-info --version) >/dev/null 2>&1;; \
+  esac
+am__tagged_files = $(HEADERS) $(SOURCES) $(TAGS_FILES) $(LISP)
+# Read a list of newline-separated strings from the standard input,
+# and print each of them once, without duplicates.  Input order is
+# *not* preserved.
+am__uniquify_input = $(AWK) '\
+  BEGIN { nonempty = 0; } \
+  { items[$$0] = 1; nonempty = 1; } \
+  END { if (nonempty) { for (i in items) print i; }; } \
+'
+# Make sure the list of sources is unique.  This is necessary because,
+# e.g., the same source file might be shared among _SOURCES variables
+# for different programs/libraries.
+am__define_uniq_tagged_files = \
+  list='$(am__tagged_files)'; \
+  unique=`for i in $$list; do \
+    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
+  done | $(am__uniquify_input)`
+ETAGS = etags
+CTAGS = ctags
+am__DIST_COMMON = $(srcdir)/Makefile.in $(top_srcdir)/Make_global.am \
+	$(top_srcdir)/build-aux/depcomp
+DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
+ACLOCAL = @ACLOCAL@
+AMTAR = @AMTAR@
+AM_DEFAULT_VERBOSITY = @AM_DEFAULT_VERBOSITY@
+AR = @AR@
+AUTOCONF = @AUTOCONF@
+AUTOHEADER = @AUTOHEADER@
+AUTOMAKE = @AUTOMAKE@
+AWK = @AWK@
+CC = @CC@
+CCDEPMODE = @CCDEPMODE@
+CFLAGS = @CFLAGS@
+CPP = @CPP@
+CPPFLAGS = @CPPFLAGS@
+CYGPATH_W = @CYGPATH_W@
+DEFS = @DEFS@
+DEPDIR = @DEPDIR@
+DLLTOOL = @DLLTOOL@
+DSYMUTIL = @DSYMUTIL@
+DUMPBIN = @DUMPBIN@
+ECHO_C = @ECHO_C@
+ECHO_N = @ECHO_N@
+ECHO_T = @ECHO_T@
+EGREP = @EGREP@
+EXEEXT = @EXEEXT@
+FGREP = @FGREP@
+GCC_FVISIBILITY_HIDDEN = @GCC_FVISIBILITY_HIDDEN@
+GREP = @GREP@
+INSTALL = @INSTALL@
+INSTALL_DATA = @INSTALL_DATA@
+INSTALL_PROGRAM = @INSTALL_PROGRAM@
+INSTALL_SCRIPT = @INSTALL_SCRIPT@
+INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
+LD = @LD@
+LDFLAGS = @LDFLAGS@
+LIBMNL_CFLAGS = @LIBMNL_CFLAGS@
+LIBMNL_LIBS = @LIBMNL_LIBS@
+LIBOBJS = @LIBOBJS@
+LIBS = @LIBS@
+LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
+LN_S = @LN_S@
+LTLIBOBJS = @LTLIBOBJS@
+LT_SYS_LIBRARY_PATH = @LT_SYS_LIBRARY_PATH@
+MAKEINFO = @MAKEINFO@
+MANIFEST_TOOL = @MANIFEST_TOOL@
+MKDIR_P = @MKDIR_P@
+NM = @NM@
+NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
+OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
+PACKAGE = @PACKAGE@
+PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
+PACKAGE_NAME = @PACKAGE_NAME@
+PACKAGE_STRING = @PACKAGE_STRING@
+PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
+PACKAGE_VERSION = @PACKAGE_VERSION@
+PATH_SEPARATOR = @PATH_SEPARATOR@
+PKG_CONFIG = @PKG_CONFIG@
+PKG_CONFIG_LIBDIR = @PKG_CONFIG_LIBDIR@
+PKG_CONFIG_PATH = @PKG_CONFIG_PATH@
+RANLIB = @RANLIB@
+SED = @SED@
+SET_MAKE = @SET_MAKE@
+SHELL = @SHELL@
+STRIP = @STRIP@
+VERSION = @VERSION@
+abs_builddir = @abs_builddir@
+abs_srcdir = @abs_srcdir@
+abs_top_builddir = @abs_top_builddir@
+abs_top_srcdir = @abs_top_srcdir@
+ac_ct_AR = @ac_ct_AR@
+ac_ct_CC = @ac_ct_CC@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
+am__include = @am__include@
+am__leading_dot = @am__leading_dot@
+am__quote = @am__quote@
+am__tar = @am__tar@
+am__untar = @am__untar@
+bindir = @bindir@
+build = @build@
+build_alias = @build_alias@
+build_cpu = @build_cpu@
+build_os = @build_os@
+build_vendor = @build_vendor@
+builddir = @builddir@
+datadir = @datadir@
+datarootdir = @datarootdir@
+docdir = @docdir@
+dvidir = @dvidir@
+exec_prefix = @exec_prefix@
+host = @host@
+host_alias = @host_alias@
+host_cpu = @host_cpu@
+host_os = @host_os@
+host_vendor = @host_vendor@
+htmldir = @htmldir@
+includedir = @includedir@
+infodir = @infodir@
+install_sh = @install_sh@
+libdir = @libdir@
+libexecdir = @libexecdir@
+localedir = @localedir@
+localstatedir = @localstatedir@
+mandir = @mandir@
+mkdir_p = @mkdir_p@
+oldincludedir = @oldincludedir@
+pdfdir = @pdfdir@
+prefix = @prefix@
+program_transform_name = @program_transform_name@
+psdir = @psdir@
+regular_CFLAGS = @regular_CFLAGS@
+regular_CPPFLAGS = @regular_CPPFLAGS@
+runstatedir = @runstatedir@
+sbindir = @sbindir@
+sharedstatedir = @sharedstatedir@
+srcdir = @srcdir@
+sysconfdir = @sysconfdir@
+target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
+top_builddir = @top_builddir@
+top_srcdir = @top_srcdir@
+
+# This is _NOT_ the library release version, it's an API version.
+# Extracted from Chapter 6 "Library interface versions" of the libtool docs.
+#
+# <snippet>
+# Here are a set of rules to help you update your library version information:
+#
+# 1. Start with version information of `0:0:0' for each libtool library.
+# 2. Update the version information only immediately before a public release
+# of your software. More frequent updates are unnecessary, and only guarantee
+# that the current interface number gets larger faster.
+# 3. If the library source code has changed at all since the last update,
+# then increment revision (`c:r:a' becomes `c:r+1:a').
+# 4. If any interfaces have been added, removed, or changed since the last
+# update, increment current, and set revision to 0.
+# 5. If any interfaces have been added since the last public release, then
+# increment age.
+# 6. If any interfaces have been removed since the last public release, then
+# set age to 0.
+# </snippet>
+#
+LIBVERSION = 17:0:6
+AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_srcdir}/include ${LIBMNL_CFLAGS} ${LIBMXML_CFLAGS}
+AM_CFLAGS = ${regular_CFLAGS} ${GCC_FVISIBILITY_HIDDEN}
+lib_LTLIBRARIES = libnftnl.la
+libnftnl_la_LIBADD = ${LIBMNL_LIBS}
+libnftnl_la_LDFLAGS = -Wl,--version-script=$(srcdir)/libnftnl.map	\
+		      -version-info $(LIBVERSION)
+
+libnftnl_la_SOURCES = utils.c		\
+		      batch.c		\
+		      flowtable.c	\
+		      common.c		\
+		      gen.c		\
+		      table.c		\
+		      trace.c		\
+		      chain.c		\
+		      object.c		\
+		      rule.c		\
+		      set.c		\
+		      set_elem.c	\
+		      ruleset.c		\
+		      udata.c		\
+		      expr.c		\
+		      expr_ops.c	\
+		      expr/bitwise.c	\
+		      expr/byteorder.c	\
+		      expr/cmp.c	\
+		      expr/range.c	\
+		      expr/connlimit.c	\
+		      expr/counter.c	\
+		      expr/ct.c		\
+		      expr/data_reg.c	\
+		      expr/dup.c	\
+		      expr/exthdr.c	\
+		      expr/flow_offload.c \
+		      expr/fib.c	\
+		      expr/fwd.c	\
+		      expr/last.c	\
+		      expr/limit.c	\
+		      expr/log.c	\
+		      expr/lookup.c	\
+		      expr/dynset.c	\
+		      expr/immediate.c	\
+		      expr/inner.c	\
+		      expr/match.c	\
+		      expr/meta.c	\
+		      expr/numgen.c	\
+		      expr/nat.c	\
+		      expr/tproxy.c	\
+		      expr/objref.c	\
+		      expr/payload.c	\
+		      expr/queue.c	\
+		      expr/quota.c	\
+		      expr/reject.c	\
+		      expr/rt.c		\
+		      expr/target.c	\
+		      expr/tunnel.c	\
+		      expr/masq.c	\
+		      expr/redir.c	\
+		      expr/hash.c	\
+		      expr/socket.c	\
+		      expr/synproxy.c	\
+		      expr/osf.c	\
+		      expr/xfrm.c	\
+		      obj/counter.c	\
+		      obj/ct_helper.c	\
+		      obj/quota.c	\
+		      obj/tunnel.c	\
+		      obj/limit.c	\
+		      obj/synproxy.c	\
+		      obj/ct_timeout.c 	\
+		      obj/secmark.c	\
+		      obj/ct_expect.c 	\
+		      libnftnl.map
+
+all: all-am
+
+.SUFFIXES:
+.SUFFIXES: .c .lo .o .obj
+$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am $(top_srcdir)/Make_global.am $(am__configure_deps)
+	@for dep in $?; do \
+	  case '$(am__configure_deps)' in \
+	    *$$dep*) \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
+	      exit 1;; \
+	  esac; \
+	done; \
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign src/Makefile
+Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
+	@case '$?' in \
+	  *config.status*) \
+	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
+	  *) \
+	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles)'; \
+	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__maybe_remake_depfiles);; \
+	esac;
+$(top_srcdir)/Make_global.am $(am__empty):
+
+$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+
+$(top_srcdir)/configure:  $(am__configure_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
+	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
+
+install-libLTLIBRARIES: $(lib_LTLIBRARIES)
+	@$(NORMAL_INSTALL)
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	list2=; for p in $$list; do \
+	  if test -f $$p; then \
+	    list2="$$list2 $$p"; \
+	  else :; fi; \
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(MKDIR_P) '$(DESTDIR)$(libdir)'"; \
+	  $(MKDIR_P) "$(DESTDIR)$(libdir)" || exit 1; \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \
+	}
+
+uninstall-libLTLIBRARIES:
+	@$(NORMAL_UNINSTALL)
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \
+	done
+
+clean-libLTLIBRARIES:
+	-test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES)
+	@list='$(lib_LTLIBRARIES)'; \
+	locs=`for p in $$list; do echo $$p; done | \
+	      sed 's|^[^/]*$$|.|; s|/[^/]*$$||; s|$$|/so_locations|' | \
+	      sort -u`; \
+	test -z "$$locs" || { \
+	  echo rm -f $${locs}; \
+	  rm -f $${locs}; \
+	}
+expr/$(am__dirstamp):
+	@$(MKDIR_P) expr
+	@: > expr/$(am__dirstamp)
+expr/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) expr/$(DEPDIR)
+	@: > expr/$(DEPDIR)/$(am__dirstamp)
+expr/bitwise.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/byteorder.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/cmp.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/range.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/connlimit.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/counter.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/ct.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/data_reg.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/dup.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/exthdr.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/flow_offload.lo: expr/$(am__dirstamp) \
+	expr/$(DEPDIR)/$(am__dirstamp)
+expr/fib.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/fwd.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/last.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/limit.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/log.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/lookup.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/dynset.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/immediate.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/inner.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/match.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/meta.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/numgen.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/nat.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/tproxy.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/objref.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/payload.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/queue.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/quota.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/reject.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/rt.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/target.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/tunnel.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/masq.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/redir.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/hash.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/socket.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/synproxy.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/osf.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+expr/xfrm.lo: expr/$(am__dirstamp) expr/$(DEPDIR)/$(am__dirstamp)
+obj/$(am__dirstamp):
+	@$(MKDIR_P) obj
+	@: > obj/$(am__dirstamp)
+obj/$(DEPDIR)/$(am__dirstamp):
+	@$(MKDIR_P) obj/$(DEPDIR)
+	@: > obj/$(DEPDIR)/$(am__dirstamp)
+obj/counter.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/ct_helper.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/quota.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/tunnel.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/limit.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/synproxy.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/ct_timeout.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/secmark.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+obj/ct_expect.lo: obj/$(am__dirstamp) obj/$(DEPDIR)/$(am__dirstamp)
+
+libnftnl.la: $(libnftnl_la_OBJECTS) $(libnftnl_la_DEPENDENCIES) $(EXTRA_libnftnl_la_DEPENDENCIES) 
+	$(AM_V_CCLD)$(libnftnl_la_LINK) -rpath $(libdir) $(libnftnl_la_OBJECTS) $(libnftnl_la_LIBADD) $(LIBS)
+
+mostlyclean-compile:
+	-rm -f *.$(OBJEXT)
+	-rm -f expr/*.$(OBJEXT)
+	-rm -f expr/*.lo
+	-rm -f obj/*.$(OBJEXT)
+	-rm -f obj/*.lo
+
+distclean-compile:
+	-rm -f *.tab.c
+
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/batch.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/chain.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/common.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/expr.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/expr_ops.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/flowtable.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gen.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/object.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rule.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ruleset.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/set.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/set_elem.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/table.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/trace.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/udata.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/utils.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/bitwise.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/byteorder.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/cmp.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/connlimit.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/counter.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/ct.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/data_reg.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/dup.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/dynset.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/exthdr.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/fib.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/flow_offload.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/fwd.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/hash.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/immediate.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/inner.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/last.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/limit.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/log.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/lookup.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/masq.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/match.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/meta.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/nat.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/numgen.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/objref.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/osf.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/payload.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/queue.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/quota.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/range.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/redir.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/reject.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/rt.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/socket.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/synproxy.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/target.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/tproxy.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/tunnel.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@expr/$(DEPDIR)/xfrm.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/counter.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/ct_expect.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/ct_helper.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/ct_timeout.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/limit.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/quota.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/secmark.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/synproxy.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@obj/$(DEPDIR)/tunnel.Plo@am__quote@ # am--include-marker
+
+$(am__depfiles_remade):
+	@$(MKDIR_P) $(@D)
+	@echo '# dummy' >$@-t && $(am__mv) $@-t $@
+
+am--depfiles: $(am__depfiles_remade)
+
+.c.o:
+@am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.o$$||'`;\
+@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
+@am__fastdepCC_TRUE@	$(am__mv) $$depbase.Tpo $$depbase.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ $<
+
+.c.obj:
+@am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.obj$$||'`;\
+@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ `$(CYGPATH_W) '$<'` &&\
+@am__fastdepCC_TRUE@	$(am__mv) $$depbase.Tpo $$depbase.Po
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(COMPILE) -c -o $@ `$(CYGPATH_W) '$<'`
+
+.c.lo:
+@am__fastdepCC_TRUE@	$(AM_V_CC)depbase=`echo $@ | sed 's|[^/]*$$|$(DEPDIR)/&|;s|\.lo$$||'`;\
+@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $$depbase.Tpo -c -o $@ $< &&\
+@am__fastdepCC_TRUE@	$(am__mv) $$depbase.Tpo $$depbase.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LTCOMPILE) -c -o $@ $<
+
+mostlyclean-libtool:
+	-rm -f *.lo
+
+clean-libtool:
+	-rm -rf .libs _libs
+	-rm -rf expr/.libs expr/_libs
+	-rm -rf obj/.libs obj/_libs
+
+ID: $(am__tagged_files)
+	$(am__define_uniq_tagged_files); mkid -fID $$unique
+tags: tags-am
+TAGS: tags
+
+tags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	set x; \
+	here=`pwd`; \
+	$(am__define_uniq_tagged_files); \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
+	  test -n "$$unique" || unique=$$empty_fix; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
+	fi
+ctags: ctags-am
+
+CTAGS: ctags
+ctags-am: $(TAGS_DEPENDENCIES) $(am__tagged_files)
+	$(am__define_uniq_tagged_files); \
+	test -z "$(CTAGS_ARGS)$$unique" \
+	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
+	     $$unique
+
+GTAGS:
+	here=`$(am__cd) $(top_builddir) && pwd` \
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
+cscopelist: cscopelist-am
+
+cscopelist-am: $(am__tagged_files)
+	list='$(am__tagged_files)'; \
+	case "$(srcdir)" in \
+	  [\\/]* | ?:[\\/]*) sdir="$(srcdir)" ;; \
+	  *) sdir=$(subdir)/$(srcdir) ;; \
+	esac; \
+	for i in $$list; do \
+	  if test -f "$$i"; then \
+	    echo "$(subdir)/$$i"; \
+	  else \
+	    echo "$$sdir/$$i"; \
+	  fi; \
+	done >> $(top_builddir)/cscope.files
+
+distclean-tags:
+	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
+
+distdir: $(BUILT_SOURCES)
+	$(MAKE) $(AM_MAKEFLAGS) distdir-am
+
+distdir-am: $(DISTFILES)
+	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
+	list='$(DISTFILES)'; \
+	  dist_files=`for file in $$list; do echo $$file; done | \
+	  sed -e "s|^$$srcdirstrip/||;t" \
+	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
+	case $$dist_files in \
+	  */*) $(MKDIR_P) `echo "$$dist_files" | \
+			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
+			   sort -u` ;; \
+	esac; \
+	for file in $$dist_files; do \
+	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
+	  if test -d $$d/$$file; then \
+	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
+	  else \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
+	    || exit 1; \
+	  fi; \
+	done
+check-am: all-am
+check: check-am
+all-am: Makefile $(LTLIBRARIES)
+installdirs:
+	for dir in "$(DESTDIR)$(libdir)"; do \
+	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
+	done
+install: install-am
+install-exec: install-exec-am
+install-data: install-data-am
+uninstall: uninstall-am
+
+install-am: all-am
+	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
+
+installcheck: installcheck-am
+install-strip:
+	if test -z '$(STRIP)'; then \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	      install; \
+	else \
+	  $(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
+	    install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
+	    "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
+	fi
+mostlyclean-generic:
+
+clean-generic:
+
+distclean-generic:
+	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
+	-rm -f expr/$(DEPDIR)/$(am__dirstamp)
+	-rm -f expr/$(am__dirstamp)
+	-rm -f obj/$(DEPDIR)/$(am__dirstamp)
+	-rm -f obj/$(am__dirstamp)
+
+maintainer-clean-generic:
+	@echo "This command is intended for maintainers to use"
+	@echo "it deletes files that may require special tools to rebuild."
+clean: clean-am
+
+clean-am: clean-generic clean-libLTLIBRARIES clean-libtool \
+	mostlyclean-am
+
+distclean: distclean-am
+		-rm -f ./$(DEPDIR)/batch.Plo
+	-rm -f ./$(DEPDIR)/chain.Plo
+	-rm -f ./$(DEPDIR)/common.Plo
+	-rm -f ./$(DEPDIR)/expr.Plo
+	-rm -f ./$(DEPDIR)/expr_ops.Plo
+	-rm -f ./$(DEPDIR)/flowtable.Plo
+	-rm -f ./$(DEPDIR)/gen.Plo
+	-rm -f ./$(DEPDIR)/object.Plo
+	-rm -f ./$(DEPDIR)/rule.Plo
+	-rm -f ./$(DEPDIR)/ruleset.Plo
+	-rm -f ./$(DEPDIR)/set.Plo
+	-rm -f ./$(DEPDIR)/set_elem.Plo
+	-rm -f ./$(DEPDIR)/table.Plo
+	-rm -f ./$(DEPDIR)/trace.Plo
+	-rm -f ./$(DEPDIR)/udata.Plo
+	-rm -f ./$(DEPDIR)/utils.Plo
+	-rm -f expr/$(DEPDIR)/bitwise.Plo
+	-rm -f expr/$(DEPDIR)/byteorder.Plo
+	-rm -f expr/$(DEPDIR)/cmp.Plo
+	-rm -f expr/$(DEPDIR)/connlimit.Plo
+	-rm -f expr/$(DEPDIR)/counter.Plo
+	-rm -f expr/$(DEPDIR)/ct.Plo
+	-rm -f expr/$(DEPDIR)/data_reg.Plo
+	-rm -f expr/$(DEPDIR)/dup.Plo
+	-rm -f expr/$(DEPDIR)/dynset.Plo
+	-rm -f expr/$(DEPDIR)/exthdr.Plo
+	-rm -f expr/$(DEPDIR)/fib.Plo
+	-rm -f expr/$(DEPDIR)/flow_offload.Plo
+	-rm -f expr/$(DEPDIR)/fwd.Plo
+	-rm -f expr/$(DEPDIR)/hash.Plo
+	-rm -f expr/$(DEPDIR)/immediate.Plo
+	-rm -f expr/$(DEPDIR)/inner.Plo
+	-rm -f expr/$(DEPDIR)/last.Plo
+	-rm -f expr/$(DEPDIR)/limit.Plo
+	-rm -f expr/$(DEPDIR)/log.Plo
+	-rm -f expr/$(DEPDIR)/lookup.Plo
+	-rm -f expr/$(DEPDIR)/masq.Plo
+	-rm -f expr/$(DEPDIR)/match.Plo
+	-rm -f expr/$(DEPDIR)/meta.Plo
+	-rm -f expr/$(DEPDIR)/nat.Plo
+	-rm -f expr/$(DEPDIR)/numgen.Plo
+	-rm -f expr/$(DEPDIR)/objref.Plo
+	-rm -f expr/$(DEPDIR)/osf.Plo
+	-rm -f expr/$(DEPDIR)/payload.Plo
+	-rm -f expr/$(DEPDIR)/queue.Plo
+	-rm -f expr/$(DEPDIR)/quota.Plo
+	-rm -f expr/$(DEPDIR)/range.Plo
+	-rm -f expr/$(DEPDIR)/redir.Plo
+	-rm -f expr/$(DEPDIR)/reject.Plo
+	-rm -f expr/$(DEPDIR)/rt.Plo
+	-rm -f expr/$(DEPDIR)/socket.Plo
+	-rm -f expr/$(DEPDIR)/synproxy.Plo
+	-rm -f expr/$(DEPDIR)/target.Plo
+	-rm -f expr/$(DEPDIR)/tproxy.Plo
+	-rm -f expr/$(DEPDIR)/tunnel.Plo
+	-rm -f expr/$(DEPDIR)/xfrm.Plo
+	-rm -f obj/$(DEPDIR)/counter.Plo
+	-rm -f obj/$(DEPDIR)/ct_expect.Plo
+	-rm -f obj/$(DEPDIR)/ct_helper.Plo
+	-rm -f obj/$(DEPDIR)/ct_timeout.Plo
+	-rm -f obj/$(DEPDIR)/limit.Plo
+	-rm -f obj/$(DEPDIR)/quota.Plo
+	-rm -f obj/$(DEPDIR)/secmark.Plo
+	-rm -f obj/$(DEPDIR)/synproxy.Plo
+	-rm -f obj/$(DEPDIR)/tunnel.Plo
+	-rm -f Makefile
+distclean-am: clean-am distclean-compile distclean-generic \
+	distclean-tags
+
+dvi: dvi-am
+
+dvi-am:
+
+html: html-am
+
+html-am:
+
+info: info-am
+
+info-am:
+
+install-data-am:
+
+install-dvi: install-dvi-am
+
+install-dvi-am:
+
+install-exec-am: install-libLTLIBRARIES
+
+install-html: install-html-am
+
+install-html-am:
+
+install-info: install-info-am
+
+install-info-am:
+
+install-man:
+
+install-pdf: install-pdf-am
+
+install-pdf-am:
+
+install-ps: install-ps-am
+
+install-ps-am:
+
+installcheck-am:
+
+maintainer-clean: maintainer-clean-am
+		-rm -f ./$(DEPDIR)/batch.Plo
+	-rm -f ./$(DEPDIR)/chain.Plo
+	-rm -f ./$(DEPDIR)/common.Plo
+	-rm -f ./$(DEPDIR)/expr.Plo
+	-rm -f ./$(DEPDIR)/expr_ops.Plo
+	-rm -f ./$(DEPDIR)/flowtable.Plo
+	-rm -f ./$(DEPDIR)/gen.Plo
+	-rm -f ./$(DEPDIR)/object.Plo
+	-rm -f ./$(DEPDIR)/rule.Plo
+	-rm -f ./$(DEPDIR)/ruleset.Plo
+	-rm -f ./$(DEPDIR)/set.Plo
+	-rm -f ./$(DEPDIR)/set_elem.Plo
+	-rm -f ./$(DEPDIR)/table.Plo
+	-rm -f ./$(DEPDIR)/trace.Plo
+	-rm -f ./$(DEPDIR)/udata.Plo
+	-rm -f ./$(DEPDIR)/utils.Plo
+	-rm -f expr/$(DEPDIR)/bitwise.Plo
+	-rm -f expr/$(DEPDIR)/byteorder.Plo
+	-rm -f expr/$(DEPDIR)/cmp.Plo
+	-rm -f expr/$(DEPDIR)/connlimit.Plo
+	-rm -f expr/$(DEPDIR)/counter.Plo
+	-rm -f expr/$(DEPDIR)/ct.Plo
+	-rm -f expr/$(DEPDIR)/data_reg.Plo
+	-rm -f expr/$(DEPDIR)/dup.Plo
+	-rm -f expr/$(DEPDIR)/dynset.Plo
+	-rm -f expr/$(DEPDIR)/exthdr.Plo
+	-rm -f expr/$(DEPDIR)/fib.Plo
+	-rm -f expr/$(DEPDIR)/flow_offload.Plo
+	-rm -f expr/$(DEPDIR)/fwd.Plo
+	-rm -f expr/$(DEPDIR)/hash.Plo
+	-rm -f expr/$(DEPDIR)/immediate.Plo
+	-rm -f expr/$(DEPDIR)/inner.Plo
+	-rm -f expr/$(DEPDIR)/last.Plo
+	-rm -f expr/$(DEPDIR)/limit.Plo
+	-rm -f expr/$(DEPDIR)/log.Plo
+	-rm -f expr/$(DEPDIR)/lookup.Plo
+	-rm -f expr/$(DEPDIR)/masq.Plo
+	-rm -f expr/$(DEPDIR)/match.Plo
+	-rm -f expr/$(DEPDIR)/meta.Plo
+	-rm -f expr/$(DEPDIR)/nat.Plo
+	-rm -f expr/$(DEPDIR)/numgen.Plo
+	-rm -f expr/$(DEPDIR)/objref.Plo
+	-rm -f expr/$(DEPDIR)/osf.Plo
+	-rm -f expr/$(DEPDIR)/payload.Plo
+	-rm -f expr/$(DEPDIR)/queue.Plo
+	-rm -f expr/$(DEPDIR)/quota.Plo
+	-rm -f expr/$(DEPDIR)/range.Plo
+	-rm -f expr/$(DEPDIR)/redir.Plo
+	-rm -f expr/$(DEPDIR)/reject.Plo
+	-rm -f expr/$(DEPDIR)/rt.Plo
+	-rm -f expr/$(DEPDIR)/socket.Plo
+	-rm -f expr/$(DEPDIR)/synproxy.Plo
+	-rm -f expr/$(DEPDIR)/target.Plo
+	-rm -f expr/$(DEPDIR)/tproxy.Plo
+	-rm -f expr/$(DEPDIR)/tunnel.Plo
+	-rm -f expr/$(DEPDIR)/xfrm.Plo
+	-rm -f obj/$(DEPDIR)/counter.Plo
+	-rm -f obj/$(DEPDIR)/ct_expect.Plo
+	-rm -f obj/$(DEPDIR)/ct_helper.Plo
+	-rm -f obj/$(DEPDIR)/ct_timeout.Plo
+	-rm -f obj/$(DEPDIR)/limit.Plo
+	-rm -f obj/$(DEPDIR)/quota.Plo
+	-rm -f obj/$(DEPDIR)/secmark.Plo
+	-rm -f obj/$(DEPDIR)/synproxy.Plo
+	-rm -f obj/$(DEPDIR)/tunnel.Plo
+	-rm -f Makefile
+maintainer-clean-am: distclean-am maintainer-clean-generic
+
+mostlyclean: mostlyclean-am
+
+mostlyclean-am: mostlyclean-compile mostlyclean-generic \
+	mostlyclean-libtool
+
+pdf: pdf-am
+
+pdf-am:
+
+ps: ps-am
+
+ps-am:
+
+uninstall-am: uninstall-libLTLIBRARIES
+
+.MAKE: install-am install-strip
+
+.PHONY: CTAGS GTAGS TAGS all all-am am--depfiles check check-am clean \
+	clean-generic clean-libLTLIBRARIES clean-libtool cscopelist-am \
+	ctags ctags-am distclean distclean-compile distclean-generic \
+	distclean-libtool distclean-tags distdir dvi dvi-am html \
+	html-am info info-am install install-am install-data \
+	install-data-am install-dvi install-dvi-am install-exec \
+	install-exec-am install-html install-html-am install-info \
+	install-info-am install-libLTLIBRARIES install-man install-pdf \
+	install-pdf-am install-ps install-ps-am install-strip \
+	installcheck installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-compile \
+	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+	tags tags-am uninstall uninstall-am uninstall-libLTLIBRARIES
+
+.PRECIOUS: Makefile
+
+
+# Tell versions [3.59,3.63) of GNU make to not export all variables.
+# Otherwise a system limit (for SysV at least) may be exceeded.
+.NOEXPORT:
diff --git a/src/batch.c b/src/batch.c
new file mode 100644
index 0000000..8a9c6f9
--- /dev/null
+++ b/src/batch.c
@@ -0,0 +1,164 @@
+/*
+ * Copyright (c) 2013-2015 Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "internal.h"
+#include <errno.h>
+#include <libmnl/libmnl.h>
+#include <libnftnl/batch.h>
+
+struct nftnl_batch {
+	uint32_t		num_pages;
+	struct nftnl_batch_page	*current_page;
+	uint32_t		page_size;
+	uint32_t		page_overrun_size;
+	struct list_head	page_list;
+};
+
+struct nftnl_batch_page {
+	struct list_head	head;
+	struct mnl_nlmsg_batch	*batch;
+};
+
+static struct nftnl_batch_page *nftnl_batch_page_alloc(struct nftnl_batch *batch)
+{
+	struct nftnl_batch_page *page;
+	char *buf;
+
+	page = malloc(sizeof(struct nftnl_batch_page));
+	if (page == NULL)
+		return NULL;
+
+	buf = malloc(batch->page_size + batch->page_overrun_size);
+	if (buf == NULL)
+		goto err1;
+
+	page->batch = mnl_nlmsg_batch_start(buf, batch->page_size);
+	if (page->batch == NULL)
+		goto err2;
+
+	return page;
+err2:
+	free(buf);
+err1:
+	free(page);
+	return NULL;
+}
+
+static void nftnl_batch_add_page(struct nftnl_batch_page *page,
+			       struct nftnl_batch *batch)
+{
+	batch->current_page = page;
+	batch->num_pages++;
+	list_add_tail(&page->head, &batch->page_list);
+}
+
+EXPORT_SYMBOL(nftnl_batch_alloc);
+struct nftnl_batch *nftnl_batch_alloc(uint32_t pg_size, uint32_t pg_overrun_size)
+{
+	struct nftnl_batch *batch;
+	struct nftnl_batch_page *page;
+
+	batch = calloc(1, sizeof(struct nftnl_batch));
+	if (batch == NULL)
+		return NULL;
+
+	batch->page_size = pg_size;
+	batch->page_overrun_size = pg_overrun_size;
+	INIT_LIST_HEAD(&batch->page_list);
+
+	page = nftnl_batch_page_alloc(batch);
+	if (page == NULL)
+		goto err1;
+
+	nftnl_batch_add_page(page, batch);
+	return batch;
+err1:
+	free(batch);
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_batch_free);
+void nftnl_batch_free(struct nftnl_batch *batch)
+{
+	struct nftnl_batch_page *page, *next;
+
+	list_for_each_entry_safe(page, next, &batch->page_list, head) {
+		free(mnl_nlmsg_batch_head(page->batch));
+		mnl_nlmsg_batch_stop(page->batch);
+		free(page);
+	}
+
+	free(batch);
+}
+
+EXPORT_SYMBOL(nftnl_batch_update);
+int nftnl_batch_update(struct nftnl_batch *batch)
+{
+	struct nftnl_batch_page *page;
+	struct nlmsghdr *last_nlh;
+
+	if (mnl_nlmsg_batch_next(batch->current_page->batch))
+		return 0;
+
+	last_nlh = nftnl_batch_buffer(batch);
+
+	page = nftnl_batch_page_alloc(batch);
+	if (page == NULL)
+		goto err1;
+
+	nftnl_batch_add_page(page, batch);
+
+	memcpy(nftnl_batch_buffer(batch), last_nlh, last_nlh->nlmsg_len);
+	mnl_nlmsg_batch_next(batch->current_page->batch);
+
+	return 0;
+err1:
+	return -1;
+}
+
+EXPORT_SYMBOL(nftnl_batch_buffer);
+void *nftnl_batch_buffer(struct nftnl_batch *batch)
+{
+	return mnl_nlmsg_batch_current(batch->current_page->batch);
+}
+
+EXPORT_SYMBOL(nftnl_batch_buffer_len);
+uint32_t nftnl_batch_buffer_len(struct nftnl_batch *batch)
+{
+	return mnl_nlmsg_batch_size(batch->current_page->batch);
+}
+
+EXPORT_SYMBOL(nftnl_batch_iovec_len);
+int nftnl_batch_iovec_len(struct nftnl_batch *batch)
+{
+	int num_pages = batch->num_pages;
+
+	/* Skip last page if it's empty */
+	if (mnl_nlmsg_batch_is_empty(batch->current_page->batch))
+		num_pages--;
+
+	return num_pages;
+}
+
+EXPORT_SYMBOL(nftnl_batch_iovec);
+void nftnl_batch_iovec(struct nftnl_batch *batch, struct iovec *iov,
+		       uint32_t iovlen)
+{
+	struct nftnl_batch_page *page;
+	int i = 0;
+
+	list_for_each_entry(page, &batch->page_list, head) {
+		if (i >= iovlen)
+			break;
+
+		iov[i].iov_base = mnl_nlmsg_batch_head(page->batch);
+		iov[i].iov_len = mnl_nlmsg_batch_size(page->batch);
+		i++;
+	}
+}
diff --git a/src/chain.c b/src/chain.c
new file mode 100644
index 0000000..dcfcd04
--- /dev/null
+++ b/src/chain.c
@@ -0,0 +1,1172 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_arp.h>
+
+#include <libnftnl/chain.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_chain {
+	struct list_head head;
+	struct hlist_node hnode;
+
+	const char	*name;
+	const char	*type;
+	const char	*table;
+	const char	*dev;
+	const char	**dev_array;
+	int		dev_array_len;
+	uint32_t	family;
+	uint32_t	policy;
+	uint32_t	hooknum;
+	int32_t		prio;
+	uint32_t	chain_flags;
+	uint32_t	use;
+	uint64_t	packets;
+	uint64_t	bytes;
+	uint64_t	handle;
+	uint32_t	flags;
+	uint32_t	chain_id;
+
+	struct {
+		void		*data;
+		uint32_t	len;
+	} user;
+
+	struct list_head rule_list;
+};
+
+static const char *nftnl_hooknum2str(int family, int hooknum)
+{
+	switch (family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6:
+	case NFPROTO_INET:
+	case NFPROTO_BRIDGE:
+		switch (hooknum) {
+		case NF_INET_PRE_ROUTING:
+			return "prerouting";
+		case NF_INET_LOCAL_IN:
+			return "input";
+		case NF_INET_FORWARD:
+			return "forward";
+		case NF_INET_LOCAL_OUT:
+			return "output";
+		case NF_INET_POST_ROUTING:
+			return "postrouting";
+		}
+		break;
+	case NFPROTO_ARP:
+		switch (hooknum) {
+		case NF_ARP_IN:
+			return "input";
+		case NF_ARP_OUT:
+			return "output";
+		case NF_ARP_FORWARD:
+			return "forward";
+		}
+		break;
+	case NFPROTO_NETDEV:
+		switch (hooknum) {
+		case NF_NETDEV_INGRESS:
+			return "ingress";
+		}
+		break;
+	}
+	return "unknown";
+}
+
+EXPORT_SYMBOL(nftnl_chain_alloc);
+struct nftnl_chain *nftnl_chain_alloc(void)
+{
+	struct nftnl_chain *c;
+
+	c = calloc(1, sizeof(struct nftnl_chain));
+	if (c == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&c->rule_list);
+
+	return c;
+}
+
+EXPORT_SYMBOL(nftnl_chain_free);
+void nftnl_chain_free(const struct nftnl_chain *c)
+{
+	struct nftnl_rule *r, *tmp;
+	int i;
+
+	list_for_each_entry_safe(r, tmp, &c->rule_list, head)
+		nftnl_rule_free(r);
+
+	if (c->flags & (1 << NFTNL_CHAIN_NAME))
+		xfree(c->name);
+	if (c->flags & (1 << NFTNL_CHAIN_TABLE))
+		xfree(c->table);
+	if (c->flags & (1 << NFTNL_CHAIN_TYPE))
+		xfree(c->type);
+	if (c->flags & (1 << NFTNL_CHAIN_DEV))
+		xfree(c->dev);
+	if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+		xfree(c->user.data);
+	if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
+		for (i = 0; i < c->dev_array_len; i++)
+			xfree(c->dev_array[i]);
+
+		xfree(c->dev_array);
+	}
+	xfree(c);
+}
+
+EXPORT_SYMBOL(nftnl_chain_is_set);
+bool nftnl_chain_is_set(const struct nftnl_chain *c, uint16_t attr)
+{
+	return c->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_chain_unset);
+void nftnl_chain_unset(struct nftnl_chain *c, uint16_t attr)
+{
+	int i;
+
+	if (!(c->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_CHAIN_NAME:
+		xfree(c->name);
+		break;
+	case NFTNL_CHAIN_TABLE:
+		xfree(c->table);
+		break;
+	case NFTNL_CHAIN_USE:
+		break;
+	case NFTNL_CHAIN_TYPE:
+		xfree(c->type);
+		break;
+	case NFTNL_CHAIN_HOOKNUM:
+	case NFTNL_CHAIN_PRIO:
+	case NFTNL_CHAIN_POLICY:
+	case NFTNL_CHAIN_BYTES:
+	case NFTNL_CHAIN_PACKETS:
+	case NFTNL_CHAIN_HANDLE:
+	case NFTNL_CHAIN_FAMILY:
+	case NFTNL_CHAIN_FLAGS:
+	case NFTNL_CHAIN_ID:
+		break;
+	case NFTNL_CHAIN_DEV:
+		xfree(c->dev);
+		break;
+	case NFTNL_CHAIN_DEVICES:
+		for (i = 0; i < c->dev_array_len; i++)
+			xfree(c->dev_array[i]);
+		xfree(c->dev_array);
+		break;
+	default:
+		return;
+	}
+
+	c->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_chain_validate[NFTNL_CHAIN_MAX + 1] = {
+	[NFTNL_CHAIN_HOOKNUM]	= sizeof(uint32_t),
+	[NFTNL_CHAIN_PRIO]		= sizeof(int32_t),
+	[NFTNL_CHAIN_POLICY]		= sizeof(uint32_t),
+	[NFTNL_CHAIN_BYTES]		= sizeof(uint64_t),
+	[NFTNL_CHAIN_PACKETS]	= sizeof(uint64_t),
+	[NFTNL_CHAIN_HANDLE]		= sizeof(uint64_t),
+	[NFTNL_CHAIN_FAMILY]		= sizeof(uint32_t),
+	[NFTNL_CHAIN_FLAGS]		= sizeof(uint32_t),
+	[NFTNL_CHAIN_ID]		= sizeof(uint32_t),
+};
+
+EXPORT_SYMBOL(nftnl_chain_set_data);
+int nftnl_chain_set_data(struct nftnl_chain *c, uint16_t attr,
+			 const void *data, uint32_t data_len)
+{
+	const char **dev_array;
+	int len = 0, i;
+
+	nftnl_assert_attr_exists(attr, NFTNL_CHAIN_MAX);
+	nftnl_assert_validate(data, nftnl_chain_validate, attr, data_len);
+
+	switch(attr) {
+	case NFTNL_CHAIN_NAME:
+		if (c->flags & (1 << NFTNL_CHAIN_NAME))
+			xfree(c->name);
+
+		c->name = strdup(data);
+		if (!c->name)
+			return -1;
+		break;
+	case NFTNL_CHAIN_TABLE:
+		if (c->flags & (1 << NFTNL_CHAIN_TABLE))
+			xfree(c->table);
+
+		c->table = strdup(data);
+		if (!c->table)
+			return -1;
+		break;
+	case NFTNL_CHAIN_HOOKNUM:
+		memcpy(&c->hooknum, data, sizeof(c->hooknum));
+		break;
+	case NFTNL_CHAIN_PRIO:
+		memcpy(&c->prio, data, sizeof(c->prio));
+		break;
+	case NFTNL_CHAIN_POLICY:
+		memcpy(&c->policy, data, sizeof(c->policy));
+		break;
+	case NFTNL_CHAIN_USE:
+		memcpy(&c->use, data, sizeof(c->use));
+		break;
+	case NFTNL_CHAIN_BYTES:
+		memcpy(&c->bytes, data, sizeof(c->bytes));
+		break;
+	case NFTNL_CHAIN_PACKETS:
+		memcpy(&c->packets, data, sizeof(c->packets));
+		break;
+	case NFTNL_CHAIN_HANDLE:
+		memcpy(&c->handle, data, sizeof(c->handle));
+		break;
+	case NFTNL_CHAIN_FAMILY:
+		memcpy(&c->family, data, sizeof(c->family));
+		break;
+	case NFTNL_CHAIN_TYPE:
+		if (c->flags & (1 << NFTNL_CHAIN_TYPE))
+			xfree(c->type);
+
+		c->type = strdup(data);
+		if (!c->type)
+			return -1;
+		break;
+	case NFTNL_CHAIN_DEV:
+		if (c->flags & (1 << NFTNL_CHAIN_DEV))
+			xfree(c->dev);
+
+		c->dev = strdup(data);
+		if (!c->dev)
+			return -1;
+		break;
+	case NFTNL_CHAIN_DEVICES:
+		dev_array = (const char **)data;
+		while (dev_array[len] != NULL)
+			len++;
+
+		if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
+			for (i = 0; i < c->dev_array_len; i++)
+				xfree(c->dev_array[i]);
+			xfree(c->dev_array);
+		}
+
+		c->dev_array = calloc(len + 1, sizeof(char *));
+		if (!c->dev_array)
+			return -1;
+
+		for (i = 0; i < len; i++)
+			c->dev_array[i] = strdup(dev_array[i]);
+
+		c->dev_array_len = len;
+		break;
+	case NFTNL_CHAIN_FLAGS:
+		memcpy(&c->chain_flags, data, sizeof(c->chain_flags));
+		break;
+	case NFTNL_CHAIN_ID:
+		memcpy(&c->chain_id, data, sizeof(c->chain_id));
+		break;
+	case NFTNL_CHAIN_USERDATA:
+		if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+			xfree(c->user.data);
+
+		c->user.data = malloc(data_len);
+		if (!c->user.data)
+			return -1;
+		memcpy(c->user.data, data, data_len);
+		c->user.len = data_len;
+		break;
+	}
+	c->flags |= (1 << attr);
+	return 0;
+}
+
+void nftnl_chain_set(struct nftnl_chain *c, uint16_t attr, const void *data) __visible;
+void nftnl_chain_set(struct nftnl_chain *c, uint16_t attr, const void *data)
+{
+	nftnl_chain_set_data(c, attr, data, nftnl_chain_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_chain_set_u32);
+void nftnl_chain_set_u32(struct nftnl_chain *c, uint16_t attr, uint32_t data)
+{
+	nftnl_chain_set_data(c, attr, &data, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_chain_set_s32);
+void nftnl_chain_set_s32(struct nftnl_chain *c, uint16_t attr, int32_t data)
+{
+	nftnl_chain_set_data(c, attr, &data, sizeof(int32_t));
+}
+
+EXPORT_SYMBOL(nftnl_chain_set_u64);
+void nftnl_chain_set_u64(struct nftnl_chain *c, uint16_t attr, uint64_t data)
+{
+	nftnl_chain_set_data(c, attr, &data, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_chain_set_u8);
+void nftnl_chain_set_u8(struct nftnl_chain *c, uint16_t attr, uint8_t data)
+{
+	nftnl_chain_set_data(c, attr, &data, sizeof(uint8_t));
+}
+
+EXPORT_SYMBOL(nftnl_chain_set_str);
+int nftnl_chain_set_str(struct nftnl_chain *c, uint16_t attr, const char *str)
+{
+	return nftnl_chain_set_data(c, attr, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_chain_set_array);
+int nftnl_chain_set_array(struct nftnl_chain *c, uint16_t attr,
+			  const char **data)
+{
+	return nftnl_chain_set_data(c, attr, data, 0);
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_data);
+const void *nftnl_chain_get_data(const struct nftnl_chain *c, uint16_t attr,
+				 uint32_t *data_len)
+{
+	if (!(c->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_CHAIN_NAME:
+		*data_len = strlen(c->name) + 1;
+		return c->name;
+	case NFTNL_CHAIN_TABLE:
+		*data_len = strlen(c->table) + 1;
+		return c->table;
+	case NFTNL_CHAIN_HOOKNUM:
+		*data_len = sizeof(uint32_t);
+		return &c->hooknum;
+	case NFTNL_CHAIN_PRIO:
+		*data_len = sizeof(int32_t);
+		return &c->prio;
+	case NFTNL_CHAIN_POLICY:
+		*data_len = sizeof(uint32_t);
+		return &c->policy;
+	case NFTNL_CHAIN_USE:
+		*data_len = sizeof(uint32_t);
+		return &c->use;
+	case NFTNL_CHAIN_BYTES:
+		*data_len = sizeof(uint64_t);
+		return &c->bytes;
+	case NFTNL_CHAIN_PACKETS:
+		*data_len = sizeof(uint64_t);
+		return &c->packets;
+	case NFTNL_CHAIN_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &c->handle;
+	case NFTNL_CHAIN_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &c->family;
+	case NFTNL_CHAIN_TYPE:
+		*data_len = sizeof(uint32_t);
+		return c->type;
+	case NFTNL_CHAIN_DEV:
+		*data_len = strlen(c->dev) + 1;
+		return c->dev;
+	case NFTNL_CHAIN_DEVICES:
+		*data_len = 0;
+		return &c->dev_array[0];
+	case NFTNL_CHAIN_FLAGS:
+		*data_len = sizeof(uint32_t);
+		return &c->chain_flags;
+	case NFTNL_CHAIN_ID:
+		*data_len = sizeof(uint32_t);
+		return &c->chain_id;
+	case NFTNL_CHAIN_USERDATA:
+		*data_len = c->user.len;
+		return c->user.data;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_chain_get);
+const void *nftnl_chain_get(const struct nftnl_chain *c, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_chain_get_data(c, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_str);
+const char *nftnl_chain_get_str(const struct nftnl_chain *c, uint16_t attr)
+{
+	return nftnl_chain_get(c, attr);
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_u32);
+uint32_t nftnl_chain_get_u32(const struct nftnl_chain *c, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint32_t *val = nftnl_chain_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint32_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_s32);
+int32_t nftnl_chain_get_s32(const struct nftnl_chain *c, uint16_t attr)
+{
+	uint32_t data_len;
+	const int32_t *val = nftnl_chain_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(int32_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_u64);
+uint64_t nftnl_chain_get_u64(const struct nftnl_chain *c, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint64_t *val = nftnl_chain_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(int64_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_u8);
+uint8_t nftnl_chain_get_u8(const struct nftnl_chain *c, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint8_t *val = nftnl_chain_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(int8_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_chain_get_array);
+const char *const *nftnl_chain_get_array(const struct nftnl_chain *c, uint16_t attr)
+{
+	uint32_t data_len;
+	const char * const *val = nftnl_chain_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, attr == NFTNL_CHAIN_DEVICES);
+
+	return val;
+}
+
+EXPORT_SYMBOL(nftnl_chain_nlmsg_build_payload);
+void nftnl_chain_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_chain *c)
+{
+	struct nlattr *nest = NULL;
+	int i;
+
+	if (c->flags & (1 << NFTNL_CHAIN_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_CHAIN_TABLE, c->table);
+	if (c->flags & (1 << NFTNL_CHAIN_NAME))
+		mnl_attr_put_strz(nlh, NFTA_CHAIN_NAME, c->name);
+
+	if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) ||
+	    (c->flags & (1 << NFTNL_CHAIN_PRIO)) ||
+	    (c->flags & (1 << NFTNL_CHAIN_DEV)) ||
+	    (c->flags & (1 << NFTNL_CHAIN_DEVICES)))
+		nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_HOOK);
+
+	if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)))
+		mnl_attr_put_u32(nlh, NFTA_HOOK_HOOKNUM, htonl(c->hooknum));
+	if ((c->flags & (1 << NFTNL_CHAIN_PRIO)))
+		mnl_attr_put_u32(nlh, NFTA_HOOK_PRIORITY, htonl(c->prio));
+
+	if (c->flags & (1 << NFTNL_CHAIN_DEV))
+		mnl_attr_put_strz(nlh, NFTA_HOOK_DEV, c->dev);
+	else if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
+		struct nlattr *nest_dev;
+
+		nest_dev = mnl_attr_nest_start(nlh, NFTA_HOOK_DEVS);
+		for (i = 0; i < c->dev_array_len; i++)
+			mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME,
+					  c->dev_array[i]);
+		mnl_attr_nest_end(nlh, nest_dev);
+	}
+
+	if ((c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) ||
+	    (c->flags & (1 << NFTNL_CHAIN_PRIO)) ||
+	    (c->flags & (1 << NFTNL_CHAIN_DEV)) ||
+	    (c->flags & (1 << NFTNL_CHAIN_DEVICES)))
+		mnl_attr_nest_end(nlh, nest);
+
+	if (c->flags & (1 << NFTNL_CHAIN_POLICY))
+		mnl_attr_put_u32(nlh, NFTA_CHAIN_POLICY, htonl(c->policy));
+	if (c->flags & (1 << NFTNL_CHAIN_USE))
+		mnl_attr_put_u32(nlh, NFTA_CHAIN_USE, htonl(c->use));
+	if ((c->flags & (1 << NFTNL_CHAIN_PACKETS)) &&
+	    (c->flags & (1 << NFTNL_CHAIN_BYTES))) {
+		nest = mnl_attr_nest_start(nlh, NFTA_CHAIN_COUNTERS);
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, be64toh(c->packets));
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, be64toh(c->bytes));
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (c->flags & (1 << NFTNL_CHAIN_HANDLE))
+		mnl_attr_put_u64(nlh, NFTA_CHAIN_HANDLE, be64toh(c->handle));
+	if (c->flags & (1 << NFTNL_CHAIN_TYPE))
+		mnl_attr_put_strz(nlh, NFTA_CHAIN_TYPE, c->type);
+	if (c->flags & (1 << NFTNL_CHAIN_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_CHAIN_FLAGS, htonl(c->chain_flags));
+	if (c->flags & (1 << NFTNL_CHAIN_ID))
+		mnl_attr_put_u32(nlh, NFTA_CHAIN_ID, htonl(c->chain_id));
+	if (c->flags & (1 << NFTNL_CHAIN_USERDATA))
+		mnl_attr_put(nlh, NFTA_CHAIN_USERDATA, c->user.len, c->user.data);
+}
+
+EXPORT_SYMBOL(nftnl_chain_rule_add);
+void nftnl_chain_rule_add(struct nftnl_rule *rule, struct nftnl_chain *c)
+{
+	list_add(&rule->head, &c->rule_list);
+}
+
+EXPORT_SYMBOL(nftnl_chain_rule_del);
+void nftnl_chain_rule_del(struct nftnl_rule *r)
+{
+	list_del(&r->head);
+}
+
+EXPORT_SYMBOL(nftnl_chain_rule_add_tail);
+void nftnl_chain_rule_add_tail(struct nftnl_rule *rule, struct nftnl_chain *c)
+{
+	list_add_tail(&rule->head, &c->rule_list);
+}
+
+EXPORT_SYMBOL(nftnl_chain_rule_insert_at);
+void nftnl_chain_rule_insert_at(struct nftnl_rule *rule, struct nftnl_rule *pos)
+{
+	list_add_tail(&rule->head, &pos->head);
+}
+
+EXPORT_SYMBOL(nftnl_chain_rule_append_at);
+void nftnl_chain_rule_append_at(struct nftnl_rule *rule, struct nftnl_rule *pos)
+{
+	list_add(&rule->head, &pos->head);
+}
+
+static int nftnl_chain_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_CHAIN_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_CHAIN_NAME:
+	case NFTA_CHAIN_TABLE:
+	case NFTA_CHAIN_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CHAIN_HOOK:
+	case NFTA_CHAIN_COUNTERS:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CHAIN_POLICY:
+	case NFTA_CHAIN_USE:
+	case NFTA_CHAIN_FLAGS:
+	case NFTA_CHAIN_ID:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CHAIN_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CHAIN_USERDATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_chain_parse_counters_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_COUNTER_BYTES:
+	case NFTA_COUNTER_PACKETS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_chain_parse_counters(struct nlattr *attr, struct nftnl_chain *c)
+{
+	struct nlattr *tb[NFTA_COUNTER_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_chain_parse_counters_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_COUNTER_PACKETS]) {
+		c->packets = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS]));
+		c->flags |= (1 << NFTNL_CHAIN_PACKETS);
+	}
+	if (tb[NFTA_COUNTER_BYTES]) {
+		c->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES]));
+		c->flags |= (1 << NFTNL_CHAIN_BYTES);
+	}
+
+	return 0;
+}
+
+static int nftnl_chain_parse_hook_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_HOOK_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_HOOK_HOOKNUM:
+	case NFTA_HOOK_PRIORITY:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_HOOK_DEV:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_chain_parse_devs(struct nlattr *nest, struct nftnl_chain *c)
+{
+	const char **dev_array, **tmp;
+	int len = 0, size = 8;
+	struct nlattr *attr;
+
+	dev_array = calloc(8, sizeof(char *));
+	if (!dev_array)
+		return -1;
+
+	mnl_attr_for_each_nested(attr, nest) {
+		if (mnl_attr_get_type(attr) != NFTA_DEVICE_NAME)
+			goto err;
+		dev_array[len++] = strdup(mnl_attr_get_str(attr));
+		if (len >= size) {
+			tmp = realloc(dev_array, size * 2 * sizeof(char *));
+			if (!tmp)
+				goto err;
+
+			size *= 2;
+			memset(&tmp[len], 0, (size - len) * sizeof(char *));
+			dev_array = tmp;
+		}
+	}
+
+	c->dev_array = dev_array;
+	c->dev_array_len = len;
+
+	return 0;
+err:
+	while (len--)
+		xfree(dev_array[len]);
+	xfree(dev_array);
+	return -1;
+}
+
+static int nftnl_chain_parse_hook(struct nlattr *attr, struct nftnl_chain *c)
+{
+	struct nlattr *tb[NFTA_HOOK_MAX+1] = {};
+	int ret;
+
+	if (mnl_attr_parse_nested(attr, nftnl_chain_parse_hook_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_HOOK_HOOKNUM]) {
+		c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_HOOKNUM]));
+		c->flags |= (1 << NFTNL_CHAIN_HOOKNUM);
+	}
+	if (tb[NFTA_HOOK_PRIORITY]) {
+		c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_HOOK_PRIORITY]));
+		c->flags |= (1 << NFTNL_CHAIN_PRIO);
+	}
+	if (tb[NFTA_HOOK_DEV]) {
+		c->dev = strdup(mnl_attr_get_str(tb[NFTA_HOOK_DEV]));
+		if (!c->dev)
+			return -1;
+		c->flags |= (1 << NFTNL_CHAIN_DEV);
+	}
+	if (tb[NFTA_HOOK_DEVS]) {
+		ret = nftnl_chain_parse_devs(tb[NFTA_HOOK_DEVS], c);
+		if (ret < 0)
+			return -1;
+		c->flags |= (1 << NFTNL_CHAIN_DEVICES);
+	}
+
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_chain_nlmsg_parse);
+int nftnl_chain_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_chain *c)
+{
+	struct nlattr *tb[NFTA_CHAIN_MAX+1] = {};
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	int ret = 0;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_chain_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CHAIN_NAME]) {
+		if (c->flags & (1 << NFTNL_CHAIN_NAME))
+			xfree(c->name);
+		c->name = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_NAME]));
+		if (!c->name)
+			return -1;
+		c->flags |= (1 << NFTNL_CHAIN_NAME);
+	}
+	if (tb[NFTA_CHAIN_TABLE]) {
+		if (c->flags & (1 << NFTNL_CHAIN_TABLE))
+			xfree(c->table);
+		c->table = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_TABLE]));
+		if (!c->table)
+			return -1;
+		c->flags |= (1 << NFTNL_CHAIN_TABLE);
+	}
+	if (tb[NFTA_CHAIN_HOOK]) {
+		ret = nftnl_chain_parse_hook(tb[NFTA_CHAIN_HOOK], c);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_CHAIN_POLICY]) {
+		c->policy = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_POLICY]));
+		c->flags |= (1 << NFTNL_CHAIN_POLICY);
+	}
+	if (tb[NFTA_CHAIN_USE]) {
+		c->use = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_USE]));
+		c->flags |= (1 << NFTNL_CHAIN_USE);
+	}
+	if (tb[NFTA_CHAIN_COUNTERS]) {
+		ret = nftnl_chain_parse_counters(tb[NFTA_CHAIN_COUNTERS], c);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_CHAIN_HANDLE]) {
+		c->handle = be64toh(mnl_attr_get_u64(tb[NFTA_CHAIN_HANDLE]));
+		c->flags |= (1 << NFTNL_CHAIN_HANDLE);
+	}
+	if (tb[NFTA_CHAIN_TYPE]) {
+		if (c->flags & (1 << NFTNL_CHAIN_TYPE))
+			xfree(c->type);
+		c->type = strdup(mnl_attr_get_str(tb[NFTA_CHAIN_TYPE]));
+		if (!c->type)
+			return -1;
+		c->flags |= (1 << NFTNL_CHAIN_TYPE);
+	}
+	if (tb[NFTA_CHAIN_FLAGS]) {
+		c->chain_flags = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_FLAGS]));
+		c->flags |= (1 << NFTNL_CHAIN_FLAGS);
+	}
+	if (tb[NFTA_CHAIN_ID]) {
+		c->chain_id = ntohl(mnl_attr_get_u32(tb[NFTA_CHAIN_ID]));
+		c->flags |= (1 << NFTNL_CHAIN_ID);
+	}
+	if (tb[NFTA_CHAIN_USERDATA]) {
+		nftnl_chain_set_data(c, NFTNL_CHAIN_USERDATA,
+				     mnl_attr_get_payload(tb[NFTA_CHAIN_USERDATA]),
+				     mnl_attr_get_payload_len(tb[NFTA_CHAIN_USERDATA]));
+	}
+
+	c->family = nfg->nfgen_family;
+	c->flags |= (1 << NFTNL_CHAIN_FAMILY);
+
+	return ret;
+}
+
+static inline int nftnl_str2hooknum(int family, const char *hook)
+{
+	int hooknum;
+
+	for (hooknum = 0; hooknum < NF_INET_NUMHOOKS; hooknum++) {
+		if (strcmp(hook, nftnl_hooknum2str(family, hooknum)) == 0)
+			return hooknum;
+	}
+	return -1;
+}
+
+static int nftnl_chain_snprintf_default(char *buf, size_t remain,
+					const struct nftnl_chain *c)
+{
+	int ret, offset = 0, i;
+
+	ret = snprintf(buf, remain, "%s %s %s use %u",
+		       nftnl_family2str(c->family), c->table, c->name, c->use);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (c->flags & (1 << NFTNL_CHAIN_HOOKNUM)) {
+		ret = snprintf(buf + offset, remain, " type %s hook %s prio %d",
+			       c->type, nftnl_hooknum2str(c->family, c->hooknum),
+			       c->prio);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (c->flags & (1 << NFTNL_CHAIN_POLICY)) {
+			ret = snprintf(buf + offset, remain, " policy %s",
+				       nftnl_verdict2str(c->policy));
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+
+		ret = snprintf(buf + offset, remain,
+			       " packets %"PRIu64" bytes %"PRIu64"",
+			       c->packets, c->bytes);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (c->flags & (1 << NFTNL_CHAIN_DEV)) {
+			ret = snprintf(buf + offset, remain, " dev %s ",
+				       c->dev);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+		if (c->flags & (1 << NFTNL_CHAIN_DEVICES)) {
+			ret = snprintf(buf + offset, remain, " dev { ");
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+			for (i = 0; i < c->dev_array_len; i++) {
+				ret = snprintf(buf + offset, remain, " %s ",
+					       c->dev_array[i]);
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+			ret = snprintf(buf + offset, remain, " } ");
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+		if (c->flags & (1 << NFTNL_CHAIN_FLAGS)) {
+			ret = snprintf(buf + offset, remain, " flags %x",
+				       c->chain_flags);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+		if (c->flags & (1 << NFTNL_CHAIN_ID)) {
+			ret = snprintf(buf + offset, remain, " id %x",
+				       c->chain_id);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+	}
+
+	return offset;
+}
+
+static int nftnl_chain_cmd_snprintf(char *buf, size_t remain,
+				    const struct nftnl_chain *c, uint32_t cmd,
+				    uint32_t type, uint32_t flags)
+{
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = nftnl_chain_snprintf_default(buf + offset, remain, c);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_chain_snprintf);
+int nftnl_chain_snprintf(char *buf, size_t size, const struct nftnl_chain *c,
+			 uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_chain_cmd_snprintf(buf, size, c, nftnl_flag2cmd(flags),
+					type, flags);
+}
+
+static int nftnl_chain_do_snprintf(char *buf, size_t size, const void *c,
+				   uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_chain_snprintf(buf, size, c, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_chain_fprintf);
+int nftnl_chain_fprintf(FILE *fp, const struct nftnl_chain *c, uint32_t type,
+			uint32_t flags)
+{
+	return nftnl_fprintf(fp, c, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_chain_do_snprintf);
+}
+
+EXPORT_SYMBOL(nftnl_rule_foreach);
+int nftnl_rule_foreach(struct nftnl_chain *c,
+                          int (*cb)(struct nftnl_rule *r, void *data),
+                          void *data)
+{
+       struct nftnl_rule *cur, *tmp;
+       int ret;
+
+       list_for_each_entry_safe(cur, tmp, &c->rule_list, head) {
+               ret = cb(cur, data);
+               if (ret < 0)
+                       return ret;
+       }
+       return 0;
+}
+
+EXPORT_SYMBOL(nftnl_rule_lookup_byindex);
+struct nftnl_rule *
+nftnl_rule_lookup_byindex(struct nftnl_chain *c, uint32_t index)
+{
+	struct nftnl_rule *r;
+
+	list_for_each_entry(r, &c->rule_list, head) {
+		if (!index)
+			return r;
+		index--;
+	}
+	return NULL;
+}
+
+struct nftnl_rule_iter {
+	const struct nftnl_chain	*c;
+	struct nftnl_rule		*cur;
+};
+
+static void nftnl_rule_iter_init(const struct nftnl_chain *c,
+				 struct nftnl_rule_iter *iter)
+{
+	iter->c = c;
+	if (list_empty(&c->rule_list))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(c->rule_list.next, struct nftnl_rule,
+				       head);
+}
+
+EXPORT_SYMBOL(nftnl_rule_iter_create);
+struct nftnl_rule_iter *nftnl_rule_iter_create(const struct nftnl_chain *c)
+{
+	struct nftnl_rule_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_rule_iter));
+	if (iter == NULL)
+		return NULL;
+
+	nftnl_rule_iter_init(c, iter);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_rule_iter_next);
+struct nftnl_rule *nftnl_rule_iter_next(struct nftnl_rule_iter *iter)
+{
+	struct nftnl_rule *rule = iter->cur;
+
+	if (rule == NULL)
+		return NULL;
+
+	/* get next rule, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_rule, head);
+	if (&iter->cur->head == iter->c->rule_list.next)
+		return NULL;
+
+	return rule;
+}
+
+EXPORT_SYMBOL(nftnl_rule_iter_destroy);
+void nftnl_rule_iter_destroy(struct nftnl_rule_iter *iter)
+{
+	xfree(iter);
+}
+
+#define CHAIN_NAME_HSIZE	512
+
+struct nftnl_chain_list {
+
+	struct list_head list;
+	struct hlist_head name_hash[CHAIN_NAME_HSIZE];
+};
+
+EXPORT_SYMBOL(nftnl_chain_list_alloc);
+struct nftnl_chain_list *nftnl_chain_list_alloc(void)
+{
+	struct nftnl_chain_list *list;
+	int i;
+
+	list = calloc(1, sizeof(struct nftnl_chain_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+	for (i = 0; i < CHAIN_NAME_HSIZE; i++)
+		INIT_HLIST_HEAD(&list->name_hash[i]);
+
+	return list;
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_free);
+void nftnl_chain_list_free(struct nftnl_chain_list *list)
+{
+	struct nftnl_chain *r, *tmp;
+
+	list_for_each_entry_safe(r, tmp, &list->list, head) {
+		list_del(&r->head);
+		hlist_del(&r->hnode);
+		nftnl_chain_free(r);
+	}
+	xfree(list);
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_is_empty);
+int nftnl_chain_list_is_empty(const struct nftnl_chain_list *list)
+{
+	return list_empty(&list->list);
+}
+
+static uint32_t djb_hash(const char *key)
+{
+	uint32_t i, hash = 5381;
+
+	for (i = 0; i < strlen(key); i++)
+		hash = ((hash << 5) + hash) + key[i];
+
+	return hash;
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_add);
+void nftnl_chain_list_add(struct nftnl_chain *r, struct nftnl_chain_list *list)
+{
+	int key = djb_hash(r->name) % CHAIN_NAME_HSIZE;
+
+	hlist_add_head(&r->hnode, &list->name_hash[key]);
+	list_add(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_add_tail);
+void nftnl_chain_list_add_tail(struct nftnl_chain *r, struct nftnl_chain_list *list)
+{
+	int key = djb_hash(r->name) % CHAIN_NAME_HSIZE;
+
+	hlist_add_head(&r->hnode, &list->name_hash[key]);
+	list_add_tail(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_del);
+void nftnl_chain_list_del(struct nftnl_chain *r)
+{
+	list_del(&r->head);
+	hlist_del(&r->hnode);
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_foreach);
+int nftnl_chain_list_foreach(struct nftnl_chain_list *chain_list,
+			   int (*cb)(struct nftnl_chain *r, void *data),
+			   void *data)
+{
+	struct nftnl_chain *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &chain_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_lookup_byname);
+struct nftnl_chain *
+nftnl_chain_list_lookup_byname(struct nftnl_chain_list *chain_list,
+			       const char *chain)
+{
+	int key = djb_hash(chain) % CHAIN_NAME_HSIZE;
+	struct nftnl_chain *c;
+	struct hlist_node *n;
+
+	hlist_for_each_entry(c, n, &chain_list->name_hash[key], hnode) {
+		if (!strcmp(chain, c->name))
+			return c;
+	}
+	return NULL;
+}
+
+struct nftnl_chain_list_iter {
+	const struct nftnl_chain_list	*list;
+	struct nftnl_chain		*cur;
+};
+
+EXPORT_SYMBOL(nftnl_chain_list_iter_create);
+struct nftnl_chain_list_iter *
+nftnl_chain_list_iter_create(const struct nftnl_chain_list *l)
+{
+	struct nftnl_chain_list_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_chain_list_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->list = l;
+	if (nftnl_chain_list_is_empty(l))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(l->list.next, struct nftnl_chain, head);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_iter_next);
+struct nftnl_chain *nftnl_chain_list_iter_next(struct nftnl_chain_list_iter *iter)
+{
+	struct nftnl_chain *r = iter->cur;
+
+	if (r == NULL)
+		return NULL;
+
+	/* get next chain, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_chain, head);
+	if (&iter->cur->head == iter->list->list.next)
+		return NULL;
+
+	return r;
+}
+
+EXPORT_SYMBOL(nftnl_chain_list_iter_destroy);
+void nftnl_chain_list_iter_destroy(struct nftnl_chain_list_iter *iter)
+{
+	xfree(iter);
+}
diff --git a/src/common.c b/src/common.c
new file mode 100644
index 0000000..ec84fa0
--- /dev/null
+++ b/src/common.c
@@ -0,0 +1,164 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdlib.h>
+#include <sys/socket.h>
+#include <time.h>
+#include <arpa/inet.h>
+#include <linux/netlink.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/common.h>
+#include <libnftnl/set.h>
+
+#include <errno.h>
+#include "internal.h"
+
+static struct nlmsghdr *__nftnl_nlmsg_build_hdr(char *buf, uint16_t type,
+						uint16_t family,
+						uint16_t flags, uint32_t seq,
+						uint16_t res_id)
+{
+	struct nlmsghdr *nlh;
+	struct nfgenmsg *nfh;
+
+	nlh = mnl_nlmsg_put_header(buf);
+	nlh->nlmsg_type = type;
+	nlh->nlmsg_flags = NLM_F_REQUEST | flags;
+	nlh->nlmsg_seq = seq;
+
+	nfh = mnl_nlmsg_put_extra_header(nlh, sizeof(struct nfgenmsg));
+	nfh->nfgen_family = family;
+	nfh->version = NFNETLINK_V0;
+	nfh->res_id = htons(res_id);
+
+	return nlh;
+}
+
+EXPORT_SYMBOL(nftnl_nlmsg_build_hdr);
+struct nlmsghdr *nftnl_nlmsg_build_hdr(char *buf, uint16_t type, uint16_t family,
+				       uint16_t flags, uint32_t seq)
+{
+	return __nftnl_nlmsg_build_hdr(buf, (NFNL_SUBSYS_NFTABLES << 8) | type,
+				       family, flags, seq, 0);
+}
+
+EXPORT_SYMBOL(nftnl_parse_err_alloc);
+struct nftnl_parse_err *nftnl_parse_err_alloc(void)
+{
+	struct nftnl_parse_err *err;
+
+	err = calloc(1, sizeof(struct nftnl_parse_err));
+	if (err == NULL)
+		return NULL;
+
+	err->error = NFTNL_PARSE_EOPNOTSUPP;
+
+	return err;
+}
+
+EXPORT_SYMBOL(nftnl_parse_err_free);
+void nftnl_parse_err_free(struct nftnl_parse_err *err)
+{
+	xfree(err);
+}
+
+EXPORT_SYMBOL(nftnl_parse_perror);
+int nftnl_parse_perror(const char *msg, struct nftnl_parse_err *err)
+{
+	switch (err->error) {
+	case NFTNL_PARSE_EBADINPUT:
+		return fprintf(stderr, "%s: Bad input format in line %d column %d\n",
+			       msg, err->line, err->column);
+	case NFTNL_PARSE_EMISSINGNODE:
+		return fprintf(stderr, "%s: Node \"%s\" not found\n",
+			       msg, err->node_name);
+	case NFTNL_PARSE_EBADTYPE:
+		return fprintf(stderr, "%s: Invalid type in node \"%s\"\n",
+			       msg, err->node_name);
+	case NFTNL_PARSE_EOPNOTSUPP:
+		return fprintf(stderr, "%s: Operation not supported\n", msg);
+	default:
+		return fprintf(stderr, "%s: Undefined error\n", msg);
+	}
+}
+
+EXPORT_SYMBOL(nftnl_batch_begin);
+struct nlmsghdr *nftnl_batch_begin(char *buf, uint32_t seq)
+{
+	return __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_BEGIN, AF_UNSPEC,
+				       0, seq, NFNL_SUBSYS_NFTABLES);
+}
+
+EXPORT_SYMBOL(nftnl_batch_end);
+struct nlmsghdr *nftnl_batch_end(char *buf, uint32_t seq)
+{
+	return __nftnl_nlmsg_build_hdr(buf, NFNL_MSG_BATCH_END, AF_UNSPEC,
+				       0, seq, NFNL_SUBSYS_NFTABLES);
+}
+
+EXPORT_SYMBOL(nftnl_batch_is_supported);
+int nftnl_batch_is_supported(void)
+{
+	struct mnl_socket *nl;
+	struct mnl_nlmsg_batch *b;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	uint32_t seq = time(NULL), req_seq;
+	int ret;
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL)
+		return -1;
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0)
+		return -1;
+
+	b = mnl_nlmsg_batch_start(buf, sizeof(buf));
+
+	nftnl_batch_begin(mnl_nlmsg_batch_current(b), seq++);
+	mnl_nlmsg_batch_next(b);
+
+	req_seq = seq;
+	nftnl_nlmsg_build_hdr(mnl_nlmsg_batch_current(b), NFT_MSG_NEWSET,
+			      AF_INET, NLM_F_ACK, seq++);
+	mnl_nlmsg_batch_next(b);
+
+	nftnl_batch_end(mnl_nlmsg_batch_current(b), seq++);
+	mnl_nlmsg_batch_next(b);
+
+	ret = mnl_socket_sendto(nl, mnl_nlmsg_batch_head(b),
+				mnl_nlmsg_batch_size(b));
+	if (ret < 0)
+		goto err;
+
+	mnl_nlmsg_batch_stop(b);
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, req_seq, mnl_socket_get_portid(nl),
+				 NULL, NULL);
+		if (ret <= 0)
+			break;
+
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	}
+	mnl_socket_close(nl);
+
+	/* We're sending an incomplete message to see if the kernel supports
+	 * set messages in batches. EINVAL means that we sent an incomplete
+	 * message with missing attributes. The kernel just ignores messages
+	 * that we cannot include in the batch.
+	 */
+	return (ret == -1 && errno == EINVAL) ? 1 : 0;
+err:
+	mnl_nlmsg_batch_stop(b);
+	return -1;
+}
diff --git a/src/expr.c b/src/expr.c
new file mode 100644
index 0000000..b4581f1
--- /dev/null
+++ b/src/expr.c
@@ -0,0 +1,303 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <netinet/in.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/expr.h>
+
+EXPORT_SYMBOL(nftnl_expr_alloc);
+struct nftnl_expr *nftnl_expr_alloc(const char *name)
+{
+	struct nftnl_expr *expr;
+	struct expr_ops *ops;
+
+	ops = nftnl_expr_ops_lookup(name);
+	if (ops == NULL)
+		return NULL;
+
+	expr = calloc(1, sizeof(struct nftnl_expr) + ops->alloc_len);
+	if (expr == NULL)
+		return NULL;
+
+	/* Manually set expression name attribute */
+	expr->flags |= (1 << NFTNL_EXPR_NAME);
+	expr->ops = ops;
+
+	if (ops->init)
+		ops->init(expr);
+
+	return expr;
+}
+
+EXPORT_SYMBOL(nftnl_expr_free);
+void nftnl_expr_free(const struct nftnl_expr *expr)
+{
+	if (expr->ops->free)
+		expr->ops->free(expr);
+
+	xfree(expr);
+}
+
+EXPORT_SYMBOL(nftnl_expr_is_set);
+bool nftnl_expr_is_set(const struct nftnl_expr *expr, uint16_t type)
+{
+	return expr->flags & (1 << type);
+}
+
+EXPORT_SYMBOL(nftnl_expr_set);
+int nftnl_expr_set(struct nftnl_expr *expr, uint16_t type,
+		   const void *data, uint32_t data_len)
+{
+	switch(type) {
+	case NFTNL_EXPR_NAME:	/* cannot be modified */
+		return 0;
+	default:
+		if (expr->ops->set(expr, type, data, data_len) < 0)
+			return -1;
+	}
+	expr->flags |= (1 << type);
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_expr_set_u8);
+void
+nftnl_expr_set_u8(struct nftnl_expr *expr, uint16_t type, uint8_t data)
+{
+	nftnl_expr_set(expr, type, &data, sizeof(uint8_t));
+}
+
+EXPORT_SYMBOL(nftnl_expr_set_u16);
+void
+nftnl_expr_set_u16(struct nftnl_expr *expr, uint16_t type, uint16_t data)
+{
+	nftnl_expr_set(expr, type, &data, sizeof(uint16_t));
+}
+
+EXPORT_SYMBOL(nftnl_expr_set_u32);
+void
+nftnl_expr_set_u32(struct nftnl_expr *expr, uint16_t type, uint32_t data)
+{
+	nftnl_expr_set(expr, type, &data, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_expr_set_u64);
+void
+nftnl_expr_set_u64(struct nftnl_expr *expr, uint16_t type, uint64_t data)
+{
+	nftnl_expr_set(expr, type, &data, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_expr_set_str);
+int nftnl_expr_set_str(struct nftnl_expr *expr, uint16_t type, const char *str)
+{
+	return nftnl_expr_set(expr, type, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_expr_get);
+const void *nftnl_expr_get(const struct nftnl_expr *expr,
+			      uint16_t type, uint32_t *data_len)
+{
+	const void *ret;
+
+	if (!(expr->flags & (1 << type)))
+		return NULL;
+
+	switch(type) {
+	case NFTNL_EXPR_NAME:
+		*data_len = strlen(expr->ops->name) + 1;
+		ret = expr->ops->name;
+		break;
+	default:
+		ret = expr->ops->get(expr, type, data_len);
+		break;
+	}
+
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_expr_get_u8);
+uint8_t nftnl_expr_get_u8(const struct nftnl_expr *expr, uint16_t type)
+{
+	const void *data;
+	uint32_t data_len;
+
+	data = nftnl_expr_get(expr, type, &data_len);
+	if (data == NULL)
+		return 0;
+
+	if (data_len != sizeof(uint8_t))
+		return 0;
+
+	return *((uint8_t *)data);
+}
+
+EXPORT_SYMBOL(nftnl_expr_get_u16);
+uint16_t nftnl_expr_get_u16(const struct nftnl_expr *expr, uint16_t type)
+{
+	const void *data;
+	uint32_t data_len;
+
+	data = nftnl_expr_get(expr, type, &data_len);
+	if (data == NULL)
+		return 0;
+
+	if (data_len != sizeof(uint16_t))
+		return 0;
+
+	return *((uint16_t *)data);
+}
+
+EXPORT_SYMBOL(nftnl_expr_get_u32);
+uint32_t nftnl_expr_get_u32(const struct nftnl_expr *expr, uint16_t type)
+{
+	const void *data;
+	uint32_t data_len;
+
+	data = nftnl_expr_get(expr, type, &data_len);
+	if (data == NULL)
+		return 0;
+
+	if (data_len != sizeof(uint32_t))
+		return 0;
+
+	return *((uint32_t *)data);
+}
+
+EXPORT_SYMBOL(nftnl_expr_get_u64);
+uint64_t nftnl_expr_get_u64(const struct nftnl_expr *expr, uint16_t type)
+{
+	const void *data;
+	uint32_t data_len;
+
+	data = nftnl_expr_get(expr, type, &data_len);
+	if (data == NULL)
+		return 0;
+
+	if (data_len != sizeof(uint64_t))
+		return 0;
+
+	return *((uint64_t *)data);
+}
+
+EXPORT_SYMBOL(nftnl_expr_get_str);
+const char *nftnl_expr_get_str(const struct nftnl_expr *expr, uint16_t type)
+{
+	uint32_t data_len;
+
+	return (const char *)nftnl_expr_get(expr, type, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_expr_build_payload);
+void nftnl_expr_build_payload(struct nlmsghdr *nlh, struct nftnl_expr *expr)
+{
+	struct nlattr *nest;
+
+	mnl_attr_put_strz(nlh, NFTA_EXPR_NAME, expr->ops->name);
+
+	if (!expr->ops->build)
+		return;
+
+	nest = mnl_attr_nest_start(nlh, NFTA_EXPR_DATA);
+	expr->ops->build(nlh, expr);
+	mnl_attr_nest_end(nlh, nest);
+}
+
+static int nftnl_rule_parse_expr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_EXPR_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_EXPR_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_EXPR_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+struct nftnl_expr *nftnl_expr_parse(struct nlattr *attr)
+{
+	struct nlattr *tb[NFTA_EXPR_MAX+1] = {};
+	struct nftnl_expr *expr;
+
+	if (mnl_attr_parse_nested(attr, nftnl_rule_parse_expr_cb, tb) < 0)
+		goto err1;
+
+	expr = nftnl_expr_alloc(mnl_attr_get_str(tb[NFTA_EXPR_NAME]));
+	if (expr == NULL)
+		goto err1;
+
+	if (tb[NFTA_EXPR_DATA] &&
+	    expr->ops->parse &&
+	    expr->ops->parse(expr, tb[NFTA_EXPR_DATA]) < 0)
+		goto err2;
+
+	return expr;
+
+err2:
+	xfree(expr);
+err1:
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_expr_snprintf);
+int nftnl_expr_snprintf(char *buf, size_t remain, const struct nftnl_expr *expr,
+			uint32_t type, uint32_t flags)
+{
+	int ret;
+	unsigned int offset = 0;
+
+	if (remain)
+		buf[0] = '\0';
+
+	if (!expr->ops->output || type != NFTNL_OUTPUT_DEFAULT)
+		return 0;
+
+	ret = expr->ops->output(buf + offset, remain, flags, expr);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+static int nftnl_expr_do_snprintf(char *buf, size_t size, const void *e,
+				  uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_expr_snprintf(buf, size, e, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_expr_fprintf);
+int nftnl_expr_fprintf(FILE *fp, const struct nftnl_expr *expr, uint32_t type,
+		       uint32_t flags)
+{
+	return nftnl_fprintf(fp, expr, NFTNL_CMD_UNSPEC, type, flags,
+			     nftnl_expr_do_snprintf);
+}
diff --git a/src/expr/bitwise.c b/src/expr/bitwise.c
new file mode 100644
index 0000000..2d27233
--- /dev/null
+++ b/src/expr/bitwise.c
@@ -0,0 +1,286 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h> /* for memcpy */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_bitwise {
+	enum nft_registers	sreg;
+	enum nft_registers	dreg;
+	enum nft_bitwise_ops	op;
+	unsigned int		len;
+	union nftnl_data_reg	mask;
+	union nftnl_data_reg	xor;
+	union nftnl_data_reg	data;
+};
+
+static int
+nftnl_expr_bitwise_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_bitwise *bitwise = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_BITWISE_SREG:
+		memcpy(&bitwise->sreg, data, sizeof(bitwise->sreg));
+		break;
+	case NFTNL_EXPR_BITWISE_DREG:
+		memcpy(&bitwise->dreg, data, sizeof(bitwise->dreg));
+		break;
+	case NFTNL_EXPR_BITWISE_OP:
+		memcpy(&bitwise->op, data, sizeof(bitwise->op));
+		break;
+	case NFTNL_EXPR_BITWISE_LEN:
+		memcpy(&bitwise->len, data, sizeof(bitwise->len));
+		break;
+	case NFTNL_EXPR_BITWISE_MASK:
+		memcpy(&bitwise->mask.val, data, data_len);
+		bitwise->mask.len = data_len;
+		break;
+	case NFTNL_EXPR_BITWISE_XOR:
+		memcpy(&bitwise->xor.val, data, data_len);
+		bitwise->xor.len = data_len;
+		break;
+	case NFTNL_EXPR_BITWISE_DATA:
+		memcpy(&bitwise->data.val, data, data_len);
+		bitwise->data.len = data_len;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_bitwise_get(const struct nftnl_expr *e, uint16_t type,
+		       uint32_t *data_len)
+{
+	struct nftnl_expr_bitwise *bitwise = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_BITWISE_SREG:
+		*data_len = sizeof(bitwise->sreg);
+		return &bitwise->sreg;
+	case NFTNL_EXPR_BITWISE_DREG:
+		*data_len = sizeof(bitwise->dreg);
+		return &bitwise->dreg;
+	case NFTNL_EXPR_BITWISE_OP:
+		*data_len = sizeof(bitwise->op);
+		return &bitwise->op;
+	case NFTNL_EXPR_BITWISE_LEN:
+		*data_len = sizeof(bitwise->len);
+		return &bitwise->len;
+	case NFTNL_EXPR_BITWISE_MASK:
+		*data_len = bitwise->mask.len;
+		return &bitwise->mask.val;
+	case NFTNL_EXPR_BITWISE_XOR:
+		*data_len = bitwise->xor.len;
+		return &bitwise->xor.val;
+	case NFTNL_EXPR_BITWISE_DATA:
+		*data_len = bitwise->data.len;
+		return &bitwise->data.val;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_bitwise_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_BITWISE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_BITWISE_SREG:
+	case NFTA_BITWISE_DREG:
+	case NFTA_BITWISE_OP:
+	case NFTA_BITWISE_LEN:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_BITWISE_MASK:
+	case NFTA_BITWISE_XOR:
+	case NFTA_BITWISE_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_bitwise_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_bitwise *bitwise = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_SREG))
+		mnl_attr_put_u32(nlh, NFTA_BITWISE_SREG, htonl(bitwise->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_DREG))
+		mnl_attr_put_u32(nlh, NFTA_BITWISE_DREG, htonl(bitwise->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_OP))
+		mnl_attr_put_u32(nlh, NFTA_BITWISE_OP, htonl(bitwise->op));
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_LEN))
+		mnl_attr_put_u32(nlh, NFTA_BITWISE_LEN, htonl(bitwise->len));
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_MASK)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_BITWISE_MASK);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, bitwise->mask.len,
+			     bitwise->mask.val);
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_XOR)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_BITWISE_XOR);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, bitwise->xor.len,
+			     bitwise->xor.val);
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_BITWISE_DATA)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_BITWISE_DATA);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, bitwise->data.len,
+				bitwise->data.val);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int
+nftnl_expr_bitwise_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_bitwise *bitwise = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_BITWISE_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_bitwise_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_BITWISE_SREG]) {
+		bitwise->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_BITWISE_SREG);
+	}
+	if (tb[NFTA_BITWISE_DREG]) {
+		bitwise->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_BITWISE_DREG);
+	}
+	if (tb[NFTA_BITWISE_OP]) {
+		bitwise->op = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_OP]));
+		e->flags |= (1 << NFTNL_EXPR_BITWISE_OP);
+	}
+	if (tb[NFTA_BITWISE_LEN]) {
+		bitwise->len = ntohl(mnl_attr_get_u32(tb[NFTA_BITWISE_LEN]));
+		e->flags |= (1 << NFTNL_EXPR_BITWISE_LEN);
+	}
+	if (tb[NFTA_BITWISE_MASK]) {
+		ret = nftnl_parse_data(&bitwise->mask, tb[NFTA_BITWISE_MASK], NULL);
+		e->flags |= (1 << NFTA_BITWISE_MASK);
+	}
+	if (tb[NFTA_BITWISE_XOR]) {
+		ret = nftnl_parse_data(&bitwise->xor, tb[NFTA_BITWISE_XOR], NULL);
+		e->flags |= (1 << NFTA_BITWISE_XOR);
+	}
+	if (tb[NFTA_BITWISE_DATA]) {
+		ret = nftnl_parse_data(&bitwise->data, tb[NFTA_BITWISE_DATA], NULL);
+		e->flags |= (1 << NFTNL_EXPR_BITWISE_DATA);
+	}
+
+	return ret;
+}
+
+static int
+nftnl_expr_bitwise_snprintf_bool(char *buf, size_t remain,
+				 const struct nftnl_expr_bitwise *bitwise)
+{
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "reg %u = ( reg %u & ",
+		       bitwise->dreg, bitwise->sreg);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &bitwise->mask,
+				      0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = snprintf(buf + offset, remain, ") ^ ");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &bitwise->xor,
+				      0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+static int
+nftnl_expr_bitwise_snprintf_shift(char *buf, size_t remain, const char *op,
+				  const struct nftnl_expr_bitwise *bitwise)
+{	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "reg %u = ( reg %u %s ",
+		       bitwise->dreg, bitwise->sreg, op);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &bitwise->data,
+				      0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = snprintf(buf + offset, remain, ") ");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+static int
+nftnl_expr_bitwise_snprintf(char *buf, size_t size,
+			    uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_bitwise *bitwise = nftnl_expr_data(e);
+	int err = -1;
+
+	switch (bitwise->op) {
+	case NFT_BITWISE_BOOL:
+		err = nftnl_expr_bitwise_snprintf_bool(buf, size, bitwise);
+		break;
+	case NFT_BITWISE_LSHIFT:
+		err = nftnl_expr_bitwise_snprintf_shift(buf, size, "<<", bitwise);
+		break;
+	case NFT_BITWISE_RSHIFT:
+		err = nftnl_expr_bitwise_snprintf_shift(buf, size, ">>", bitwise);
+		break;
+	}
+
+	return err;
+}
+
+struct expr_ops expr_ops_bitwise = {
+	.name		= "bitwise",
+	.alloc_len	= sizeof(struct nftnl_expr_bitwise),
+	.max_attr	= NFTA_BITWISE_MAX,
+	.set		= nftnl_expr_bitwise_set,
+	.get		= nftnl_expr_bitwise_get,
+	.parse		= nftnl_expr_bitwise_parse,
+	.build		= nftnl_expr_bitwise_build,
+	.output		= nftnl_expr_bitwise_snprintf,
+};
diff --git a/src/expr/byteorder.c b/src/expr/byteorder.c
new file mode 100644
index 0000000..89ed0a8
--- /dev/null
+++ b/src/expr/byteorder.c
@@ -0,0 +1,224 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h> /* for memcpy */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_byteorder {
+	enum nft_registers	sreg;
+	enum nft_registers	dreg;
+	enum nft_byteorder_ops	op;
+	unsigned int		len;
+	unsigned int		size;
+};
+
+static int
+nftnl_expr_byteorder_set(struct nftnl_expr *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_byteorder *byteorder = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_BYTEORDER_SREG:
+		memcpy(&byteorder->sreg, data, sizeof(byteorder->sreg));
+		break;
+	case NFTNL_EXPR_BYTEORDER_DREG:
+		memcpy(&byteorder->dreg, data, sizeof(byteorder->dreg));
+		break;
+	case NFTNL_EXPR_BYTEORDER_OP:
+		memcpy(&byteorder->op, data, sizeof(byteorder->op));
+		break;
+	case NFTNL_EXPR_BYTEORDER_LEN:
+		memcpy(&byteorder->len, data, sizeof(byteorder->len));
+		break;
+	case NFTNL_EXPR_BYTEORDER_SIZE:
+		memcpy(&byteorder->size, data, sizeof(byteorder->size));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_byteorder_get(const struct nftnl_expr *e, uint16_t type,
+			    uint32_t *data_len)
+{
+	struct nftnl_expr_byteorder *byteorder = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_BYTEORDER_SREG:
+		*data_len = sizeof(byteorder->sreg);
+		return &byteorder->sreg;
+	case NFTNL_EXPR_BYTEORDER_DREG:
+		*data_len = sizeof(byteorder->dreg);
+		return &byteorder->dreg;
+	case NFTNL_EXPR_BYTEORDER_OP:
+		*data_len = sizeof(byteorder->op);
+		return &byteorder->op;
+	case NFTNL_EXPR_BYTEORDER_LEN:
+		*data_len = sizeof(byteorder->len);
+		return &byteorder->len;
+	case NFTNL_EXPR_BYTEORDER_SIZE:
+		*data_len = sizeof(byteorder->size);
+		return &byteorder->size;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_byteorder_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_BYTEORDER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_BYTEORDER_SREG:
+	case NFTA_BYTEORDER_DREG:
+	case NFTA_BYTEORDER_OP:
+	case NFTA_BYTEORDER_LEN:
+	case NFTA_BYTEORDER_SIZE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_byteorder_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_byteorder *byteorder = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_BYTEORDER_SREG)) {
+		mnl_attr_put_u32(nlh, NFTA_BYTEORDER_SREG,
+				 htonl(byteorder->sreg));
+	}
+	if (e->flags & (1 << NFTNL_EXPR_BYTEORDER_DREG)) {
+		mnl_attr_put_u32(nlh, NFTA_BYTEORDER_DREG,
+				 htonl(byteorder->dreg));
+	}
+	if (e->flags & (1 << NFTNL_EXPR_BYTEORDER_OP)) {
+		mnl_attr_put_u32(nlh, NFTA_BYTEORDER_OP,
+				 htonl(byteorder->op));
+	}
+	if (e->flags & (1 << NFTNL_EXPR_BYTEORDER_LEN)) {
+		mnl_attr_put_u32(nlh, NFTA_BYTEORDER_LEN,
+				 htonl(byteorder->len));
+	}
+	if (e->flags & (1 << NFTNL_EXPR_BYTEORDER_SIZE)) {
+		mnl_attr_put_u32(nlh, NFTA_BYTEORDER_SIZE,
+				 htonl(byteorder->size));
+	}
+}
+
+static int
+nftnl_expr_byteorder_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_byteorder *byteorder = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_BYTEORDER_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_byteorder_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_BYTEORDER_SREG]) {
+		byteorder->sreg =
+			ntohl(mnl_attr_get_u32(tb[NFTA_BYTEORDER_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_BYTEORDER_SREG);
+	}
+	if (tb[NFTA_BYTEORDER_DREG]) {
+		byteorder->dreg =
+			ntohl(mnl_attr_get_u32(tb[NFTA_BYTEORDER_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_BYTEORDER_DREG);
+	}
+	if (tb[NFTA_BYTEORDER_OP]) {
+		byteorder->op =
+			ntohl(mnl_attr_get_u32(tb[NFTA_BYTEORDER_OP]));
+		e->flags |= (1 << NFTNL_EXPR_BYTEORDER_OP);
+	}
+	if (tb[NFTA_BYTEORDER_LEN]) {
+		byteorder->len =
+			ntohl(mnl_attr_get_u32(tb[NFTA_BYTEORDER_LEN]));
+		e->flags |= (1 << NFTNL_EXPR_BYTEORDER_LEN);
+	}
+	if (tb[NFTA_BYTEORDER_SIZE]) {
+		byteorder->size =
+			ntohl(mnl_attr_get_u32(tb[NFTA_BYTEORDER_SIZE]));
+		e->flags |= (1 << NFTNL_EXPR_BYTEORDER_SIZE);
+	}
+
+	return ret;
+}
+
+static const char *expr_byteorder_str[] = {
+	[NFT_BYTEORDER_HTON] = "hton",
+	[NFT_BYTEORDER_NTOH] = "ntoh",
+};
+
+static const char *bo2str(uint32_t type)
+{
+	if (type > NFT_BYTEORDER_HTON)
+		return "unknown";
+
+	return expr_byteorder_str[type];
+}
+
+static inline int nftnl_str2ntoh(const char *op)
+{
+	if (strcmp(op, "ntoh") == 0)
+		return NFT_BYTEORDER_NTOH;
+	else if (strcmp(op, "hton") == 0)
+		return NFT_BYTEORDER_HTON;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
+static int
+nftnl_expr_byteorder_snprintf(char *buf, size_t remain,
+			      uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_byteorder *byteorder = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "reg %u = %s(reg %u, %u, %u) ",
+		       byteorder->dreg, bo2str(byteorder->op),
+		       byteorder->sreg, byteorder->size, byteorder->len);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+struct expr_ops expr_ops_byteorder = {
+	.name		= "byteorder",
+	.alloc_len	= sizeof(struct nftnl_expr_byteorder),
+	.max_attr	= NFTA_BYTEORDER_MAX,
+	.set		= nftnl_expr_byteorder_set,
+	.get		= nftnl_expr_byteorder_get,
+	.parse		= nftnl_expr_byteorder_parse,
+	.build		= nftnl_expr_byteorder_build,
+	.output		= nftnl_expr_byteorder_snprintf,
+};
diff --git a/src/expr/cmp.c b/src/expr/cmp.c
new file mode 100644
index 0000000..f9d15bb
--- /dev/null
+++ b/src/expr/cmp.c
@@ -0,0 +1,206 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_cmp {
+	union nftnl_data_reg	data;
+	enum nft_registers	sreg;
+	enum nft_cmp_ops	op;
+};
+
+static int
+nftnl_expr_cmp_set(struct nftnl_expr *e, uint16_t type,
+		      const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_cmp *cmp = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CMP_SREG:
+		memcpy(&cmp->sreg, data, sizeof(cmp->sreg));
+		break;
+	case NFTNL_EXPR_CMP_OP:
+		memcpy(&cmp->op, data, sizeof(cmp->op));
+		break;
+	case NFTNL_EXPR_CMP_DATA:
+		memcpy(&cmp->data.val, data, data_len);
+		cmp->data.len = data_len;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_cmp_get(const struct nftnl_expr *e, uint16_t type,
+		      uint32_t *data_len)
+{
+	struct nftnl_expr_cmp *cmp = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CMP_SREG:
+		*data_len = sizeof(cmp->sreg);
+		return &cmp->sreg;
+	case NFTNL_EXPR_CMP_OP:
+		*data_len = sizeof(cmp->op);
+		return &cmp->op;
+	case NFTNL_EXPR_CMP_DATA:
+		*data_len = cmp->data.len;
+		return &cmp->data.val;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_cmp_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_CMP_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_CMP_SREG:
+	case NFTA_CMP_OP:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CMP_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_cmp_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_cmp *cmp = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_CMP_SREG))
+		mnl_attr_put_u32(nlh, NFTA_CMP_SREG, htonl(cmp->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_CMP_OP))
+		mnl_attr_put_u32(nlh, NFTA_CMP_OP, htonl(cmp->op));
+	if (e->flags & (1 << NFTNL_EXPR_CMP_DATA)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_CMP_DATA);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, cmp->data.len, cmp->data.val);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int
+nftnl_expr_cmp_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_cmp *cmp = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_CMP_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_cmp_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CMP_SREG]) {
+		cmp->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_CMP_SREG]));
+		e->flags |= (1 << NFTA_CMP_SREG);
+	}
+	if (tb[NFTA_CMP_OP]) {
+		cmp->op = ntohl(mnl_attr_get_u32(tb[NFTA_CMP_OP]));
+		e->flags |= (1 << NFTA_CMP_OP);
+	}
+	if (tb[NFTA_CMP_DATA]) {
+		ret = nftnl_parse_data(&cmp->data, tb[NFTA_CMP_DATA], NULL);
+		e->flags |= (1 << NFTA_CMP_DATA);
+	}
+
+	return ret;
+}
+
+static const char *expr_cmp_str[] = {
+	[NFT_CMP_EQ]	= "eq",
+	[NFT_CMP_NEQ]	= "neq",
+	[NFT_CMP_LT]	= "lt",
+	[NFT_CMP_LTE]	= "lte",
+	[NFT_CMP_GT]	= "gt",
+	[NFT_CMP_GTE]	= "gte",
+};
+
+static const char *cmp2str(uint32_t op)
+{
+	if (op > NFT_CMP_GTE)
+		return "unknown";
+
+	return expr_cmp_str[op];
+}
+
+static inline int nftnl_str2cmp(const char *op)
+{
+	if (strcmp(op, "eq") == 0)
+		return NFT_CMP_EQ;
+	else if (strcmp(op, "neq") == 0)
+		return NFT_CMP_NEQ;
+	else if (strcmp(op, "lt") == 0)
+		return NFT_CMP_LT;
+	else if (strcmp(op, "lte") == 0)
+		return NFT_CMP_LTE;
+	else if (strcmp(op, "gt") == 0)
+		return NFT_CMP_GT;
+	else if (strcmp(op, "gte") == 0)
+		return NFT_CMP_GTE;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
+static int
+nftnl_expr_cmp_snprintf(char *buf, size_t remain,
+			uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_cmp *cmp = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "%s reg %u ",
+		       cmp2str(cmp->op), cmp->sreg);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &cmp->data,
+				      0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+struct expr_ops expr_ops_cmp = {
+	.name		= "cmp",
+	.alloc_len	= sizeof(struct nftnl_expr_cmp),
+	.max_attr	= NFTA_CMP_MAX,
+	.set		= nftnl_expr_cmp_set,
+	.get		= nftnl_expr_cmp_get,
+	.parse		= nftnl_expr_cmp_parse,
+	.build		= nftnl_expr_cmp_build,
+	.output		= nftnl_expr_cmp_snprintf,
+};
diff --git a/src/expr/connlimit.c b/src/expr/connlimit.c
new file mode 100644
index 0000000..549417b
--- /dev/null
+++ b/src/expr/connlimit.c
@@ -0,0 +1,139 @@
+/*
+ * (C) 2018 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_connlimit {
+	uint32_t	count;
+	uint32_t	flags;
+};
+
+static int
+nftnl_expr_connlimit_set(struct nftnl_expr *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_connlimit *connlimit = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CONNLIMIT_COUNT:
+		memcpy(&connlimit->count, data, sizeof(connlimit->count));
+		break;
+	case NFTNL_EXPR_CONNLIMIT_FLAGS:
+		memcpy(&connlimit->flags, data, sizeof(connlimit->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_connlimit_get(const struct nftnl_expr *e, uint16_t type,
+			  uint32_t *data_len)
+{
+	struct nftnl_expr_connlimit *connlimit = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CONNLIMIT_COUNT:
+		*data_len = sizeof(connlimit->count);
+		return &connlimit->count;
+	case NFTNL_EXPR_CONNLIMIT_FLAGS:
+		*data_len = sizeof(connlimit->flags);
+		return &connlimit->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_connlimit_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_CONNLIMIT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_CONNLIMIT_COUNT:
+	case NFTA_CONNLIMIT_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_connlimit_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_connlimit *connlimit = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_CONNLIMIT_COUNT))
+		mnl_attr_put_u32(nlh, NFTA_CONNLIMIT_COUNT,
+				 htonl(connlimit->count));
+	if (e->flags & (1 << NFTNL_EXPR_CONNLIMIT_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_CONNLIMIT_FLAGS,
+				 htonl(connlimit->flags));
+}
+
+static int
+nftnl_expr_connlimit_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_connlimit *connlimit = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_CONNLIMIT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_connlimit_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CONNLIMIT_COUNT]) {
+		connlimit->count =
+			ntohl(mnl_attr_get_u32(tb[NFTA_CONNLIMIT_COUNT]));
+		e->flags |= (1 << NFTNL_EXPR_CONNLIMIT_COUNT);
+	}
+	if (tb[NFTA_CONNLIMIT_FLAGS]) {
+		connlimit->flags =
+			ntohl(mnl_attr_get_u32(tb[NFTA_CONNLIMIT_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_CONNLIMIT_FLAGS);
+	}
+
+	return 0;
+}
+
+static int nftnl_expr_connlimit_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_expr *e)
+{
+	struct nftnl_expr_connlimit *connlimit = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "count %u flags %x ",
+			connlimit->count, connlimit->flags);
+}
+
+struct expr_ops expr_ops_connlimit = {
+	.name		= "connlimit",
+	.alloc_len	= sizeof(struct nftnl_expr_connlimit),
+	.max_attr	= NFTA_CONNLIMIT_MAX,
+	.set		= nftnl_expr_connlimit_set,
+	.get		= nftnl_expr_connlimit_get,
+	.parse		= nftnl_expr_connlimit_parse,
+	.build		= nftnl_expr_connlimit_build,
+	.output		= nftnl_expr_connlimit_snprintf,
+};
diff --git a/src/expr/counter.c b/src/expr/counter.c
new file mode 100644
index 0000000..d139a5f
--- /dev/null
+++ b/src/expr/counter.c
@@ -0,0 +1,137 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_counter {
+	uint64_t	pkts;
+	uint64_t	bytes;
+};
+
+static int
+nftnl_expr_counter_set(struct nftnl_expr *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_counter *ctr = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CTR_BYTES:
+		memcpy(&ctr->bytes, data, sizeof(ctr->bytes));
+		break;
+	case NFTNL_EXPR_CTR_PACKETS:
+		memcpy(&ctr->pkts, data, sizeof(ctr->pkts));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_counter_get(const struct nftnl_expr *e, uint16_t type,
+			  uint32_t *data_len)
+{
+	struct nftnl_expr_counter *ctr = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CTR_BYTES:
+		*data_len = sizeof(ctr->bytes);
+		return &ctr->bytes;
+	case NFTNL_EXPR_CTR_PACKETS:
+		*data_len = sizeof(ctr->pkts);
+		return &ctr->pkts;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_counter_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_COUNTER_BYTES:
+	case NFTA_COUNTER_PACKETS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_counter_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_counter *ctr = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_CTR_BYTES))
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, htobe64(ctr->bytes));
+	if (e->flags & (1 << NFTNL_EXPR_CTR_PACKETS))
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, htobe64(ctr->pkts));
+}
+
+static int
+nftnl_expr_counter_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_counter *ctr = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_COUNTER_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_counter_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_COUNTER_BYTES]) {
+		ctr->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES]));
+		e->flags |= (1 << NFTNL_EXPR_CTR_BYTES);
+	}
+	if (tb[NFTA_COUNTER_PACKETS]) {
+		ctr->pkts = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS]));
+		e->flags |= (1 << NFTNL_EXPR_CTR_PACKETS);
+	}
+
+	return 0;
+}
+
+static int nftnl_expr_counter_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_expr *e)
+{
+	struct nftnl_expr_counter *ctr = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "pkts %"PRIu64" bytes %"PRIu64" ",
+			ctr->pkts, ctr->bytes);
+}
+
+struct expr_ops expr_ops_counter = {
+	.name		= "counter",
+	.alloc_len	= sizeof(struct nftnl_expr_counter),
+	.max_attr	= NFTA_COUNTER_MAX,
+	.set		= nftnl_expr_counter_set,
+	.get		= nftnl_expr_counter_get,
+	.parse		= nftnl_expr_counter_parse,
+	.build		= nftnl_expr_counter_build,
+	.output		= nftnl_expr_counter_snprintf,
+};
diff --git a/src/expr/ct.c b/src/expr/ct.c
new file mode 100644
index 0000000..f4a2aea
--- /dev/null
+++ b/src/expr/ct.c
@@ -0,0 +1,262 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_ct {
+	enum nft_ct_keys        key;
+	enum nft_registers	dreg;
+	enum nft_registers	sreg;
+	uint8_t			dir;
+};
+
+#define IP_CT_DIR_ORIGINAL	0
+#define IP_CT_DIR_REPLY		1
+
+static int
+nftnl_expr_ct_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_ct *ct = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CT_KEY:
+		memcpy(&ct->key, data, sizeof(ct->key));
+		break;
+	case NFTNL_EXPR_CT_DIR:
+		memcpy(&ct->dir, data, sizeof(ct->dir));
+		break;
+	case NFTNL_EXPR_CT_DREG:
+		memcpy(&ct->dreg, data, sizeof(ct->dreg));
+		break;
+	case NFTNL_EXPR_CT_SREG:
+		memcpy(&ct->sreg, data, sizeof(ct->sreg));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_ct_get(const struct nftnl_expr *e, uint16_t type,
+		     uint32_t *data_len)
+{
+	struct nftnl_expr_ct *ct = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_CT_KEY:
+		*data_len = sizeof(ct->key);
+		return &ct->key;
+	case NFTNL_EXPR_CT_DIR:
+		*data_len = sizeof(ct->dir);
+		return &ct->dir;
+	case NFTNL_EXPR_CT_DREG:
+		*data_len = sizeof(ct->dreg);
+		return &ct->dreg;
+	case NFTNL_EXPR_CT_SREG:
+		*data_len = sizeof(ct->sreg);
+		return &ct->sreg;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_ct_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_CT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_CT_KEY:
+	case NFTA_CT_DREG:
+	case NFTA_CT_SREG:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_DIRECTION:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_ct_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_ct *ct = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_CT_KEY))
+		mnl_attr_put_u32(nlh, NFTA_CT_KEY, htonl(ct->key));
+	if (e->flags & (1 << NFTNL_EXPR_CT_DREG))
+		mnl_attr_put_u32(nlh, NFTA_CT_DREG, htonl(ct->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_CT_DIR))
+		mnl_attr_put_u8(nlh, NFTA_CT_DIRECTION, ct->dir);
+	if (e->flags & (1 << NFTNL_EXPR_CT_SREG))
+		mnl_attr_put_u32(nlh, NFTA_CT_SREG, htonl(ct->sreg));
+}
+
+static int
+nftnl_expr_ct_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_ct *ct = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_CT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_ct_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CT_KEY]) {
+		ct->key = ntohl(mnl_attr_get_u32(tb[NFTA_CT_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_CT_KEY);
+	}
+	if (tb[NFTA_CT_DREG]) {
+		ct->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_CT_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_CT_DREG);
+	}
+	if (tb[NFTA_CT_SREG]) {
+		ct->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_CT_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_CT_SREG);
+	}
+	if (tb[NFTA_CT_DIRECTION]) {
+		ct->dir = mnl_attr_get_u8(tb[NFTA_CT_DIRECTION]);
+		e->flags |= (1 << NFTNL_EXPR_CT_DIR);
+	}
+
+	return 0;
+}
+
+static const char *ctkey2str_array[NFT_CT_MAX + 1] = {
+	[NFT_CT_STATE]		= "state",
+	[NFT_CT_DIRECTION]	= "direction",
+	[NFT_CT_STATUS]		= "status",
+	[NFT_CT_MARK]		= "mark",
+	[NFT_CT_SECMARK]	= "secmark",
+	[NFT_CT_EXPIRATION]	= "expiration",
+	[NFT_CT_HELPER]		= "helper",
+	[NFT_CT_L3PROTOCOL]	= "l3protocol",
+	[NFT_CT_PROTOCOL]	= "protocol",
+	[NFT_CT_SRC]		= "src",
+	[NFT_CT_DST]		= "dst",
+	[NFT_CT_PROTO_SRC]	= "proto_src",
+	[NFT_CT_PROTO_DST]	= "proto_dst",
+	[NFT_CT_LABELS]		= "label",
+	[NFT_CT_PKTS]		= "packets",
+	[NFT_CT_BYTES]		= "bytes",
+	[NFT_CT_AVGPKT]		= "avgpkt",
+	[NFT_CT_ZONE]		= "zone",
+	[NFT_CT_EVENTMASK]	= "event",
+	[NFT_CT_SRC_IP]		= "src_ip",
+	[NFT_CT_DST_IP]		= "dst_ip",
+	[NFT_CT_SRC_IP6]	= "src_ip6",
+	[NFT_CT_DST_IP6]	= "dst_ip6",
+	[NFT_CT_ID]		= "id",
+};
+
+static const char *ctkey2str(uint32_t ctkey)
+{
+	if (ctkey >= NFT_CT_MAX)
+		return "unknown";
+
+	return ctkey2str_array[ctkey];
+}
+
+static inline int str2ctkey(const char *ctkey)
+{
+	int i;
+
+	for (i = 0; i < NFT_CT_MAX; i++) {
+		if (strcmp(ctkey2str_array[i], ctkey) == 0)
+			return i;
+	}
+
+	return -1;
+}
+
+static const char *ctdir2str(uint8_t ctdir)
+{
+	switch (ctdir) {
+	case IP_CT_DIR_ORIGINAL:
+		return "original";
+	case IP_CT_DIR_REPLY:
+		return "reply";
+	default:
+		return "unknown";
+	}
+}
+
+static inline int str2ctdir(const char *str, uint8_t *ctdir)
+{
+	if (strcmp(str, "original") == 0) {
+		*ctdir = IP_CT_DIR_ORIGINAL;
+		return 0;
+	}
+
+	if (strcmp(str, "reply") == 0) {
+		*ctdir = IP_CT_DIR_REPLY;
+		return 0;
+	}
+
+	return -1;
+}
+
+static int
+nftnl_expr_ct_snprintf(char *buf, size_t remain,
+		       uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_ct *ct = nftnl_expr_data(e);
+	int ret, offset = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_CT_SREG)) {
+		ret = snprintf(buf, remain, "set %s with reg %u ",
+				ctkey2str(ct->key), ct->sreg);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_CT_DREG)) {
+		ret = snprintf(buf, remain, "load %s => reg %u ",
+			       ctkey2str(ct->key), ct->dreg);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (nftnl_expr_is_set(e, NFTNL_EXPR_CT_DIR)) {
+		ret = snprintf(buf + offset, remain, ", dir %s ",
+			       ctdir2str(ct->dir));
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_ct = {
+	.name		= "ct",
+	.alloc_len	= sizeof(struct nftnl_expr_ct),
+	.max_attr	= NFTA_CT_MAX,
+	.set		= nftnl_expr_ct_set,
+	.get		= nftnl_expr_ct_get,
+	.parse		= nftnl_expr_ct_parse,
+	.build		= nftnl_expr_ct_build,
+	.output		= nftnl_expr_ct_snprintf,
+};
diff --git a/src/expr/data_reg.c b/src/expr/data_reg.c
new file mode 100644
index 0000000..2633a77
--- /dev/null
+++ b/src/expr/data_reg.c
@@ -0,0 +1,219 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <limits.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <netinet/in.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+#include "internal.h"
+
+static int
+nftnl_data_reg_value_snprintf_default(char *buf, size_t remain,
+				      const union nftnl_data_reg *reg,
+				      uint32_t flags)
+{
+	const char *pfx = flags & DATA_F_NOPFX ? "" : "0x";
+	int offset = 0, ret, i;
+
+
+
+	for (i = 0; i < div_round_up(reg->len, sizeof(uint32_t)); i++) {
+		ret = snprintf(buf + offset, remain,
+			       "%s%.8x ", pfx, reg->val[i]);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+static int
+nftnl_data_reg_verdict_snprintf_def(char *buf, size_t size,
+				    const union nftnl_data_reg *reg,
+				    uint32_t flags)
+{
+	int remain = size, offset = 0, ret = 0;
+
+	ret = snprintf(buf, size, "%s ", nftnl_verdict2str(reg->verdict));
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (reg->chain != NULL) {
+		ret = snprintf(buf + offset, remain, "-> %s ", reg->chain);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+int nftnl_data_reg_snprintf(char *buf, size_t size,
+			    const union nftnl_data_reg *reg,
+			    uint32_t flags, int reg_type)
+{
+	switch(reg_type) {
+	case DATA_VALUE:
+		return nftnl_data_reg_value_snprintf_default(buf, size,
+							     reg, flags);
+	case DATA_VERDICT:
+	case DATA_CHAIN:
+		return nftnl_data_reg_verdict_snprintf_def(buf, size,
+							   reg, flags);
+	default:
+		return -1;
+	}
+}
+
+static int nftnl_data_parse_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_DATA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_DATA_VALUE:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	case NFTA_DATA_VERDICT:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_verdict_parse_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_VERDICT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_VERDICT_CODE:
+	case NFTA_VERDICT_CHAIN_ID:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_VERDICT_CHAIN:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	}
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_parse_verdict(union nftnl_data_reg *data, const struct nlattr *attr, int *type)
+{
+	struct nlattr *tb[NFTA_VERDICT_MAX+1];
+
+	if (mnl_attr_parse_nested(attr, nftnl_verdict_parse_cb, tb) < 0)
+		return -1;
+
+	if (!tb[NFTA_VERDICT_CODE])
+		return -1;
+
+	data->verdict = ntohl(mnl_attr_get_u32(tb[NFTA_VERDICT_CODE]));
+
+	switch(data->verdict) {
+	case NF_ACCEPT:
+	case NF_DROP:
+	case NF_QUEUE:
+	case NFT_CONTINUE:
+	case NFT_BREAK:
+	case NFT_RETURN:
+		if (type)
+			*type = DATA_VERDICT;
+		data->len = sizeof(data->verdict);
+		break;
+	case NFT_JUMP:
+	case NFT_GOTO:
+		if (!tb[NFTA_VERDICT_CHAIN])
+			return -1;
+
+		data->chain = strdup(mnl_attr_get_str(tb[NFTA_VERDICT_CHAIN]));
+		if (!data->chain)
+			return -1;
+
+		if (type)
+			*type = DATA_CHAIN;
+		break;
+	default:
+		return -1;
+	}
+
+	return 0;
+}
+
+static int
+__nftnl_parse_data(union nftnl_data_reg *data, const struct nlattr *attr)
+{
+	void *orig = mnl_attr_get_payload(attr);
+	uint32_t data_len = mnl_attr_get_payload_len(attr);
+
+	if (data_len == 0)
+		return -1;
+
+	if (data_len > sizeof(data->val))
+		return -1;
+
+	memcpy(data->val, orig, data_len);
+	data->len = data_len;
+
+	return 0;
+}
+
+int nftnl_parse_data(union nftnl_data_reg *data, struct nlattr *attr, int *type)
+{
+	struct nlattr *tb[NFTA_DATA_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_data_parse_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_DATA_VALUE]) {
+		if (type)
+			*type = DATA_VALUE;
+
+		ret = __nftnl_parse_data(data, tb[NFTA_DATA_VALUE]);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_DATA_VERDICT])
+		ret = nftnl_parse_verdict(data, tb[NFTA_DATA_VERDICT], type);
+
+	return ret;
+}
+
+void nftnl_free_verdict(const union nftnl_data_reg *data)
+{
+	switch(data->verdict) {
+	case NFT_JUMP:
+	case NFT_GOTO:
+		xfree(data->chain);
+		break;
+	default:
+		break;
+	}
+}
diff --git a/src/expr/dup.c b/src/expr/dup.c
new file mode 100644
index 0000000..a239ff3
--- /dev/null
+++ b/src/expr/dup.c
@@ -0,0 +1,142 @@
+/*
+ * (C) 2015 Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+#include "expr_ops.h"
+#include "data_reg.h"
+
+struct nftnl_expr_dup {
+	enum nft_registers	sreg_addr;
+	enum nft_registers	sreg_dev;
+};
+
+static int nftnl_expr_dup_set(struct nftnl_expr *e, uint16_t type,
+			      const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_dup *dup = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_DUP_SREG_ADDR:
+		memcpy(&dup->sreg_addr, data, sizeof(dup->sreg_addr));
+		break;
+	case NFTNL_EXPR_DUP_SREG_DEV:
+		memcpy(&dup->sreg_dev, data, sizeof(dup->sreg_dev));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_dup_get(const struct nftnl_expr *e,
+				      uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_dup *dup = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_DUP_SREG_ADDR:
+		*data_len = sizeof(dup->sreg_addr);
+		return &dup->sreg_addr;
+	case NFTNL_EXPR_DUP_SREG_DEV:
+		*data_len = sizeof(dup->sreg_dev);
+		return &dup->sreg_dev;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_dup_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_DUP_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_DUP_SREG_ADDR:
+	case NFTA_DUP_SREG_DEV:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_expr_dup_build(struct nlmsghdr *nlh,
+				 const struct nftnl_expr *e)
+{
+	struct nftnl_expr_dup *dup = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_DUP_SREG_ADDR))
+		mnl_attr_put_u32(nlh, NFTA_DUP_SREG_ADDR, htonl(dup->sreg_addr));
+	if (e->flags & (1 << NFTNL_EXPR_DUP_SREG_DEV))
+		mnl_attr_put_u32(nlh, NFTA_DUP_SREG_DEV, htonl(dup->sreg_dev));
+}
+
+static int nftnl_expr_dup_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_dup *dup = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_DUP_MAX + 1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_dup_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_DUP_SREG_ADDR]) {
+		dup->sreg_addr = ntohl(mnl_attr_get_u32(tb[NFTA_DUP_SREG_ADDR]));
+		e->flags |= (1 << NFTNL_EXPR_DUP_SREG_ADDR);
+	}
+	if (tb[NFTA_DUP_SREG_DEV]) {
+		dup->sreg_dev = ntohl(mnl_attr_get_u32(tb[NFTA_DUP_SREG_DEV]));
+		e->flags |= (1 << NFTNL_EXPR_DUP_SREG_DEV);
+	}
+
+	return ret;
+}
+
+static int nftnl_expr_dup_snprintf(char *buf, size_t remain,
+				   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_dup *dup = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	if (e->flags & (1 << NFTNL_EXPR_DUP_SREG_ADDR)) {
+		ret = snprintf(buf + offset, remain, "sreg_addr %u ", dup->sreg_addr);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_DUP_SREG_DEV)) {
+		ret = snprintf(buf + offset, remain, "sreg_dev %u ", dup->sreg_dev);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_dup = {
+	.name		= "dup",
+	.alloc_len	= sizeof(struct nftnl_expr_dup),
+	.max_attr	= NFTA_DUP_MAX,
+	.set		= nftnl_expr_dup_set,
+	.get		= nftnl_expr_dup_get,
+	.parse		= nftnl_expr_dup_parse,
+	.build		= nftnl_expr_dup_build,
+	.output		= nftnl_expr_dup_snprintf,
+};
diff --git a/src/expr/dynset.c b/src/expr/dynset.c
new file mode 100644
index 0000000..5bcf1c6
--- /dev/null
+++ b/src/expr/dynset.c
@@ -0,0 +1,377 @@
+/*
+ * Copyright (c) 2014, 2015 Patrick McHardy <kaber@trash.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <inttypes.h>
+#include <errno.h>
+#include <arpa/inet.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/rule.h>
+#include <libnftnl/expr.h>
+#include "data_reg.h"
+#include "expr_ops.h"
+
+struct nftnl_expr_dynset {
+	enum nft_registers	sreg_key;
+	enum nft_registers	sreg_data;
+	enum nft_dynset_ops	op;
+	uint64_t		timeout;
+	struct list_head	expr_list;
+	char			*set_name;
+	uint32_t		set_id;
+	uint32_t		dynset_flags;
+};
+
+static int
+nftnl_expr_dynset_set(struct nftnl_expr *e, uint16_t type,
+			 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nftnl_expr *expr, *next;
+
+	switch (type) {
+	case NFTNL_EXPR_DYNSET_SREG_KEY:
+		memcpy(&dynset->sreg_key, data, sizeof(dynset->sreg_key));
+		break;
+	case NFTNL_EXPR_DYNSET_SREG_DATA:
+		memcpy(&dynset->sreg_data, data, sizeof(dynset->sreg_data));
+		break;
+	case NFTNL_EXPR_DYNSET_OP:
+		memcpy(&dynset->op, data, sizeof(dynset->op));
+		break;
+	case NFTNL_EXPR_DYNSET_TIMEOUT:
+		memcpy(&dynset->timeout, data, sizeof(dynset->timeout));
+		break;
+	case NFTNL_EXPR_DYNSET_SET_NAME:
+		dynset->set_name = strdup((const char *)data);
+		if (!dynset->set_name)
+			return -1;
+		break;
+	case NFTNL_EXPR_DYNSET_SET_ID:
+		memcpy(&dynset->set_id, data, sizeof(dynset->set_id));
+		break;
+	case NFTNL_EXPR_DYNSET_EXPR:
+		list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
+			nftnl_expr_free(expr);
+
+		expr = (void *)data;
+		list_add(&expr->head, &dynset->expr_list);
+		break;
+	case NFTNL_EXPR_DYNSET_FLAGS:
+		memcpy(&dynset->dynset_flags, data, sizeof(dynset->dynset_flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_dynset_get(const struct nftnl_expr *e, uint16_t type,
+			 uint32_t *data_len)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nftnl_expr *expr;
+
+	switch (type) {
+	case NFTNL_EXPR_DYNSET_SREG_KEY:
+		*data_len = sizeof(dynset->sreg_key);
+		return &dynset->sreg_key;
+	case NFTNL_EXPR_DYNSET_SREG_DATA:
+		*data_len = sizeof(dynset->sreg_data);
+		return &dynset->sreg_data;
+	case NFTNL_EXPR_DYNSET_OP:
+		*data_len = sizeof(dynset->op);
+		return &dynset->op;
+	case NFTNL_EXPR_DYNSET_TIMEOUT:
+		*data_len = sizeof(dynset->timeout);
+		return &dynset->timeout;
+	case NFTNL_EXPR_DYNSET_SET_NAME:
+		*data_len = strlen(dynset->set_name) + 1;
+		return dynset->set_name;
+	case NFTNL_EXPR_DYNSET_SET_ID:
+		*data_len = sizeof(dynset->set_id);
+		return &dynset->set_id;
+	case NFTNL_EXPR_DYNSET_EXPR:
+		list_for_each_entry(expr, &dynset->expr_list, head)
+			break;
+		return expr;
+	case NFTNL_EXPR_DYNSET_FLAGS:
+		*data_len = sizeof(dynset->dynset_flags);
+		return &dynset->dynset_flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_dynset_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_SET_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_DYNSET_SREG_KEY:
+	case NFTA_DYNSET_SREG_DATA:
+	case NFTA_DYNSET_SET_ID:
+	case NFTA_DYNSET_OP:
+	case NFTA_DYNSET_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_DYNSET_TIMEOUT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_DYNSET_SET_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_DYNSET_EXPR:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_dynset_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nlattr *nest;
+	int num_exprs = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_KEY))
+		mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_KEY, htonl(dynset->sreg_key));
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA))
+		mnl_attr_put_u32(nlh, NFTA_DYNSET_SREG_DATA, htonl(dynset->sreg_data));
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_OP))
+		mnl_attr_put_u32(nlh, NFTA_DYNSET_OP, htonl(dynset->op));
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT))
+		mnl_attr_put_u64(nlh, NFTA_DYNSET_TIMEOUT, htobe64(dynset->timeout));
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_NAME))
+		mnl_attr_put_strz(nlh, NFTA_DYNSET_SET_NAME, dynset->set_name);
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_SET_ID))
+		mnl_attr_put_u32(nlh, NFTA_DYNSET_SET_ID, htonl(dynset->set_id));
+	if (!list_empty(&dynset->expr_list)) {
+		struct nftnl_expr *expr;
+
+		list_for_each_entry(expr, &dynset->expr_list, head)
+			num_exprs++;
+
+		if (num_exprs == 1) {
+			nest = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPR);
+			list_for_each_entry(expr, &dynset->expr_list, head)
+				nftnl_expr_build_payload(nlh, expr);
+			mnl_attr_nest_end(nlh, nest);
+		} else if (num_exprs > 1) {
+			struct nlattr *nest1, *nest2;
+
+			nest1 = mnl_attr_nest_start(nlh, NFTA_DYNSET_EXPRESSIONS);
+			list_for_each_entry(expr, &dynset->expr_list, head) {
+				nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
+				nftnl_expr_build_payload(nlh, expr);
+				mnl_attr_nest_end(nlh, nest2);
+			}
+			mnl_attr_nest_end(nlh, nest1);
+		}
+	}
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_DYNSET_FLAGS,
+				 htonl(dynset->dynset_flags));
+}
+
+EXPORT_SYMBOL(nftnl_expr_add_expr);
+void nftnl_expr_add_expr(struct nftnl_expr *e, uint32_t type,
+			 struct nftnl_expr *expr)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+
+	list_add_tail(&expr->head, &dynset->expr_list);
+}
+
+EXPORT_SYMBOL(nftnl_expr_expr_foreach);
+int nftnl_expr_expr_foreach(const struct nftnl_expr *e,
+			    int (*cb)(struct nftnl_expr *e, void *data),
+			    void *data)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nftnl_expr *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &dynset->expr_list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+static int
+nftnl_expr_dynset_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_SET_MAX+1] = {};
+	struct nftnl_expr *expr, *next;
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_dynset_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_DYNSET_SREG_KEY]) {
+		dynset->sreg_key = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_KEY);
+	}
+	if (tb[NFTA_DYNSET_SREG_DATA]) {
+		dynset->sreg_data = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SREG_DATA]));
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_SREG_DATA);
+	}
+	if (tb[NFTA_DYNSET_OP]) {
+		dynset->op = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_OP]));
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_OP);
+	}
+	if (tb[NFTA_DYNSET_TIMEOUT]) {
+		dynset->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_DYNSET_TIMEOUT]));
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_TIMEOUT);
+	}
+	if (tb[NFTA_DYNSET_SET_NAME]) {
+		dynset->set_name =
+			strdup(mnl_attr_get_str(tb[NFTA_DYNSET_SET_NAME]));
+		if (!dynset->set_name)
+			return -1;
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_NAME);
+	}
+	if (tb[NFTA_DYNSET_SET_ID]) {
+		dynset->set_id = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_SET_ID]));
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_SET_ID);
+	}
+	if (tb[NFTA_DYNSET_EXPR]) {
+		expr = nftnl_expr_parse(tb[NFTA_DYNSET_EXPR]);
+		if (expr == NULL)
+			return -1;
+
+		list_add(&expr->head, &dynset->expr_list);
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPR);
+	} else if (tb[NFTA_DYNSET_EXPRESSIONS]) {
+		struct nlattr *attr2;
+
+		mnl_attr_for_each_nested(attr2, tb[NFTA_DYNSET_EXPRESSIONS]) {
+			if (mnl_attr_get_type(attr2) != NFTA_LIST_ELEM)
+				goto out_dynset_expr;
+
+			expr = nftnl_expr_parse(attr2);
+			if (!expr)
+				goto out_dynset_expr;
+
+			list_add_tail(&expr->head, &dynset->expr_list);
+		}
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_EXPRESSIONS);
+	}
+	if (tb[NFTA_DYNSET_FLAGS]) {
+		dynset->dynset_flags = ntohl(mnl_attr_get_u32(tb[NFTA_DYNSET_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_DYNSET_FLAGS);
+	}
+
+	return ret;
+out_dynset_expr:
+	list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
+		nftnl_expr_free(expr);
+
+	return -1;
+}
+
+static const char *op2str_array[] = {
+	[NFT_DYNSET_OP_ADD]		= "add",
+	[NFT_DYNSET_OP_UPDATE] 		= "update",
+	[NFT_DYNSET_OP_DELETE]		= "delete",
+};
+
+static const char *op2str(enum nft_dynset_ops op)
+{
+	if (op > NFT_DYNSET_OP_DELETE)
+		return "unknown";
+	return op2str_array[op];
+}
+
+static int
+nftnl_expr_dynset_snprintf(char *buf, size_t remain,
+			   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nftnl_expr *expr;
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "%s reg_key %u set %s ",
+		       op2str(dynset->op), dynset->sreg_key, dynset->set_name);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_SREG_DATA)) {
+		ret = snprintf(buf + offset, remain, "sreg_data %u ",
+			       dynset->sreg_data);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_DYNSET_TIMEOUT)) {
+		ret = snprintf(buf + offset, remain, "timeout %"PRIu64"ms ",
+			       dynset->timeout);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	list_for_each_entry(expr, &dynset->expr_list, head) {
+		ret = snprintf(buf + offset, remain, "expr [ %s ",
+			       expr->ops->name);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_expr_snprintf(buf + offset, remain, expr,
+					     NFTNL_OUTPUT_DEFAULT,
+					     NFTNL_OF_EVENT_ANY);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = snprintf(buf + offset, remain, "] ");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+static void nftnl_expr_dynset_init(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+
+	INIT_LIST_HEAD(&dynset->expr_list);
+}
+
+static void nftnl_expr_dynset_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_dynset *dynset = nftnl_expr_data(e);
+	struct nftnl_expr *expr, *next;
+
+	xfree(dynset->set_name);
+	list_for_each_entry_safe(expr, next, &dynset->expr_list, head)
+		nftnl_expr_free(expr);
+}
+
+struct expr_ops expr_ops_dynset = {
+	.name		= "dynset",
+	.alloc_len	= sizeof(struct nftnl_expr_dynset),
+	.max_attr	= NFTA_DYNSET_MAX,
+	.init		= nftnl_expr_dynset_init,
+	.free		= nftnl_expr_dynset_free,
+	.set		= nftnl_expr_dynset_set,
+	.get		= nftnl_expr_dynset_get,
+	.parse		= nftnl_expr_dynset_parse,
+	.build		= nftnl_expr_dynset_build,
+	.output		= nftnl_expr_dynset_snprintf,
+};
diff --git a/src/expr/exthdr.c b/src/expr/exthdr.c
new file mode 100644
index 0000000..739c7ff
--- /dev/null
+++ b/src/expr/exthdr.c
@@ -0,0 +1,271 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+#include <limits.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+#ifndef IPPROTO_MH
+#define IPPROTO_MH 135
+#endif
+
+struct nftnl_expr_exthdr {
+	enum nft_registers	dreg;
+	enum nft_registers	sreg;
+	uint32_t		offset;
+	uint32_t		len;
+	uint8_t			type;
+	uint32_t		op;
+	uint32_t		flags;
+};
+
+static int
+nftnl_expr_exthdr_set(struct nftnl_expr *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_exthdr *exthdr = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_EXTHDR_DREG:
+		memcpy(&exthdr->dreg, data, sizeof(exthdr->dreg));
+		break;
+	case NFTNL_EXPR_EXTHDR_TYPE:
+		memcpy(&exthdr->type, data, sizeof(exthdr->type));
+		break;
+	case NFTNL_EXPR_EXTHDR_OFFSET:
+		memcpy(&exthdr->offset, data, sizeof(exthdr->offset));
+		break;
+	case NFTNL_EXPR_EXTHDR_LEN:
+		memcpy(&exthdr->len, data, sizeof(exthdr->len));
+		break;
+	case NFTNL_EXPR_EXTHDR_OP:
+		memcpy(&exthdr->op, data, sizeof(exthdr->op));
+		break;
+	case NFTNL_EXPR_EXTHDR_FLAGS:
+		memcpy(&exthdr->flags, data, sizeof(exthdr->flags));
+		break;
+	case NFTNL_EXPR_EXTHDR_SREG:
+		memcpy(&exthdr->sreg, data, sizeof(exthdr->sreg));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_exthdr_get(const struct nftnl_expr *e, uint16_t type,
+			 uint32_t *data_len)
+{
+	struct nftnl_expr_exthdr *exthdr = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_EXTHDR_DREG:
+		*data_len = sizeof(exthdr->dreg);
+		return &exthdr->dreg;
+	case NFTNL_EXPR_EXTHDR_TYPE:
+		*data_len = sizeof(exthdr->type);
+		return &exthdr->type;
+	case NFTNL_EXPR_EXTHDR_OFFSET:
+		*data_len = sizeof(exthdr->offset);
+		return &exthdr->offset;
+	case NFTNL_EXPR_EXTHDR_LEN:
+		*data_len = sizeof(exthdr->len);
+		return &exthdr->len;
+	case NFTNL_EXPR_EXTHDR_OP:
+		*data_len = sizeof(exthdr->op);
+		return &exthdr->op;
+	case NFTNL_EXPR_EXTHDR_FLAGS:
+		*data_len = sizeof(exthdr->flags);
+		return &exthdr->flags;
+	case NFTNL_EXPR_EXTHDR_SREG:
+		*data_len = sizeof(exthdr->sreg);
+		return &exthdr->sreg;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_exthdr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_EXTHDR_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_EXTHDR_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	case NFTA_EXTHDR_DREG:
+	case NFTA_EXTHDR_SREG:
+	case NFTA_EXTHDR_OFFSET:
+	case NFTA_EXTHDR_LEN:
+	case NFTA_EXTHDR_OP:
+	case NFTA_EXTHDR_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_exthdr_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_exthdr *exthdr = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_DREG))
+		mnl_attr_put_u32(nlh, NFTA_EXTHDR_DREG, htonl(exthdr->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_SREG))
+		mnl_attr_put_u32(nlh, NFTA_EXTHDR_SREG, htonl(exthdr->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_TYPE))
+		mnl_attr_put_u8(nlh, NFTA_EXTHDR_TYPE, exthdr->type);
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_OFFSET))
+		mnl_attr_put_u32(nlh, NFTA_EXTHDR_OFFSET, htonl(exthdr->offset));
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_LEN))
+		mnl_attr_put_u32(nlh, NFTA_EXTHDR_LEN, htonl(exthdr->len));
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_OP))
+		mnl_attr_put_u32(nlh, NFTA_EXTHDR_OP, htonl(exthdr->op));
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_EXTHDR_FLAGS, htonl(exthdr->flags));
+}
+
+static int
+nftnl_expr_exthdr_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_exthdr *exthdr = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_EXTHDR_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_exthdr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_EXTHDR_DREG]) {
+		exthdr->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_EXTHDR_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_DREG);
+	}
+	if (tb[NFTA_EXTHDR_SREG]) {
+		exthdr->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_EXTHDR_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_SREG);
+	}
+	if (tb[NFTA_EXTHDR_TYPE]) {
+		exthdr->type = mnl_attr_get_u8(tb[NFTA_EXTHDR_TYPE]);
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_TYPE);
+	}
+	if (tb[NFTA_EXTHDR_OFFSET]) {
+		exthdr->offset = ntohl(mnl_attr_get_u32(tb[NFTA_EXTHDR_OFFSET]));
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_OFFSET);
+	}
+	if (tb[NFTA_EXTHDR_LEN]) {
+		exthdr->len = ntohl(mnl_attr_get_u32(tb[NFTA_EXTHDR_LEN]));
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_LEN);
+	}
+	if (tb[NFTA_EXTHDR_OP]) {
+		exthdr->op = ntohl(mnl_attr_get_u32(tb[NFTA_EXTHDR_OP]));
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_OP);
+	}
+	if (tb[NFTA_EXTHDR_FLAGS]) {
+		exthdr->flags = ntohl(mnl_attr_get_u32(tb[NFTA_EXTHDR_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_EXTHDR_FLAGS);
+	}
+
+	return 0;
+}
+
+static const char *op2str(uint8_t op)
+{
+	switch (op) {
+	case NFT_EXTHDR_OP_TCPOPT:
+		return " tcpopt";
+	case NFT_EXTHDR_OP_IPV6:
+		return " ipv6";
+	case NFT_EXTHDR_OP_IPV4:
+		return " ipv4";
+	default:
+		return "";
+	}
+}
+
+static inline int str2exthdr_op(const char* str)
+{
+	if (!strcmp(str, "tcpopt"))
+		return NFT_EXTHDR_OP_TCPOPT;
+	if (!strcmp(str, "ipv4"))
+		return NFT_EXTHDR_OP_IPV4;
+
+	/* if str == "ipv6" or anything else */
+	return NFT_EXTHDR_OP_IPV6;
+}
+
+static inline int str2exthdr_type(const char *str)
+{
+	if (strcmp(str, "hopopts") == 0)
+		return IPPROTO_HOPOPTS;
+	else if (strcmp(str, "routing") == 0)
+		return IPPROTO_ROUTING;
+	else if (strcmp(str, "fragment") == 0)
+		return IPPROTO_FRAGMENT;
+	else if (strcmp(str, "dstopts") == 0)
+		return IPPROTO_DSTOPTS;
+	else if (strcmp(str, "mh") == 0)
+		return IPPROTO_MH;
+
+	return -1;
+}
+
+static int
+nftnl_expr_exthdr_snprintf(char *buf, size_t len,
+			   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_exthdr *exthdr = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_EXTHDR_DREG))
+		return snprintf(buf, len, "load%s %ub @ %u + %u%s => reg %u ",
+				op2str(exthdr->op), exthdr->len, exthdr->type,
+				exthdr->offset,
+				exthdr->flags & NFT_EXTHDR_F_PRESENT ? " present" : "",
+				exthdr->dreg);
+	else if (e->flags & (1 << NFTNL_EXPR_EXTHDR_SREG))
+		return snprintf(buf, len, "write%s reg %u => %ub @ %u + %u ",
+				op2str(exthdr->op), exthdr->sreg, exthdr->len, exthdr->type,
+				exthdr->offset);
+	else if (exthdr->op == NFT_EXTHDR_OP_TCPOPT && exthdr->len == 0)
+		return snprintf(buf, len, "reset tcpopt %u ", exthdr->type);
+	else
+		return snprintf(buf, len, "op %u len %u type %u offset %u ",
+				exthdr->op, exthdr->len, exthdr->type, exthdr->offset);
+
+}
+
+struct expr_ops expr_ops_exthdr = {
+	.name		= "exthdr",
+	.alloc_len	= sizeof(struct nftnl_expr_exthdr),
+	.max_attr	= NFTA_EXTHDR_MAX,
+	.set		= nftnl_expr_exthdr_set,
+	.get		= nftnl_expr_exthdr_get,
+	.parse		= nftnl_expr_exthdr_parse,
+	.build		= nftnl_expr_exthdr_build,
+	.output		= nftnl_expr_exthdr_snprintf,
+};
diff --git a/src/expr/fib.c b/src/expr/fib.c
new file mode 100644
index 0000000..957f929
--- /dev/null
+++ b/src/expr/fib.c
@@ -0,0 +1,202 @@
+/*
+ * (C) 2016 Red Hat GmbH
+ * Author: Florian Westphal <fw@strlen.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <inttypes.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_fib {
+	uint32_t		flags;
+	uint32_t		result;
+	enum nft_registers	dreg;
+};
+
+static int
+nftnl_expr_fib_set(struct nftnl_expr *e, uint16_t result,
+		    const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_fib *fib = nftnl_expr_data(e);
+
+	switch (result) {
+	case NFTNL_EXPR_FIB_RESULT:
+		memcpy(&fib->result, data, sizeof(fib->result));
+		break;
+	case NFTNL_EXPR_FIB_DREG:
+		memcpy(&fib->dreg, data, sizeof(fib->dreg));
+		break;
+	case NFTNL_EXPR_FIB_FLAGS:
+		memcpy(&fib->flags, data, sizeof(fib->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_fib_get(const struct nftnl_expr *e, uint16_t result,
+		    uint32_t *data_len)
+{
+	struct nftnl_expr_fib *fib = nftnl_expr_data(e);
+
+	switch (result) {
+	case NFTNL_EXPR_FIB_RESULT:
+		*data_len = sizeof(fib->result);
+		return &fib->result;
+	case NFTNL_EXPR_FIB_DREG:
+		*data_len = sizeof(fib->dreg);
+		return &fib->dreg;
+	case NFTNL_EXPR_FIB_FLAGS:
+		*data_len = sizeof(fib->flags);
+		return &fib->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_fib_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_FIB_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_FIB_RESULT:
+	case NFTA_FIB_DREG:
+	case NFTA_FIB_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_fib_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_fib *fib = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_FIB_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_FIB_FLAGS, htonl(fib->flags));
+	if (e->flags & (1 << NFTNL_EXPR_FIB_RESULT))
+		mnl_attr_put_u32(nlh, NFTA_FIB_RESULT, htonl(fib->result));
+	if (e->flags & (1 << NFTNL_EXPR_FIB_DREG))
+		mnl_attr_put_u32(nlh, NFTA_FIB_DREG, htonl(fib->dreg));
+}
+
+static int
+nftnl_expr_fib_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_fib *fib = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_FIB_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_fib_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_FIB_RESULT]) {
+		fib->result = ntohl(mnl_attr_get_u32(tb[NFTA_FIB_RESULT]));
+		e->flags |= (1 << NFTNL_EXPR_FIB_RESULT);
+	}
+	if (tb[NFTA_FIB_DREG]) {
+		fib->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_FIB_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_FIB_DREG);
+	}
+	if (tb[NFTA_FIB_FLAGS]) {
+		fib->flags = ntohl(mnl_attr_get_u32(tb[NFTA_FIB_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_FIB_FLAGS);
+	}
+	return ret;
+}
+
+static const char *fib_type[NFT_FIB_RESULT_MAX + 1] = {
+	[NFT_FIB_RESULT_OIF] = "oif",
+	[NFT_FIB_RESULT_OIFNAME] = "oifname",
+	[NFT_FIB_RESULT_ADDRTYPE] = "type",
+};
+
+static const char *fib_type_str(enum nft_fib_result r)
+{
+	if (r <= NFT_FIB_RESULT_MAX)
+		return fib_type[r];
+
+	return "unknown";
+}
+
+static int
+nftnl_expr_fib_snprintf(char *buf, size_t remain,
+			 uint32_t printflags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_fib *fib = nftnl_expr_data(e);
+	uint32_t flags = fib->flags & ~NFTA_FIB_F_PRESENT;
+	uint32_t present_flag = fib->flags & NFTA_FIB_F_PRESENT;
+	int offset = 0, ret, i;
+	static const struct {
+		int bit;
+		const char *name;
+	} tab[] = {
+		{ NFTA_FIB_F_SADDR, "saddr" },
+		{ NFTA_FIB_F_DADDR, "daddr" },
+		{ NFTA_FIB_F_MARK, "mark" },
+		{ NFTA_FIB_F_IIF, "iif" },
+		{ NFTA_FIB_F_OIF, "oif" },
+	};
+
+	for (i = 0; i < (sizeof(tab) / sizeof(tab[0])); i++) {
+		if (flags & tab[i].bit) {
+			ret = snprintf(buf + offset, remain, "%s ",
+				       tab[i].name);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+			flags &= ~tab[i].bit;
+			if (flags) {
+				ret = snprintf(buf + offset, remain, ". ");
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+		}
+	}
+
+	if (flags) {
+		ret = snprintf(buf + offset, remain, "unknown 0x%" PRIx32,
+			       flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	ret = snprintf(buf + offset, remain, "%s%s => reg %d ",
+		       fib_type_str(fib->result),
+		       present_flag ? " present" : "",
+		       fib->dreg);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+struct expr_ops expr_ops_fib = {
+	.name		= "fib",
+	.alloc_len	= sizeof(struct nftnl_expr_fib),
+	.max_attr	= NFTA_FIB_MAX,
+	.set		= nftnl_expr_fib_set,
+	.get		= nftnl_expr_fib_get,
+	.parse		= nftnl_expr_fib_parse,
+	.build		= nftnl_expr_fib_build,
+	.output		= nftnl_expr_fib_snprintf,
+};
diff --git a/src/expr/flow_offload.c b/src/expr/flow_offload.c
new file mode 100644
index 0000000..4fc0563
--- /dev/null
+++ b/src/expr/flow_offload.c
@@ -0,0 +1,124 @@
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h> /* for memcpy */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/rule.h>
+#include <libnftnl/expr.h>
+
+struct nftnl_expr_flow {
+	char			*table_name;
+};
+
+static int nftnl_expr_flow_set(struct nftnl_expr *e, uint16_t type,
+			       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_flow *flow = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_FLOW_TABLE_NAME:
+		flow->table_name = strdup((const char *)data);
+		if (!flow->table_name)
+			return -1;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_flow_get(const struct nftnl_expr *e,
+				       uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_flow *flow = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_FLOW_TABLE_NAME:
+		*data_len = strlen(flow->table_name) + 1;
+		return flow->table_name;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_flow_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_FLOW_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_FLOW_TABLE_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_expr_flow_build(struct nlmsghdr *nlh,
+				  const struct nftnl_expr *e)
+{
+	struct nftnl_expr_flow *flow = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_FLOW_TABLE_NAME))
+		mnl_attr_put_strz(nlh, NFTA_FLOW_TABLE_NAME, flow->table_name);
+}
+
+static int nftnl_expr_flow_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_flow *flow = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_FLOW_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_flow_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_FLOW_TABLE_NAME]) {
+		flow->table_name =
+			strdup(mnl_attr_get_str(tb[NFTA_FLOW_TABLE_NAME]));
+		if (!flow->table_name)
+			return -1;
+		e->flags |= (1 << NFTNL_EXPR_FLOW_TABLE_NAME);
+	}
+
+	return ret;
+}
+
+static int nftnl_expr_flow_snprintf(char *buf, size_t remain,
+				    uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_flow *l = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "flowtable %s ", l->table_name);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+static void nftnl_expr_flow_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_flow *flow = nftnl_expr_data(e);
+
+	xfree(flow->table_name);
+}
+
+struct expr_ops expr_ops_flow = {
+	.name		= "flow_offload",
+	.alloc_len	= sizeof(struct nftnl_expr_flow),
+	.max_attr	= NFTA_FLOW_MAX,
+	.free		= nftnl_expr_flow_free,
+	.set		= nftnl_expr_flow_set,
+	.get		= nftnl_expr_flow_get,
+	.parse		= nftnl_expr_flow_parse,
+	.build		= nftnl_expr_flow_build,
+	.output		= nftnl_expr_flow_snprintf,
+};
diff --git a/src/expr/fwd.c b/src/expr/fwd.c
new file mode 100644
index 0000000..51f6612
--- /dev/null
+++ b/src/expr/fwd.c
@@ -0,0 +1,162 @@
+/*
+ * (C) 2015 Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+#include "expr_ops.h"
+#include "data_reg.h"
+
+struct nftnl_expr_fwd {
+	enum nft_registers	sreg_dev;
+	enum nft_registers	sreg_addr;
+	uint32_t		nfproto;
+};
+
+static int nftnl_expr_fwd_set(struct nftnl_expr *e, uint16_t type,
+				  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_fwd *fwd = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_FWD_SREG_DEV:
+		memcpy(&fwd->sreg_dev, data, sizeof(fwd->sreg_dev));
+		break;
+	case NFTNL_EXPR_FWD_SREG_ADDR:
+		memcpy(&fwd->sreg_addr, data, sizeof(fwd->sreg_addr));
+		break;
+	case NFTNL_EXPR_FWD_NFPROTO:
+		memcpy(&fwd->nfproto, data, sizeof(fwd->nfproto));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_fwd_get(const struct nftnl_expr *e,
+				      uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_fwd *fwd = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_FWD_SREG_DEV:
+		*data_len = sizeof(fwd->sreg_dev);
+		return &fwd->sreg_dev;
+	case NFTNL_EXPR_FWD_SREG_ADDR:
+		*data_len = sizeof(fwd->sreg_addr);
+		return &fwd->sreg_addr;
+	case NFTNL_EXPR_FWD_NFPROTO:
+		*data_len = sizeof(fwd->nfproto);
+		return &fwd->nfproto;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_fwd_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_FWD_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_FWD_SREG_DEV:
+	case NFTA_FWD_SREG_ADDR:
+	case NFTA_FWD_NFPROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_expr_fwd_build(struct nlmsghdr *nlh,
+				 const struct nftnl_expr *e)
+{
+	struct nftnl_expr_fwd *fwd = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_FWD_SREG_DEV))
+		mnl_attr_put_u32(nlh, NFTA_FWD_SREG_DEV, htonl(fwd->sreg_dev));
+	if (e->flags & (1 << NFTNL_EXPR_FWD_SREG_ADDR))
+		mnl_attr_put_u32(nlh, NFTA_FWD_SREG_ADDR, htonl(fwd->sreg_addr));
+	if (e->flags & (1 << NFTNL_EXPR_FWD_NFPROTO))
+		mnl_attr_put_u32(nlh, NFTA_FWD_NFPROTO, htonl(fwd->nfproto));
+}
+
+static int nftnl_expr_fwd_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_fwd *fwd = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_FWD_MAX + 1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_fwd_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_FWD_SREG_DEV]) {
+		fwd->sreg_dev = ntohl(mnl_attr_get_u32(tb[NFTA_FWD_SREG_DEV]));
+		e->flags |= (1 << NFTNL_EXPR_FWD_SREG_DEV);
+	}
+	if (tb[NFTA_FWD_SREG_ADDR]) {
+		fwd->sreg_addr = ntohl(mnl_attr_get_u32(tb[NFTA_FWD_SREG_ADDR]));
+		e->flags |= (1 << NFTNL_EXPR_FWD_SREG_ADDR);
+	}
+	if (tb[NFTA_FWD_NFPROTO]) {
+		fwd->nfproto = ntohl(mnl_attr_get_u32(tb[NFTA_FWD_NFPROTO]));
+		e->flags |= (1 << NFTNL_EXPR_FWD_NFPROTO);
+	}
+
+	return ret;
+}
+
+static int nftnl_expr_fwd_snprintf(char *buf, size_t remain,
+				   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_fwd *fwd = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	if (e->flags & (1 << NFTNL_EXPR_FWD_SREG_DEV)) {
+		ret = snprintf(buf + offset, remain, "sreg_dev %u ",
+			       fwd->sreg_dev);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_FWD_SREG_ADDR)) {
+		ret = snprintf(buf + offset, remain, "sreg_addr %u ",
+			       fwd->sreg_addr);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_FWD_NFPROTO)) {
+		ret = snprintf(buf + offset, remain, "nfproto %u ",
+			       fwd->nfproto);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_fwd = {
+	.name		= "fwd",
+	.alloc_len	= sizeof(struct nftnl_expr_fwd),
+	.max_attr	= NFTA_FWD_MAX,
+	.set		= nftnl_expr_fwd_set,
+	.get		= nftnl_expr_fwd_get,
+	.parse		= nftnl_expr_fwd_parse,
+	.build		= nftnl_expr_fwd_build,
+	.output		= nftnl_expr_fwd_snprintf,
+};
diff --git a/src/expr/hash.c b/src/expr/hash.c
new file mode 100644
index 0000000..6e2dd19
--- /dev/null
+++ b/src/expr/hash.c
@@ -0,0 +1,230 @@
+/*
+ * (C) 2016 by Laura Garcia <nevola@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_hash {
+	enum nft_hash_types	type;
+	enum nft_registers	sreg;
+	enum nft_registers	dreg;
+	unsigned int		len;
+	unsigned int		modulus;
+	unsigned int		seed;
+	unsigned int		offset;
+};
+
+static int
+nftnl_expr_hash_set(struct nftnl_expr *e, uint16_t type,
+		    const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_hash *hash = nftnl_expr_data(e);
+	switch (type) {
+	case NFTNL_EXPR_HASH_SREG:
+		memcpy(&hash->sreg, data, sizeof(hash->sreg));
+		break;
+	case NFTNL_EXPR_HASH_DREG:
+		memcpy(&hash->dreg, data, sizeof(hash->dreg));
+		break;
+	case NFTNL_EXPR_HASH_LEN:
+		memcpy(&hash->len, data, sizeof(hash->len));
+		break;
+	case NFTNL_EXPR_HASH_MODULUS:
+		memcpy(&hash->modulus, data, sizeof(hash->modulus));
+		break;
+	case NFTNL_EXPR_HASH_SEED:
+		memcpy(&hash->seed, data, sizeof(hash->seed));
+		break;
+	case NFTNL_EXPR_HASH_OFFSET:
+		memcpy(&hash->offset, data, sizeof(hash->offset));
+		break;
+	case NFTNL_EXPR_HASH_TYPE:
+		memcpy(&hash->type, data, sizeof(hash->type));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_hash_get(const struct nftnl_expr *e, uint16_t type,
+		    uint32_t *data_len)
+{
+	struct nftnl_expr_hash *hash = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_HASH_SREG:
+		*data_len = sizeof(hash->sreg);
+		return &hash->sreg;
+	case NFTNL_EXPR_HASH_DREG:
+		*data_len = sizeof(hash->dreg);
+		return &hash->dreg;
+	case NFTNL_EXPR_HASH_LEN:
+		*data_len = sizeof(hash->len);
+		return &hash->len;
+	case NFTNL_EXPR_HASH_MODULUS:
+		*data_len = sizeof(hash->modulus);
+		return &hash->modulus;
+	case NFTNL_EXPR_HASH_SEED:
+		*data_len = sizeof(hash->seed);
+		return &hash->seed;
+	case NFTNL_EXPR_HASH_OFFSET:
+		*data_len = sizeof(hash->offset);
+		return &hash->offset;
+	case NFTNL_EXPR_HASH_TYPE:
+		*data_len = sizeof(hash->type);
+		return &hash->type;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_hash_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_HASH_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_HASH_SREG:
+	case NFTA_HASH_DREG:
+	case NFTA_HASH_LEN:
+	case NFTA_HASH_MODULUS:
+	case NFTA_HASH_SEED:
+	case NFTA_HASH_OFFSET:
+	case NFTA_HASH_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_hash_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_hash *hash = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_HASH_SREG))
+		mnl_attr_put_u32(nlh, NFTA_HASH_SREG, htonl(hash->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_HASH_DREG))
+		mnl_attr_put_u32(nlh, NFTA_HASH_DREG, htonl(hash->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_HASH_LEN))
+		mnl_attr_put_u32(nlh, NFTA_HASH_LEN, htonl(hash->len));
+	if (e->flags & (1 << NFTNL_EXPR_HASH_MODULUS))
+		mnl_attr_put_u32(nlh, NFTA_HASH_MODULUS, htonl(hash->modulus));
+	if (e->flags & (1 << NFTNL_EXPR_HASH_SEED))
+		mnl_attr_put_u32(nlh, NFTA_HASH_SEED, htonl(hash->seed));
+	if (e->flags & (1 << NFTNL_EXPR_HASH_OFFSET))
+		mnl_attr_put_u32(nlh, NFTA_HASH_OFFSET, htonl(hash->offset));
+	if (e->flags & (1 << NFTNL_EXPR_HASH_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_HASH_TYPE, htonl(hash->type));
+}
+
+static int
+nftnl_expr_hash_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_hash *hash = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_HASH_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_hash_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_HASH_SREG]) {
+		hash->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_SREG);
+	}
+	if (tb[NFTA_HASH_DREG]) {
+		hash->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_DREG);
+	}
+	if (tb[NFTA_HASH_LEN]) {
+		hash->len = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_LEN]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_LEN);
+	}
+	if (tb[NFTA_HASH_MODULUS]) {
+		hash->modulus = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_MODULUS]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_MODULUS);
+	}
+	if (tb[NFTA_HASH_SEED]) {
+		hash->seed = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_SEED]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_SEED);
+	}
+	if (tb[NFTA_HASH_OFFSET]) {
+		hash->offset = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_OFFSET]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_OFFSET);
+	}
+	if (tb[NFTA_HASH_TYPE]) {
+		hash->type = ntohl(mnl_attr_get_u32(tb[NFTA_HASH_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_HASH_TYPE);
+	}
+
+	return ret;
+}
+
+static int
+nftnl_expr_hash_snprintf(char *buf, size_t remain,
+			 uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_hash *hash = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	switch (hash->type) {
+	case NFT_HASH_SYM:
+		ret =
+		snprintf(buf, remain, "reg %u = symhash() %% mod %u ",
+			 hash->dreg,
+			 hash->modulus);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		break;
+	case NFT_HASH_JENKINS:
+	default:
+		ret =
+		snprintf(buf, remain,
+			 "reg %u = jhash(reg %u, %u, 0x%x) %% mod %u ",
+			 hash->dreg, hash->sreg, hash->len, hash->seed,
+			 hash->modulus);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		break;
+	}
+
+	if (hash->offset) {
+		ret = snprintf(buf + offset, remain, "offset %u ",
+			       hash->offset);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_hash = {
+	.name		= "hash",
+	.alloc_len	= sizeof(struct nftnl_expr_hash),
+	.max_attr	= NFTA_HASH_MAX,
+	.set		= nftnl_expr_hash_set,
+	.get		= nftnl_expr_hash_get,
+	.parse		= nftnl_expr_hash_parse,
+	.build		= nftnl_expr_hash_build,
+	.output		= nftnl_expr_hash_snprintf,
+};
diff --git a/src/expr/immediate.c b/src/expr/immediate.c
new file mode 100644
index 0000000..5d477a8
--- /dev/null
+++ b/src/expr/immediate.c
@@ -0,0 +1,233 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_immediate {
+	union nftnl_data_reg	data;
+	enum nft_registers	dreg;
+};
+
+static int
+nftnl_expr_immediate_set(struct nftnl_expr *e, uint16_t type,
+			    const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_immediate *imm = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_IMM_DREG:
+		memcpy(&imm->dreg, data, sizeof(imm->dreg));
+		break;
+	case NFTNL_EXPR_IMM_DATA:
+		memcpy(&imm->data.val, data, data_len);
+		imm->data.len = data_len;
+		break;
+	case NFTNL_EXPR_IMM_VERDICT:
+		memcpy(&imm->data.verdict, data, sizeof(imm->data.verdict));
+		break;
+	case NFTNL_EXPR_IMM_CHAIN:
+		if (e->flags & (1 << NFTNL_EXPR_IMM_CHAIN))
+			xfree(imm->data.chain);
+
+		imm->data.chain = strdup(data);
+		if (!imm->data.chain)
+			return -1;
+		break;
+	case NFTNL_EXPR_IMM_CHAIN_ID:
+		memcpy(&imm->data.chain_id, data, sizeof(uint32_t));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_immediate_get(const struct nftnl_expr *e, uint16_t type,
+			    uint32_t *data_len)
+{
+	struct nftnl_expr_immediate *imm = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_IMM_DREG:
+		*data_len = sizeof(imm->dreg);
+		return &imm->dreg;
+	case NFTNL_EXPR_IMM_DATA:
+		*data_len = imm->data.len;
+		return &imm->data.val;
+	case NFTNL_EXPR_IMM_VERDICT:
+		*data_len = sizeof(imm->data.verdict);
+		return &imm->data.verdict;
+	case NFTNL_EXPR_IMM_CHAIN:
+		*data_len = strlen(imm->data.chain)+1;
+		return imm->data.chain;
+	case NFTNL_EXPR_IMM_CHAIN_ID:
+		*data_len = sizeof(imm->data.chain_id);
+		return &imm->data.chain_id;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_immediate_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_IMMEDIATE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_IMMEDIATE_DREG:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_IMMEDIATE_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_immediate_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_immediate *imm = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_IMM_DREG))
+		mnl_attr_put_u32(nlh, NFTA_IMMEDIATE_DREG, htonl(imm->dreg));
+
+	/* Sane configurations allows you to set ONLY one of these two below */
+	if (e->flags & (1 << NFTNL_EXPR_IMM_DATA)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_IMMEDIATE_DATA);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, imm->data.len, imm->data.val);
+		mnl_attr_nest_end(nlh, nest);
+
+	} else if (e->flags & (1 << NFTNL_EXPR_IMM_VERDICT)) {
+		struct nlattr *nest1, *nest2;
+
+		nest1 = mnl_attr_nest_start(nlh, NFTA_IMMEDIATE_DATA);
+		nest2 = mnl_attr_nest_start(nlh, NFTA_DATA_VERDICT);
+		mnl_attr_put_u32(nlh, NFTA_VERDICT_CODE, htonl(imm->data.verdict));
+		if (e->flags & (1 << NFTNL_EXPR_IMM_CHAIN))
+			mnl_attr_put_strz(nlh, NFTA_VERDICT_CHAIN, imm->data.chain);
+		if (e->flags & (1 << NFTNL_EXPR_IMM_CHAIN_ID)) {
+			mnl_attr_put_u32(nlh, NFTA_VERDICT_CHAIN_ID,
+					 htonl(imm->data.chain_id));
+		}
+
+		mnl_attr_nest_end(nlh, nest1);
+		mnl_attr_nest_end(nlh, nest2);
+	}
+}
+
+static int
+nftnl_expr_immediate_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_immediate *imm = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_IMMEDIATE_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_immediate_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_IMMEDIATE_DREG]) {
+		imm->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_IMMEDIATE_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_IMM_DREG);
+	}
+	if (tb[NFTA_IMMEDIATE_DATA]) {
+		int type;
+
+		ret = nftnl_parse_data(&imm->data, tb[NFTA_IMMEDIATE_DATA], &type);
+		if (ret < 0)
+			return ret;
+
+		switch(type) {
+		case DATA_VALUE:
+			/* real immediate data to be loaded to destination */
+			e->flags |= (1 << NFTNL_EXPR_IMM_DATA);
+			break;
+		case DATA_VERDICT:
+			/* NF_ACCEPT, NF_DROP, NF_QUEUE and NFTNL_RETURN case */
+			e->flags |= (1 << NFTNL_EXPR_IMM_VERDICT);
+			break;
+		case DATA_CHAIN:
+			/* NFTNL_GOTO and NFTNL_JUMP case */
+			e->flags |= (1 << NFTNL_EXPR_IMM_VERDICT) |
+				    (1 << NFTNL_EXPR_IMM_CHAIN);
+			break;
+		}
+	}
+
+	return ret;
+}
+
+static int
+nftnl_expr_immediate_snprintf(char *buf, size_t remain,
+			      uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_immediate *imm = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "reg %u ", imm->dreg);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->flags & (1 << NFTNL_EXPR_IMM_DATA)) {
+		ret = nftnl_data_reg_snprintf(buf + offset, remain, &imm->data,
+					      flags, DATA_VALUE);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	} else if (e->flags & (1 << NFTNL_EXPR_IMM_VERDICT)) {
+		ret = nftnl_data_reg_snprintf(buf + offset, remain, &imm->data,
+					      flags, DATA_VERDICT);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	} else if (e->flags & (1 << NFTNL_EXPR_IMM_CHAIN)) {
+		ret = nftnl_data_reg_snprintf(buf + offset, remain, &imm->data,
+					      flags, DATA_CHAIN);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+static void nftnl_expr_immediate_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_immediate *imm = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_IMM_VERDICT))
+		nftnl_free_verdict(&imm->data);
+}
+
+struct expr_ops expr_ops_immediate = {
+	.name		= "immediate",
+	.alloc_len	= sizeof(struct nftnl_expr_immediate),
+	.max_attr	= NFTA_IMMEDIATE_MAX,
+	.free		= nftnl_expr_immediate_free,
+	.set		= nftnl_expr_immediate_set,
+	.get		= nftnl_expr_immediate_get,
+	.parse		= nftnl_expr_immediate_parse,
+	.build		= nftnl_expr_immediate_build,
+	.output		= nftnl_expr_immediate_snprintf,
+};
diff --git a/src/expr/inner.c b/src/expr/inner.c
new file mode 100644
index 0000000..7daae4f
--- /dev/null
+++ b/src/expr/inner.c
@@ -0,0 +1,214 @@
+/*
+ * (C) 2012-2022 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <limits.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_inner {
+	uint32_t	type;
+	uint32_t	flags;
+	uint32_t	hdrsize;
+	struct nftnl_expr *expr;
+};
+
+static void nftnl_expr_inner_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_inner *inner = nftnl_expr_data(e);
+
+	if (inner->expr)
+		nftnl_expr_free(inner->expr);
+}
+
+static int
+nftnl_expr_inner_set(struct nftnl_expr *e, uint16_t type,
+		     const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_inner *inner = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_INNER_TYPE:
+		memcpy(&inner->type, data, sizeof(inner->type));
+		break;
+	case NFTNL_EXPR_INNER_FLAGS:
+		memcpy(&inner->flags, data, sizeof(inner->flags));
+		break;
+	case NFTNL_EXPR_INNER_HDRSIZE:
+		memcpy(&inner->hdrsize, data, sizeof(inner->hdrsize));
+		break;
+	case NFTNL_EXPR_INNER_EXPR:
+		if (inner->expr)
+			nftnl_expr_free(inner->expr);
+
+		inner->expr = (void *)data;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_inner_get(const struct nftnl_expr *e, uint16_t type,
+		     uint32_t *data_len)
+{
+	struct nftnl_expr_inner *inner = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_INNER_FLAGS:
+		*data_len = sizeof(inner->flags);
+		return &inner->flags;
+	case NFTNL_EXPR_INNER_TYPE:
+		*data_len = sizeof(inner->type);
+		return &inner->type;
+	case NFTNL_EXPR_INNER_HDRSIZE:
+		*data_len = sizeof(inner->hdrsize);
+		return &inner->hdrsize;
+	case NFTNL_EXPR_INNER_EXPR:
+		return inner->expr;
+	}
+	return NULL;
+}
+
+static void
+nftnl_expr_inner_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_inner *inner = nftnl_expr_data(e);
+	struct nlattr *nest;
+
+	mnl_attr_put_u32(nlh, NFTA_INNER_NUM, htonl(0));
+	if (e->flags & (1 << NFTNL_EXPR_INNER_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_INNER_TYPE, htonl(inner->type));
+	if (e->flags & (1 << NFTNL_EXPR_INNER_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_INNER_FLAGS, htonl(inner->flags));
+	if (e->flags & (1 << NFTNL_EXPR_INNER_HDRSIZE))
+		mnl_attr_put_u32(nlh, NFTA_INNER_HDRSIZE, htonl(inner->hdrsize));
+	if (e->flags & (1 << NFTNL_EXPR_INNER_EXPR)) {
+		nest = mnl_attr_nest_start(nlh, NFTA_INNER_EXPR);
+		nftnl_expr_build_payload(nlh, inner->expr);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int nftnl_inner_parse_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_INNER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_INNER_NUM:
+	case NFTA_INNER_TYPE:
+	case NFTA_INNER_HDRSIZE:
+	case NFTA_INNER_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_INNER_EXPR:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_expr_inner_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_inner *inner = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_INNER_MAX + 1] = {};
+	struct nftnl_expr *expr;
+	int err;
+
+	err = mnl_attr_parse_nested(attr, nftnl_inner_parse_cb, tb);
+	if (err < 0)
+		return err;
+
+	if (tb[NFTA_INNER_HDRSIZE]) {
+		inner->hdrsize =
+			ntohl(mnl_attr_get_u32(tb[NFTA_INNER_HDRSIZE]));
+		e->flags |= (1 << NFTNL_EXPR_INNER_HDRSIZE);
+	}
+	if (tb[NFTA_INNER_FLAGS]) {
+		inner->flags =
+			ntohl(mnl_attr_get_u32(tb[NFTA_INNER_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_INNER_FLAGS);
+	}
+	if (tb[NFTA_INNER_TYPE]) {
+		inner->type =
+			ntohl(mnl_attr_get_u32(tb[NFTA_INNER_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_INNER_TYPE);
+	}
+	if (tb[NFTA_INNER_EXPR]) {
+		expr = nftnl_expr_parse(tb[NFTA_INNER_EXPR]);
+		if (!expr)
+			return -1;
+
+		if (inner->expr)
+			nftnl_expr_free(inner->expr);
+
+		inner->expr = expr;
+		e->flags |= (1 << NFTNL_EXPR_INNER_EXPR);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_inner_snprintf(char *buf, size_t remain, uint32_t flags,
+			  const struct nftnl_expr *e)
+{
+	struct nftnl_expr_inner *inner = nftnl_expr_data(e);
+	uint32_t offset = 0;
+	int ret;
+
+	ret = snprintf(buf, remain, "type %u hdrsize %u flags %x [",
+		       inner->type, inner->hdrsize, inner->flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = snprintf(buf + offset, remain, " %s ", inner->expr->ops->name);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_expr_snprintf(buf + offset, remain, inner->expr,
+				  NFTNL_OUTPUT_DEFAULT, 0);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = snprintf(buf + offset, remain, "] ");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+struct expr_ops expr_ops_inner = {
+	.name		= "inner",
+	.alloc_len	= sizeof(struct nftnl_expr_inner),
+	.max_attr	= NFTA_INNER_MAX,
+	.free		= nftnl_expr_inner_free,
+	.set		= nftnl_expr_inner_set,
+	.get		= nftnl_expr_inner_get,
+	.parse		= nftnl_expr_inner_parse,
+	.build		= nftnl_expr_inner_build,
+	.output		= nftnl_expr_inner_snprintf,
+};
diff --git a/src/expr/last.c b/src/expr/last.c
new file mode 100644
index 0000000..641b713
--- /dev/null
+++ b/src/expr/last.c
@@ -0,0 +1,138 @@
+/*
+ * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_last {
+	uint64_t	msecs;
+	uint32_t	set;
+};
+
+static int nftnl_expr_last_set(struct nftnl_expr *e, uint16_t type,
+				const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_last *last = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_LAST_MSECS:
+		memcpy(&last->msecs, data, sizeof(last->msecs));
+		break;
+	case NFTNL_EXPR_LAST_SET:
+		memcpy(&last->set, data, sizeof(last->set));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_last_get(const struct nftnl_expr *e,
+					uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_last *last = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_LAST_MSECS:
+		*data_len = sizeof(last->msecs);
+		return &last->msecs;
+	case NFTNL_EXPR_LAST_SET:
+		*data_len = sizeof(last->set);
+		return &last->set;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_last_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_LAST_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_LAST_MSECS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_LAST_SET:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_last_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_last *last = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_LAST_MSECS))
+		mnl_attr_put_u64(nlh, NFTA_LAST_MSECS, htobe64(last->msecs));
+	if (e->flags & (1 << NFTNL_EXPR_LAST_SET))
+		mnl_attr_put_u32(nlh, NFTA_LAST_SET, htonl(last->set));
+}
+
+static int
+nftnl_expr_last_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_last *last = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_LAST_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_last_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_LAST_MSECS]) {
+		last->msecs = be64toh(mnl_attr_get_u64(tb[NFTA_LAST_MSECS]));
+		e->flags |= (1 << NFTNL_EXPR_LAST_MSECS);
+	}
+	if (tb[NFTA_LAST_SET]) {
+		last->set = ntohl(mnl_attr_get_u32(tb[NFTA_LAST_SET]));
+		e->flags |= (1 << NFTNL_EXPR_LAST_SET);
+	}
+
+	return 0;
+}
+
+static int nftnl_expr_last_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_expr *e)
+{
+	struct nftnl_expr_last *last = nftnl_expr_data(e);
+
+	if (!last->set)
+		return snprintf(buf, len, "never ");
+
+	return snprintf(buf, len, "%"PRIu64" ", last->msecs);
+}
+
+struct expr_ops expr_ops_last = {
+	.name		= "last",
+	.alloc_len	= sizeof(struct nftnl_expr_last),
+	.max_attr	= NFTA_LAST_MAX,
+	.set		= nftnl_expr_last_set,
+	.get		= nftnl_expr_last_get,
+	.parse		= nftnl_expr_last_parse,
+	.build		= nftnl_expr_last_build,
+	.output		= nftnl_expr_last_snprintf,
+};
diff --git a/src/expr/limit.c b/src/expr/limit.c
new file mode 100644
index 0000000..1870e0e
--- /dev/null
+++ b/src/expr/limit.c
@@ -0,0 +1,206 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <inttypes.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_limit {
+	uint64_t		rate;
+	uint64_t		unit;
+	uint32_t		burst;
+	enum nft_limit_type	type;
+	uint32_t		flags;
+};
+
+static int
+nftnl_expr_limit_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_limit *limit = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_LIMIT_RATE:
+		memcpy(&limit->rate, data, sizeof(limit->rate));
+		break;
+	case NFTNL_EXPR_LIMIT_UNIT:
+		memcpy(&limit->unit, data, sizeof(limit->unit));
+		break;
+	case NFTNL_EXPR_LIMIT_BURST:
+		memcpy(&limit->burst, data, sizeof(limit->burst));
+		break;
+	case NFTNL_EXPR_LIMIT_TYPE:
+		memcpy(&limit->type, data, sizeof(limit->type));
+		break;
+	case NFTNL_EXPR_LIMIT_FLAGS:
+		memcpy(&limit->flags, data, sizeof(limit->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_limit_get(const struct nftnl_expr *e, uint16_t type,
+			uint32_t *data_len)
+{
+	struct nftnl_expr_limit *limit = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_LIMIT_RATE:
+		*data_len = sizeof(uint64_t);
+		return &limit->rate;
+	case NFTNL_EXPR_LIMIT_UNIT:
+		*data_len = sizeof(uint64_t);
+		return &limit->unit;
+	case NFTNL_EXPR_LIMIT_BURST:
+		*data_len = sizeof(uint32_t);
+		return &limit->burst;
+	case NFTNL_EXPR_LIMIT_TYPE:
+		*data_len = sizeof(uint32_t);
+		return &limit->type;
+	case NFTNL_EXPR_LIMIT_FLAGS:
+		*data_len = sizeof(uint32_t);
+		return &limit->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_limit_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_LIMIT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_LIMIT_RATE:
+	case NFTA_LIMIT_UNIT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_LIMIT_BURST:
+	case NFTA_LIMIT_TYPE:
+	case NFTA_LIMIT_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_limit_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_limit *limit = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_LIMIT_RATE))
+		mnl_attr_put_u64(nlh, NFTA_LIMIT_RATE, htobe64(limit->rate));
+	if (e->flags & (1 << NFTNL_EXPR_LIMIT_UNIT))
+		mnl_attr_put_u64(nlh, NFTA_LIMIT_UNIT, htobe64(limit->unit));
+	if (e->flags & (1 << NFTNL_EXPR_LIMIT_BURST))
+		mnl_attr_put_u32(nlh, NFTA_LIMIT_BURST, htonl(limit->burst));
+	if (e->flags & (1 << NFTNL_EXPR_LIMIT_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_LIMIT_TYPE, htonl(limit->type));
+	if (e->flags & (1 << NFTNL_EXPR_LIMIT_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_LIMIT_FLAGS, htonl(limit->flags));
+}
+
+static int
+nftnl_expr_limit_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_limit *limit = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_LIMIT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_limit_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_LIMIT_RATE]) {
+		limit->rate = be64toh(mnl_attr_get_u64(tb[NFTA_LIMIT_RATE]));
+		e->flags |= (1 << NFTNL_EXPR_LIMIT_RATE);
+	}
+	if (tb[NFTA_LIMIT_UNIT]) {
+		limit->unit = be64toh(mnl_attr_get_u64(tb[NFTA_LIMIT_UNIT]));
+		e->flags |= (1 << NFTNL_EXPR_LIMIT_UNIT);
+	}
+	if (tb[NFTA_LIMIT_BURST]) {
+		limit->burst = ntohl(mnl_attr_get_u32(tb[NFTA_LIMIT_BURST]));
+		e->flags |= (1 << NFTNL_EXPR_LIMIT_BURST);
+	}
+	if (tb[NFTA_LIMIT_TYPE]) {
+		limit->type = ntohl(mnl_attr_get_u32(tb[NFTA_LIMIT_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_LIMIT_TYPE);
+	}
+	if (tb[NFTA_LIMIT_FLAGS]) {
+		limit->flags = ntohl(mnl_attr_get_u32(tb[NFTA_LIMIT_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_LIMIT_FLAGS);
+	}
+
+	return 0;
+}
+
+static const char *get_unit(uint64_t u)
+{
+	switch (u) {
+	case 1: return "second";
+	case 60: return "minute";
+	case 60 * 60: return "hour";
+	case 60 * 60 * 24: return "day";
+	case 60 * 60 * 24 * 7: return "week";
+	}
+	return "error";
+}
+
+static const char *limit_to_type(enum nft_limit_type type)
+{
+	switch (type) {
+	default:
+	case NFT_LIMIT_PKTS:
+		return "packets";
+	case NFT_LIMIT_PKT_BYTES:
+		return "bytes";
+	}
+}
+
+static int
+nftnl_expr_limit_snprintf(char *buf, size_t len,
+			  uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_limit *limit = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "rate %"PRIu64"/%s burst %u type %s flags 0x%x ",
+			limit->rate, get_unit(limit->unit), limit->burst,
+			limit_to_type(limit->type), limit->flags);
+}
+
+struct expr_ops expr_ops_limit = {
+	.name		= "limit",
+	.alloc_len	= sizeof(struct nftnl_expr_limit),
+	.max_attr	= NFTA_LIMIT_MAX,
+	.set		= nftnl_expr_limit_set,
+	.get		= nftnl_expr_limit_get,
+	.parse		= nftnl_expr_limit_parse,
+	.build		= nftnl_expr_limit_build,
+	.output		= nftnl_expr_limit_snprintf,
+};
diff --git a/src/expr/log.c b/src/expr/log.c
new file mode 100644
index 0000000..180d839
--- /dev/null
+++ b/src/expr/log.c
@@ -0,0 +1,257 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+#include <linux/netfilter/nf_log.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_log {
+	uint32_t		snaplen;
+	uint16_t		group;
+	uint16_t		qthreshold;
+	uint32_t		level;
+	uint32_t		flags;
+	const char		*prefix;
+};
+
+static int nftnl_expr_log_set(struct nftnl_expr *e, uint16_t type,
+				 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_log *log = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_LOG_PREFIX:
+		if (log->flags & (1 << NFTNL_EXPR_LOG_PREFIX))
+			xfree(log->prefix);
+
+		log->prefix = strdup(data);
+		if (!log->prefix)
+			return -1;
+		break;
+	case NFTNL_EXPR_LOG_GROUP:
+		memcpy(&log->group, data, sizeof(log->group));
+		break;
+	case NFTNL_EXPR_LOG_SNAPLEN:
+		memcpy(&log->snaplen, data, sizeof(log->snaplen));
+		break;
+	case NFTNL_EXPR_LOG_QTHRESHOLD:
+		memcpy(&log->qthreshold, data, sizeof(log->qthreshold));
+		break;
+	case NFTNL_EXPR_LOG_LEVEL:
+		memcpy(&log->level, data, sizeof(log->level));
+		break;
+	case NFTNL_EXPR_LOG_FLAGS:
+		memcpy(&log->flags, data, sizeof(log->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_log_get(const struct nftnl_expr *e, uint16_t type,
+		      uint32_t *data_len)
+{
+	struct nftnl_expr_log *log = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_LOG_PREFIX:
+		*data_len = strlen(log->prefix)+1;
+		return log->prefix;
+	case NFTNL_EXPR_LOG_GROUP:
+		*data_len = sizeof(log->group);
+		return &log->group;
+	case NFTNL_EXPR_LOG_SNAPLEN:
+		*data_len = sizeof(log->snaplen);
+		return &log->snaplen;
+	case NFTNL_EXPR_LOG_QTHRESHOLD:
+		*data_len = sizeof(log->qthreshold);
+		return &log->qthreshold;
+	case NFTNL_EXPR_LOG_LEVEL:
+		*data_len = sizeof(log->level);
+		return &log->level;
+	case NFTNL_EXPR_LOG_FLAGS:
+		*data_len = sizeof(log->flags);
+		return &log->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_log_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_LOG_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_LOG_PREFIX:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_LOG_GROUP:
+	case NFTA_LOG_QTHRESHOLD:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_LOG_SNAPLEN:
+	case NFTA_LOG_LEVEL:
+	case NFTA_LOG_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_log_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_log *log = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_LOG_PREFIX))
+		mnl_attr_put_strz(nlh, NFTA_LOG_PREFIX, log->prefix);
+	if (e->flags & (1 << NFTNL_EXPR_LOG_GROUP))
+		mnl_attr_put_u16(nlh, NFTA_LOG_GROUP, htons(log->group));
+	if (e->flags & (1 << NFTNL_EXPR_LOG_SNAPLEN))
+		mnl_attr_put_u32(nlh, NFTA_LOG_SNAPLEN, htonl(log->snaplen));
+	if (e->flags & (1 << NFTNL_EXPR_LOG_QTHRESHOLD))
+		mnl_attr_put_u16(nlh, NFTA_LOG_QTHRESHOLD, htons(log->qthreshold));
+	if (e->flags & (1 << NFTNL_EXPR_LOG_LEVEL))
+		mnl_attr_put_u32(nlh, NFTA_LOG_LEVEL, htonl(log->level));
+	if (e->flags & (1 << NFTNL_EXPR_LOG_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_LOG_FLAGS, htonl(log->flags));
+}
+
+static int
+nftnl_expr_log_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_log *log = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_LOG_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_log_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_LOG_PREFIX]) {
+		if (log->prefix)
+			xfree(log->prefix);
+
+		log->prefix = strdup(mnl_attr_get_str(tb[NFTA_LOG_PREFIX]));
+		if (!log->prefix)
+			return -1;
+		e->flags |= (1 << NFTNL_EXPR_LOG_PREFIX);
+	}
+	if (tb[NFTA_LOG_GROUP]) {
+		log->group = ntohs(mnl_attr_get_u16(tb[NFTA_LOG_GROUP]));
+		e->flags |= (1 << NFTNL_EXPR_LOG_GROUP);
+	}
+	if (tb[NFTA_LOG_SNAPLEN]) {
+		log->snaplen = ntohl(mnl_attr_get_u32(tb[NFTA_LOG_SNAPLEN]));
+		e->flags |= (1 << NFTNL_EXPR_LOG_SNAPLEN);
+	}
+	if (tb[NFTA_LOG_QTHRESHOLD]) {
+		log->qthreshold = ntohs(mnl_attr_get_u16(tb[NFTA_LOG_QTHRESHOLD]));
+		e->flags |= (1 << NFTNL_EXPR_LOG_QTHRESHOLD);
+	}
+	if (tb[NFTA_LOG_LEVEL]) {
+		log->level = ntohl(mnl_attr_get_u32(tb[NFTA_LOG_LEVEL]));
+		e->flags |= (1 << NFTNL_EXPR_LOG_LEVEL);
+	}
+	if (tb[NFTA_LOG_FLAGS]) {
+		log->flags = ntohl(mnl_attr_get_u32(tb[NFTA_LOG_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_LOG_FLAGS);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_log_snprintf(char *buf, size_t remain,
+			uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_log *log = nftnl_expr_data(e);
+	int ret, offset = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_LOG_PREFIX)) {
+		ret = snprintf(buf, remain, "prefix %s ", log->prefix);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_LOG_GROUP)) {
+		ret = snprintf(buf + offset, remain,
+			       "group %u snaplen %u qthreshold %u ",
+			       log->group, log->snaplen, log->qthreshold);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	} else {
+		if (e->flags & (1 << NFTNL_EXPR_LOG_LEVEL)) {
+			ret = snprintf(buf + offset, remain, "level %u ",
+				       log->level);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+		if (e->flags & (1 << NFTNL_EXPR_LOG_FLAGS)) {
+			if (log->flags & NF_LOG_TCPSEQ) {
+				ret = snprintf(buf + offset, remain, "tcpseq ");
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+			if (log->flags & NF_LOG_TCPOPT) {
+				ret = snprintf(buf + offset, remain, "tcpopt ");
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+			if (log->flags & NF_LOG_IPOPT) {
+				ret = snprintf(buf + offset, remain, "ipopt ");
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+			if (log->flags & NF_LOG_UID) {
+				ret = snprintf(buf + offset, remain, "uid ");
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+			if (log->flags & NF_LOG_MACDECODE) {
+				ret = snprintf(buf + offset, remain,
+					       "macdecode ");
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+		}
+	}
+
+	return offset;
+}
+
+static void nftnl_expr_log_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_log *log = nftnl_expr_data(e);
+
+	xfree(log->prefix);
+}
+
+struct expr_ops expr_ops_log = {
+	.name		= "log",
+	.alloc_len	= sizeof(struct nftnl_expr_log),
+	.max_attr	= NFTA_LOG_MAX,
+	.free		= nftnl_expr_log_free,
+	.set		= nftnl_expr_log_set,
+	.get		= nftnl_expr_log_get,
+	.parse		= nftnl_expr_log_parse,
+	.build		= nftnl_expr_log_build,
+	.output		= nftnl_expr_log_snprintf,
+};
diff --git a/src/expr/lookup.c b/src/expr/lookup.c
new file mode 100644
index 0000000..a06c338
--- /dev/null
+++ b/src/expr/lookup.c
@@ -0,0 +1,210 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h> /* for memcpy */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/rule.h>
+#include <libnftnl/expr.h>
+
+struct nftnl_expr_lookup {
+	enum nft_registers	sreg;
+	enum nft_registers	dreg;
+	char			*set_name;
+	uint32_t		set_id;
+	uint32_t		flags;
+};
+
+static int
+nftnl_expr_lookup_set(struct nftnl_expr *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_lookup *lookup = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_LOOKUP_SREG:
+		memcpy(&lookup->sreg, data, sizeof(lookup->sreg));
+		break;
+	case NFTNL_EXPR_LOOKUP_DREG:
+		memcpy(&lookup->dreg, data, sizeof(lookup->dreg));
+		break;
+	case NFTNL_EXPR_LOOKUP_SET:
+		lookup->set_name = strdup((const char *)data);
+		if (!lookup->set_name)
+			return -1;
+		break;
+	case NFTNL_EXPR_LOOKUP_SET_ID:
+		memcpy(&lookup->set_id, data, sizeof(lookup->set_id));
+		break;
+	case NFTNL_EXPR_LOOKUP_FLAGS:
+		memcpy(&lookup->flags, data, sizeof(lookup->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_lookup_get(const struct nftnl_expr *e, uint16_t type,
+			 uint32_t *data_len)
+{
+	struct nftnl_expr_lookup *lookup = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_LOOKUP_SREG:
+		*data_len = sizeof(lookup->sreg);
+		return &lookup->sreg;
+	case NFTNL_EXPR_LOOKUP_DREG:
+		*data_len = sizeof(lookup->dreg);
+		return &lookup->dreg;
+	case NFTNL_EXPR_LOOKUP_SET:
+		*data_len = strlen(lookup->set_name) + 1;
+		return lookup->set_name;
+	case NFTNL_EXPR_LOOKUP_SET_ID:
+		*data_len = sizeof(lookup->set_id);
+		return &lookup->set_id;
+	case NFTNL_EXPR_LOOKUP_FLAGS:
+		*data_len = sizeof(lookup->flags);
+		return &lookup->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_lookup_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_LOOKUP_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_LOOKUP_SREG:
+	case NFTA_LOOKUP_DREG:
+	case NFTA_LOOKUP_SET_ID:
+	case NFTA_LOOKUP_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_LOOKUP_SET:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_lookup_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_lookup *lookup = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_SREG))
+		mnl_attr_put_u32(nlh, NFTA_LOOKUP_SREG, htonl(lookup->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_DREG))
+		mnl_attr_put_u32(nlh, NFTA_LOOKUP_DREG, htonl(lookup->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_SET))
+		mnl_attr_put_strz(nlh, NFTA_LOOKUP_SET, lookup->set_name);
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_SET_ID))
+		mnl_attr_put_u32(nlh, NFTA_LOOKUP_SET_ID,
+				 htonl(lookup->set_id));
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_LOOKUP_FLAGS, htonl(lookup->flags));
+}
+
+static int
+nftnl_expr_lookup_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_lookup *lookup = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_LOOKUP_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_lookup_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_LOOKUP_SREG]) {
+		lookup->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_LOOKUP_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_LOOKUP_SREG);
+	}
+	if (tb[NFTA_LOOKUP_DREG]) {
+		lookup->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_LOOKUP_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_LOOKUP_DREG);
+	}
+	if (tb[NFTA_LOOKUP_SET]) {
+		lookup->set_name =
+			strdup(mnl_attr_get_str(tb[NFTA_LOOKUP_SET]));
+		if (!lookup->set_name)
+			return -1;
+		e->flags |= (1 << NFTNL_EXPR_LOOKUP_SET);
+	}
+	if (tb[NFTA_LOOKUP_SET_ID]) {
+		lookup->set_id =
+			ntohl(mnl_attr_get_u32(tb[NFTA_LOOKUP_SET_ID]));
+		e->flags |= (1 << NFTNL_EXPR_LOOKUP_SET_ID);
+	}
+	if (tb[NFTA_LOOKUP_FLAGS]) {
+		lookup->flags = ntohl(mnl_attr_get_u32(tb[NFTA_LOOKUP_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_LOOKUP_FLAGS);
+	}
+
+	return ret;
+}
+
+static int
+nftnl_expr_lookup_snprintf(char *buf, size_t remain,
+			   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_lookup *l = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "reg %u set %s ", l->sreg, l->set_name);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_DREG)) {
+		ret = snprintf(buf + offset, remain, "dreg %u ", l->dreg);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_LOOKUP_FLAGS)) {
+		ret = snprintf(buf + offset, remain, "0x%x ", l->flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+static void nftnl_expr_lookup_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_lookup *lookup = nftnl_expr_data(e);
+
+	xfree(lookup->set_name);
+}
+
+struct expr_ops expr_ops_lookup = {
+	.name		= "lookup",
+	.alloc_len	= sizeof(struct nftnl_expr_lookup),
+	.max_attr	= NFTA_LOOKUP_MAX,
+	.free		= nftnl_expr_lookup_free,
+	.set		= nftnl_expr_lookup_set,
+	.get		= nftnl_expr_lookup_get,
+	.parse		= nftnl_expr_lookup_parse,
+	.build		= nftnl_expr_lookup_build,
+	.output		= nftnl_expr_lookup_snprintf,
+};
diff --git a/src/expr/masq.c b/src/expr/masq.c
new file mode 100644
index 0000000..e6e528d
--- /dev/null
+++ b/src/expr/masq.c
@@ -0,0 +1,167 @@
+/*
+ * (C) 2014 by Arturo Borrero Gonzalez <arturo@debian.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_masq {
+	uint32_t		flags;
+	enum nft_registers	sreg_proto_min;
+	enum nft_registers	sreg_proto_max;
+};
+
+static int
+nftnl_expr_masq_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_masq *masq = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_MASQ_FLAGS:
+		memcpy(&masq->flags, data, sizeof(masq->flags));
+		break;
+	case NFTNL_EXPR_MASQ_REG_PROTO_MIN:
+		memcpy(&masq->sreg_proto_min, data, sizeof(masq->sreg_proto_min));
+		break;
+	case NFTNL_EXPR_MASQ_REG_PROTO_MAX:
+		memcpy(&masq->sreg_proto_max, data, sizeof(masq->sreg_proto_max));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_masq_get(const struct nftnl_expr *e, uint16_t type,
+		       uint32_t *data_len)
+{
+	struct nftnl_expr_masq *masq = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_MASQ_FLAGS:
+		*data_len = sizeof(masq->flags);
+		return &masq->flags;
+	case NFTNL_EXPR_MASQ_REG_PROTO_MIN:
+		*data_len = sizeof(masq->sreg_proto_min);
+		return &masq->sreg_proto_min;
+	case NFTNL_EXPR_MASQ_REG_PROTO_MAX:
+		*data_len = sizeof(masq->sreg_proto_max);
+		return &masq->sreg_proto_max;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_masq_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_MASQ_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_MASQ_REG_PROTO_MIN:
+	case NFTA_MASQ_REG_PROTO_MAX:
+	case NFTA_MASQ_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_masq_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_masq *masq = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_MASQ_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_MASQ_FLAGS, htobe32(masq->flags));
+	if (e->flags & (1 << NFTNL_EXPR_MASQ_REG_PROTO_MIN))
+		mnl_attr_put_u32(nlh, NFTA_MASQ_REG_PROTO_MIN,
+				 htobe32(masq->sreg_proto_min));
+	if (e->flags & (1 << NFTNL_EXPR_MASQ_REG_PROTO_MAX))
+		mnl_attr_put_u32(nlh, NFTA_MASQ_REG_PROTO_MAX,
+				 htobe32(masq->sreg_proto_max));
+}
+
+static int
+nftnl_expr_masq_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_masq *masq = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_MASQ_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_masq_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_MASQ_FLAGS]) {
+		masq->flags = be32toh(mnl_attr_get_u32(tb[NFTA_MASQ_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_MASQ_FLAGS);
+        }
+	if (tb[NFTA_MASQ_REG_PROTO_MIN]) {
+		masq->sreg_proto_min =
+			be32toh(mnl_attr_get_u32(tb[NFTA_MASQ_REG_PROTO_MIN]));
+		e->flags |= (1 << NFTNL_EXPR_MASQ_REG_PROTO_MIN);
+	}
+	if (tb[NFTA_MASQ_REG_PROTO_MAX]) {
+		masq->sreg_proto_max =
+			be32toh(mnl_attr_get_u32(tb[NFTA_MASQ_REG_PROTO_MAX]));
+		e->flags |= (1 << NFTNL_EXPR_MASQ_REG_PROTO_MAX);
+	}
+
+	return 0;
+}
+
+static int nftnl_expr_masq_snprintf(char *buf, size_t remain,
+				    uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_masq *masq = nftnl_expr_data(e);
+	int offset = 0, ret = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_MASQ_REG_PROTO_MIN)) {
+		ret = snprintf(buf + offset, remain, "proto_min reg %u ",
+			       masq->sreg_proto_min);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_MASQ_REG_PROTO_MAX)) {
+		ret = snprintf(buf + offset, remain, "proto_max reg %u ",
+			       masq->sreg_proto_max);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_MASQ_FLAGS)) {
+		ret = snprintf(buf + offset, remain, "flags 0x%x ", masq->flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_masq = {
+	.name		= "masq",
+	.alloc_len	= sizeof(struct nftnl_expr_masq),
+	.max_attr	= NFTA_MASQ_MAX,
+	.set		= nftnl_expr_masq_set,
+	.get		= nftnl_expr_masq_get,
+	.parse		= nftnl_expr_masq_parse,
+	.build		= nftnl_expr_masq_build,
+	.output		= nftnl_expr_masq_snprintf,
+};
diff --git a/src/expr/match.c b/src/expr/match.c
new file mode 100644
index 0000000..f472add
--- /dev/null
+++ b/src/expr/match.c
@@ -0,0 +1,193 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>	/* for memcpy */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+
+#include <linux/netfilter/nf_tables.h>
+#include <linux/netfilter/nf_tables_compat.h>
+
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+/* From include/linux/netfilter/x_tables.h */
+#define XT_EXTENSION_MAXNAMELEN 29
+
+struct nftnl_expr_match {
+	char		name[XT_EXTENSION_MAXNAMELEN];
+	uint32_t	rev;
+	uint32_t	data_len;
+	const void	*data;
+};
+
+static int
+nftnl_expr_match_set(struct nftnl_expr *e, uint16_t type,
+			 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_match *mt = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_MT_NAME:
+		snprintf(mt->name, sizeof(mt->name), "%.*s", data_len,
+			 (const char *)data);
+		break;
+	case NFTNL_EXPR_MT_REV:
+		memcpy(&mt->rev, data, sizeof(mt->rev));
+		break;
+	case NFTNL_EXPR_MT_INFO:
+		if (e->flags & (1 << NFTNL_EXPR_MT_INFO))
+			xfree(mt->data);
+
+		mt->data = data;
+		mt->data_len = data_len;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_match_get(const struct nftnl_expr *e, uint16_t type,
+			uint32_t *data_len)
+{
+	struct nftnl_expr_match *mt = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_MT_NAME:
+		*data_len = sizeof(mt->name);
+		return mt->name;
+	case NFTNL_EXPR_MT_REV:
+		*data_len = sizeof(mt->rev);
+		return &mt->rev;
+	case NFTNL_EXPR_MT_INFO:
+		*data_len = mt->data_len;
+		return mt->data;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_match_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_MATCH_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_MATCH_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_MATCH_REV:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_MATCH_INFO:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_match_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_match *mt = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_MT_NAME))
+		mnl_attr_put_strz(nlh, NFTA_MATCH_NAME, mt->name);
+	if (e->flags & (1 << NFTNL_EXPR_MT_REV))
+		mnl_attr_put_u32(nlh, NFTA_MATCH_REV, htonl(mt->rev));
+	if (e->flags & (1 << NFTNL_EXPR_MT_INFO))
+		mnl_attr_put(nlh, NFTA_MATCH_INFO, mt->data_len, mt->data);
+}
+
+static int nftnl_expr_match_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_match *match = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_MATCH_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_match_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_MATCH_NAME]) {
+		snprintf(match->name, XT_EXTENSION_MAXNAMELEN, "%s",
+			 mnl_attr_get_str(tb[NFTA_MATCH_NAME]));
+
+		match->name[XT_EXTENSION_MAXNAMELEN-1] = '\0';
+		e->flags |= (1 << NFTNL_EXPR_MT_NAME);
+	}
+
+	if (tb[NFTA_MATCH_REV]) {
+		match->rev = ntohl(mnl_attr_get_u32(tb[NFTA_MATCH_REV]));
+		e->flags |= (1 << NFTNL_EXPR_MT_REV);
+	}
+
+	if (tb[NFTA_MATCH_INFO]) {
+		uint32_t len = mnl_attr_get_payload_len(tb[NFTA_MATCH_INFO]);
+		void *match_data;
+
+		if (e->flags & (1 << NFTNL_EXPR_MT_INFO))
+			xfree(match->data);
+
+		match_data = calloc(1, len);
+		if (match_data == NULL)
+			return -1;
+
+		memcpy(match_data, mnl_attr_get_payload(tb[NFTA_MATCH_INFO]), len);
+
+		match->data = match_data;
+		match->data_len = len;
+
+		e->flags |= (1 << NFTNL_EXPR_MT_INFO);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_match_snprintf(char *buf, size_t len,
+			  uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_match *match = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "name %s rev %u ", match->name, match->rev);
+}
+
+static void nftnl_expr_match_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_match *match = nftnl_expr_data(e);
+
+	xfree(match->data);
+}
+
+struct expr_ops expr_ops_match = {
+	.name		= "match",
+	.alloc_len	= sizeof(struct nftnl_expr_match),
+	.max_attr	= NFTA_MATCH_MAX,
+	.free		= nftnl_expr_match_free,
+	.set		= nftnl_expr_match_set,
+	.get		= nftnl_expr_match_get,
+	.parse		= nftnl_expr_match_parse,
+	.build		= nftnl_expr_match_build,
+	.output		= nftnl_expr_match_snprintf,
+};
diff --git a/src/expr/meta.c b/src/expr/meta.c
new file mode 100644
index 0000000..183f441
--- /dev/null
+++ b/src/expr/meta.c
@@ -0,0 +1,221 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+#ifndef NFT_META_MAX
+#define NFT_META_MAX (NFT_META_BRI_BROUTE + 1)
+#endif
+
+struct nftnl_expr_meta {
+	enum nft_meta_keys	key;
+	enum nft_registers	dreg;
+	enum nft_registers	sreg;
+};
+
+static int
+nftnl_expr_meta_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_meta *meta = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_META_KEY:
+		memcpy(&meta->key, data, sizeof(meta->key));
+		break;
+	case NFTNL_EXPR_META_DREG:
+		memcpy(&meta->dreg, data, sizeof(meta->dreg));
+		break;
+	case NFTNL_EXPR_META_SREG:
+		memcpy(&meta->sreg, data, sizeof(meta->sreg));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_meta_get(const struct nftnl_expr *e, uint16_t type,
+		       uint32_t *data_len)
+{
+	struct nftnl_expr_meta *meta = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_META_KEY:
+		*data_len = sizeof(meta->key);
+		return &meta->key;
+	case NFTNL_EXPR_META_DREG:
+		*data_len = sizeof(meta->dreg);
+		return &meta->dreg;
+	case NFTNL_EXPR_META_SREG:
+		*data_len = sizeof(meta->sreg);
+		return &meta->sreg;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_meta_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_META_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_META_KEY:
+	case NFTA_META_DREG:
+	case NFTA_META_SREG:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_meta_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_meta *meta = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_META_KEY))
+		mnl_attr_put_u32(nlh, NFTA_META_KEY, htonl(meta->key));
+	if (e->flags & (1 << NFTNL_EXPR_META_DREG))
+		mnl_attr_put_u32(nlh, NFTA_META_DREG, htonl(meta->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_META_SREG))
+		mnl_attr_put_u32(nlh, NFTA_META_SREG, htonl(meta->sreg));
+}
+
+static int
+nftnl_expr_meta_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_meta *meta = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_META_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_meta_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_META_KEY]) {
+		meta->key = ntohl(mnl_attr_get_u32(tb[NFTA_META_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_META_KEY);
+	}
+	if (tb[NFTA_META_DREG]) {
+		meta->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_META_DREG);
+	}
+	if (tb[NFTA_META_SREG]) {
+		meta->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_META_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_META_SREG);
+	}
+
+	return 0;
+}
+
+static const char *meta_key2str_array[NFT_META_MAX] = {
+	[NFT_META_LEN]		= "len",
+	[NFT_META_PROTOCOL]	= "protocol",
+	[NFT_META_NFPROTO]	= "nfproto",
+	[NFT_META_L4PROTO]	= "l4proto",
+	[NFT_META_PRIORITY]	= "priority",
+	[NFT_META_MARK]		= "mark",
+	[NFT_META_IIF]		= "iif",
+	[NFT_META_OIF]		= "oif",
+	[NFT_META_IIFNAME]	= "iifname",
+	[NFT_META_OIFNAME]	= "oifname",
+	[NFT_META_IIFTYPE]	= "iiftype",
+	[NFT_META_OIFTYPE]	= "oiftype",
+	[NFT_META_SKUID]	= "skuid",
+	[NFT_META_SKGID]	= "skgid",
+	[NFT_META_NFTRACE]	= "nftrace",
+	[NFT_META_RTCLASSID]	= "rtclassid",
+	[NFT_META_SECMARK]	= "secmark",
+	[NFT_META_BRI_IIFNAME]	= "bri_iifname",
+	[NFT_META_BRI_OIFNAME]	= "bri_oifname",
+	[NFT_META_PKTTYPE]	= "pkttype",
+	[NFT_META_CPU]		= "cpu",
+	[NFT_META_IIFGROUP]	= "iifgroup",
+	[NFT_META_OIFGROUP]	= "oifgroup",
+	[NFT_META_CGROUP]	= "cgroup",
+	[NFT_META_PRANDOM]	= "prandom",
+	[NFT_META_SECPATH]	= "secpath",
+	[NFT_META_IIFKIND]	= "iifkind",
+	[NFT_META_OIFKIND]	= "oifkind",
+	[NFT_META_BRI_IIFPVID]	 = "bri_iifpvid",
+	[NFT_META_BRI_IIFVPROTO] = "bri_iifvproto",
+	[NFT_META_TIME_NS]	= "time",
+	[NFT_META_TIME_DAY]	= "day",
+	[NFT_META_TIME_HOUR]	= "hour",
+	[NFT_META_SDIF]		= "sdif",
+	[NFT_META_SDIFNAME]	= "sdifname",
+	[NFT_META_BRI_BROUTE]	= "broute",
+};
+
+static const char *meta_key2str(uint8_t key)
+{
+	if (key < NFT_META_MAX)
+		return meta_key2str_array[key];
+
+	return "unknown";
+}
+
+static inline int str2meta_key(const char *str)
+{
+	int i;
+
+	for (i = 0; i < NFT_META_MAX; i++) {
+		if (strcmp(str, meta_key2str_array[i]) == 0)
+			return i;
+	}
+
+	errno = EINVAL;
+	return -1;
+}
+
+static int
+nftnl_expr_meta_snprintf(char *buf, size_t len,
+			 uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_meta *meta = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_META_SREG)) {
+		return snprintf(buf, len, "set %s with reg %u ",
+				meta_key2str(meta->key), meta->sreg);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_META_DREG)) {
+		return snprintf(buf, len, "load %s => reg %u ",
+				meta_key2str(meta->key), meta->dreg);
+	}
+	return 0;
+}
+
+struct expr_ops expr_ops_meta = {
+	.name		= "meta",
+	.alloc_len	= sizeof(struct nftnl_expr_meta),
+	.max_attr	= NFTA_META_MAX,
+	.set		= nftnl_expr_meta_set,
+	.get		= nftnl_expr_meta_get,
+	.parse		= nftnl_expr_meta_parse,
+	.build		= nftnl_expr_meta_build,
+	.output		= nftnl_expr_meta_snprintf,
+};
diff --git a/src/expr/nat.c b/src/expr/nat.c
new file mode 100644
index 0000000..ca727be
--- /dev/null
+++ b/src/expr/nat.c
@@ -0,0 +1,278 @@
+/*
+ * (C) 2012-2014 Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2012 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Authors:
+ * 	Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <limits.h>
+#include <string.h>
+#include <errno.h>
+#include <arpa/inet.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_nat {
+	enum nft_registers sreg_addr_min;
+	enum nft_registers sreg_addr_max;
+	enum nft_registers sreg_proto_min;
+	enum nft_registers sreg_proto_max;
+	int                family;
+	enum nft_nat_types type;
+	uint32_t	   flags;
+};
+
+static int
+nftnl_expr_nat_set(struct nftnl_expr *e, uint16_t type,
+		      const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_nat *nat = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_NAT_TYPE:
+		memcpy(&nat->type, data, sizeof(nat->type));
+		break;
+	case NFTNL_EXPR_NAT_FAMILY:
+		memcpy(&nat->family, data, sizeof(nat->family));
+		break;
+	case NFTNL_EXPR_NAT_REG_ADDR_MIN:
+		memcpy(&nat->sreg_addr_min, data, sizeof(nat->sreg_addr_min));
+		break;
+	case NFTNL_EXPR_NAT_REG_ADDR_MAX:
+		memcpy(&nat->sreg_addr_max, data, sizeof(nat->sreg_addr_max));
+		break;
+	case NFTNL_EXPR_NAT_REG_PROTO_MIN:
+		memcpy(&nat->sreg_proto_min, data, sizeof(nat->sreg_proto_min));
+		break;
+	case NFTNL_EXPR_NAT_REG_PROTO_MAX:
+		memcpy(&nat->sreg_proto_max, data, sizeof(nat->sreg_proto_max));
+		break;
+	case NFTNL_EXPR_NAT_FLAGS:
+		memcpy(&nat->flags, data, sizeof(nat->flags));
+		break;
+	default:
+		return -1;
+	}
+
+	return 0;
+}
+
+static const void *
+nftnl_expr_nat_get(const struct nftnl_expr *e, uint16_t type,
+		      uint32_t *data_len)
+{
+	struct nftnl_expr_nat *nat = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_NAT_TYPE:
+		*data_len = sizeof(nat->type);
+		return &nat->type;
+	case NFTNL_EXPR_NAT_FAMILY:
+		*data_len = sizeof(nat->family);
+		return &nat->family;
+	case NFTNL_EXPR_NAT_REG_ADDR_MIN:
+		*data_len = sizeof(nat->sreg_addr_min);
+		return &nat->sreg_addr_min;
+	case NFTNL_EXPR_NAT_REG_ADDR_MAX:
+		*data_len = sizeof(nat->sreg_addr_max);
+		return &nat->sreg_addr_max;
+	case NFTNL_EXPR_NAT_REG_PROTO_MIN:
+		*data_len = sizeof(nat->sreg_proto_min);
+		return &nat->sreg_proto_min;
+	case NFTNL_EXPR_NAT_REG_PROTO_MAX:
+		*data_len = sizeof(nat->sreg_proto_max);
+		return &nat->sreg_proto_max;
+	case NFTNL_EXPR_NAT_FLAGS:
+		*data_len = sizeof(nat->flags);
+		return &nat->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_nat_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_NAT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_NAT_TYPE:
+	case NFTA_NAT_FAMILY:
+	case NFTA_NAT_REG_ADDR_MIN:
+	case NFTA_NAT_REG_ADDR_MAX:
+	case NFTA_NAT_REG_PROTO_MIN:
+	case NFTA_NAT_REG_PROTO_MAX:
+	case NFTA_NAT_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_expr_nat_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_nat *nat = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_NAT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_nat_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_NAT_TYPE]) {
+		nat->type = ntohl(mnl_attr_get_u32(tb[NFTA_NAT_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_TYPE);
+	}
+	if (tb[NFTA_NAT_FAMILY]) {
+		nat->family = ntohl(mnl_attr_get_u32(tb[NFTA_NAT_FAMILY]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_FAMILY);
+	}
+	if (tb[NFTA_NAT_REG_ADDR_MIN]) {
+		nat->sreg_addr_min =
+			ntohl(mnl_attr_get_u32(tb[NFTA_NAT_REG_ADDR_MIN]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_REG_ADDR_MIN);
+	}
+	if (tb[NFTA_NAT_REG_ADDR_MAX]) {
+		nat->sreg_addr_max =
+			ntohl(mnl_attr_get_u32(tb[NFTA_NAT_REG_ADDR_MAX]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_REG_ADDR_MAX);
+	}
+	if (tb[NFTA_NAT_REG_PROTO_MIN]) {
+		nat->sreg_proto_min =
+			ntohl(mnl_attr_get_u32(tb[NFTA_NAT_REG_PROTO_MIN]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_REG_PROTO_MIN);
+	}
+	if (tb[NFTA_NAT_REG_PROTO_MAX]) {
+		nat->sreg_proto_max =
+			ntohl(mnl_attr_get_u32(tb[NFTA_NAT_REG_PROTO_MAX]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_REG_PROTO_MAX);
+	}
+	if (tb[NFTA_NAT_FLAGS]) {
+		nat->flags = ntohl(mnl_attr_get_u32(tb[NFTA_NAT_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_NAT_FLAGS);
+	}
+
+	return 0;
+}
+
+static void
+nftnl_expr_nat_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_nat *nat = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_NAT_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_NAT_TYPE, htonl(nat->type));
+	if (e->flags & (1 << NFTNL_EXPR_NAT_FAMILY))
+		mnl_attr_put_u32(nlh, NFTA_NAT_FAMILY, htonl(nat->family));
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_ADDR_MIN))
+		mnl_attr_put_u32(nlh, NFTA_NAT_REG_ADDR_MIN,
+				 htonl(nat->sreg_addr_min));
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_ADDR_MAX))
+		mnl_attr_put_u32(nlh, NFTA_NAT_REG_ADDR_MAX,
+				 htonl(nat->sreg_addr_max));
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_PROTO_MIN))
+		mnl_attr_put_u32(nlh, NFTA_NAT_REG_PROTO_MIN,
+				 htonl(nat->sreg_proto_min));
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_PROTO_MAX))
+		mnl_attr_put_u32(nlh, NFTA_NAT_REG_PROTO_MAX,
+				 htonl(nat->sreg_proto_max));
+	if (e->flags & (1 << NFTNL_EXPR_NAT_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_NAT_FLAGS, htonl(nat->flags));
+}
+
+static inline const char *nat2str(uint16_t nat)
+{
+	switch (nat) {
+	case NFT_NAT_SNAT:
+		return "snat";
+	case NFT_NAT_DNAT:
+		return "dnat";
+	default:
+		return "unknown";
+	}
+}
+
+static inline int nftnl_str2nat(const char *nat)
+{
+	if (strcmp(nat, "snat") == 0)
+		return NFT_NAT_SNAT;
+	else if (strcmp(nat, "dnat") == 0)
+		return NFT_NAT_DNAT;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
+static int
+nftnl_expr_nat_snprintf(char *buf, size_t remain,
+			uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_nat *nat = nftnl_expr_data(e);
+	int offset = 0, ret = 0;
+
+	ret = snprintf(buf, remain, "%s ", nat2str(nat->type));
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = snprintf(buf + offset, remain, "%s ",
+		       nftnl_family2str(nat->family));
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_ADDR_MIN)) {
+		ret = snprintf(buf + offset, remain,
+			       "addr_min reg %u ", nat->sreg_addr_min);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_ADDR_MAX)) {
+		ret = snprintf(buf + offset, remain,
+			       "addr_max reg %u ", nat->sreg_addr_max);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_PROTO_MIN)) {
+		ret = snprintf(buf + offset, remain,
+			       "proto_min reg %u ", nat->sreg_proto_min);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_NAT_REG_PROTO_MAX)) {
+		ret = snprintf(buf + offset, remain,
+			       "proto_max reg %u ", nat->sreg_proto_max);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_NAT_FLAGS)) {
+		ret = snprintf(buf + offset, remain, "flags 0x%x ", nat->flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_nat = {
+	.name		= "nat",
+	.alloc_len	= sizeof(struct nftnl_expr_nat),
+	.max_attr	= NFTA_NAT_MAX,
+	.set		= nftnl_expr_nat_set,
+	.get		= nftnl_expr_nat_get,
+	.parse		= nftnl_expr_nat_parse,
+	.build		= nftnl_expr_nat_build,
+	.output		= nftnl_expr_nat_snprintf,
+};
diff --git a/src/expr/numgen.c b/src/expr/numgen.c
new file mode 100644
index 0000000..d4020a6
--- /dev/null
+++ b/src/expr/numgen.c
@@ -0,0 +1,184 @@
+/*
+ * (C) 2016 by Laura Garcia <nevola@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_ng {
+	enum nft_registers	dreg;
+	unsigned int		modulus;
+	enum nft_ng_types	type;
+	unsigned int		offset;
+};
+
+static int
+nftnl_expr_ng_set(struct nftnl_expr *e, uint16_t type,
+		  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_ng *ng = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_NG_DREG:
+		memcpy(&ng->dreg, data, sizeof(ng->dreg));
+		break;
+	case NFTNL_EXPR_NG_MODULUS:
+		memcpy(&ng->modulus, data, sizeof(ng->modulus));
+		break;
+	case NFTNL_EXPR_NG_TYPE:
+		memcpy(&ng->type, data, sizeof(ng->type));
+		break;
+	case NFTNL_EXPR_NG_OFFSET:
+		memcpy(&ng->offset, data, sizeof(ng->offset));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_ng_get(const struct nftnl_expr *e, uint16_t type,
+		  uint32_t *data_len)
+{
+	struct nftnl_expr_ng *ng = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_NG_DREG:
+		*data_len = sizeof(ng->dreg);
+		return &ng->dreg;
+	case NFTNL_EXPR_NG_MODULUS:
+		*data_len = sizeof(ng->modulus);
+		return &ng->modulus;
+	case NFTNL_EXPR_NG_TYPE:
+		*data_len = sizeof(ng->type);
+		return &ng->type;
+	case NFTNL_EXPR_NG_OFFSET:
+		*data_len = sizeof(ng->offset);
+		return &ng->offset;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_ng_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_NG_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_NG_DREG:
+	case NFTA_NG_MODULUS:
+	case NFTA_NG_TYPE:
+	case NFTA_NG_OFFSET:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_ng_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_ng *ng = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_NG_DREG))
+		mnl_attr_put_u32(nlh, NFTA_NG_DREG, htonl(ng->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_NG_MODULUS))
+		mnl_attr_put_u32(nlh, NFTA_NG_MODULUS, htonl(ng->modulus));
+	if (e->flags & (1 << NFTNL_EXPR_NG_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_NG_TYPE, htonl(ng->type));
+	if (e->flags & (1 << NFTNL_EXPR_NG_OFFSET))
+		mnl_attr_put_u32(nlh, NFTA_NG_OFFSET, htonl(ng->offset));
+}
+
+static int
+nftnl_expr_ng_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_ng *ng = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_NG_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_ng_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_NG_DREG]) {
+		ng->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_NG_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_NG_DREG);
+	}
+	if (tb[NFTA_NG_MODULUS]) {
+		ng->modulus = ntohl(mnl_attr_get_u32(tb[NFTA_NG_MODULUS]));
+		e->flags |= (1 << NFTNL_EXPR_NG_MODULUS);
+	}
+	if (tb[NFTA_NG_TYPE]) {
+		ng->type = ntohl(mnl_attr_get_u32(tb[NFTA_NG_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_NG_TYPE);
+	}
+	if (tb[NFTA_NG_OFFSET]) {
+		ng->offset = ntohl(mnl_attr_get_u32(tb[NFTA_NG_OFFSET]));
+		e->flags |= (1 << NFTNL_EXPR_NG_OFFSET);
+	}
+
+	return ret;
+}
+
+static int
+nftnl_expr_ng_snprintf(char *buf, size_t remain,
+		       uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_ng *ng = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	switch (ng->type) {
+	case NFT_NG_INCREMENTAL:
+		ret = snprintf(buf, remain, "reg %u = inc mod %u ",
+			       ng->dreg, ng->modulus);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		break;
+	case NFT_NG_RANDOM:
+		ret = snprintf(buf, remain, "reg %u = random mod %u ",
+			       ng->dreg, ng->modulus);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		break;
+	default:
+		return 0;
+	}
+
+	if (ng->offset) {
+		ret = snprintf(buf + offset, remain, "offset %u ", ng->offset);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_ng = {
+	.name		= "numgen",
+	.alloc_len	= sizeof(struct nftnl_expr_ng),
+	.max_attr	= NFTA_NG_MAX,
+	.set		= nftnl_expr_ng_set,
+	.get		= nftnl_expr_ng_get,
+	.parse		= nftnl_expr_ng_parse,
+	.build		= nftnl_expr_ng_build,
+	.output		= nftnl_expr_ng_snprintf,
+};
diff --git a/src/expr/objref.c b/src/expr/objref.c
new file mode 100644
index 0000000..ad0688f
--- /dev/null
+++ b/src/expr/objref.c
@@ -0,0 +1,209 @@
+/*
+ * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_objref {
+	struct {
+		uint32_t	type;
+		const char	*name;
+	} imm;
+	struct {
+		uint32_t	sreg;
+		const char	*name;
+		uint32_t	id;
+	} set;
+};
+
+static int nftnl_expr_objref_set(struct nftnl_expr *e, uint16_t type,
+				 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_OBJREF_IMM_TYPE:
+		memcpy(&objref->imm.type, data, sizeof(objref->imm.type));
+		break;
+	case NFTNL_EXPR_OBJREF_IMM_NAME:
+		objref->imm.name = strdup(data);
+		if (!objref->imm.name)
+			return -1;
+		break;
+	case NFTNL_EXPR_OBJREF_SET_SREG:
+		memcpy(&objref->set.sreg, data, sizeof(objref->set.sreg));
+		break;
+	case NFTNL_EXPR_OBJREF_SET_NAME:
+		objref->set.name = strdup(data);
+		if (!objref->set.name)
+			return -1;
+		break;
+	case NFTNL_EXPR_OBJREF_SET_ID:
+		memcpy(&objref->set.id, data, sizeof(objref->set.id));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_objref_get(const struct nftnl_expr *e,
+					 uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_OBJREF_IMM_TYPE:
+		*data_len = sizeof(objref->imm.type);
+		return &objref->imm.type;
+	case NFTNL_EXPR_OBJREF_IMM_NAME:
+		*data_len = strlen(objref->imm.name) + 1;
+		return objref->imm.name;
+	case NFTNL_EXPR_OBJREF_SET_SREG:
+		*data_len = sizeof(objref->set.sreg);
+		return &objref->set.sreg;
+	case NFTNL_EXPR_OBJREF_SET_NAME:
+		*data_len = strlen(objref->set.name) + 1;
+		return objref->set.name;
+	case NFTNL_EXPR_OBJREF_SET_ID:
+		*data_len = sizeof(objref->set.id);
+		return &objref->set.id;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_objref_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_OBJREF_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_OBJREF_IMM_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJREF_IMM_NAME:
+	case NFTA_OBJREF_SET_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJREF_SET_SREG:
+	case NFTA_OBJREF_SET_ID:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_expr_objref_build(struct nlmsghdr *nlh,
+				    const struct nftnl_expr *e)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_OBJREF_IMM_TYPE,
+				 htonl(objref->imm.type));
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_IMM_NAME))
+		mnl_attr_put_str(nlh, NFTA_OBJREF_IMM_NAME, objref->imm.name);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_SREG))
+		mnl_attr_put_u32(nlh, NFTA_OBJREF_SET_SREG,
+				 htonl(objref->set.sreg));
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_NAME))
+		mnl_attr_put_str(nlh, NFTA_OBJREF_SET_NAME, objref->set.name);
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_ID))
+		mnl_attr_put_u32(nlh, NFTA_OBJREF_SET_ID,
+				 htonl(objref->set.id));
+}
+
+static int nftnl_expr_objref_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_OBJREF_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_objref_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_OBJREF_IMM_TYPE]) {
+		objref->imm.type =
+			ntohl(mnl_attr_get_u32(tb[NFTA_OBJREF_IMM_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_IMM_TYPE);
+	}
+	if (tb[NFTA_OBJREF_IMM_NAME]) {
+		objref->imm.name =
+			strdup(mnl_attr_get_str(tb[NFTA_OBJREF_IMM_NAME]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_IMM_NAME);
+	}
+	if (tb[NFTA_OBJREF_SET_SREG]) {
+		objref->set.sreg =
+			ntohl(mnl_attr_get_u32(tb[NFTA_OBJREF_SET_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_SET_SREG);
+	}
+	if (tb[NFTA_OBJREF_SET_NAME]) {
+		objref->set.name =
+			strdup(mnl_attr_get_str(tb[NFTA_OBJREF_SET_NAME]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_SET_NAME);
+	}
+	if (tb[NFTA_OBJREF_SET_ID]) {
+		objref->set.id =
+			ntohl(mnl_attr_get_u32(tb[NFTA_OBJREF_SET_ID]));
+		e->flags |= (1 << NFTNL_EXPR_OBJREF_SET_ID);
+	}
+
+	return 0;
+}
+
+static int nftnl_expr_objref_snprintf(char *buf, size_t len,
+				      uint32_t flags,
+				      const struct nftnl_expr *e)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_OBJREF_SET_SREG))
+		return snprintf(buf, len, "sreg %u set %s ",
+				objref->set.sreg, objref->set.name);
+	else
+		return snprintf(buf, len, "type %u name %s ",
+				objref->imm.type, objref->imm.name);
+}
+
+static void nftnl_expr_objref_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_objref *objref = nftnl_expr_data(e);
+
+	xfree(objref->imm.name);
+	xfree(objref->set.name);
+}
+
+struct expr_ops expr_ops_objref = {
+	.name		= "objref",
+	.alloc_len	= sizeof(struct nftnl_expr_objref),
+	.max_attr	= NFTA_OBJREF_MAX,
+	.free		= nftnl_expr_objref_free,
+	.set		= nftnl_expr_objref_set,
+	.get		= nftnl_expr_objref_get,
+	.parse		= nftnl_expr_objref_parse,
+	.build		= nftnl_expr_objref_build,
+	.output		= nftnl_expr_objref_snprintf,
+};
diff --git a/src/expr/osf.c b/src/expr/osf.c
new file mode 100644
index 0000000..f15a722
--- /dev/null
+++ b/src/expr/osf.c
@@ -0,0 +1,151 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+#define OSF_GENRE_SIZE	32
+
+struct nftnl_expr_osf {
+	enum nft_registers	dreg;
+	uint8_t			ttl;
+	uint32_t		flags;
+};
+
+static int nftnl_expr_osf_set(struct nftnl_expr *e, uint16_t type,
+			      const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_osf *osf = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_OSF_DREG:
+		memcpy(&osf->dreg, data, sizeof(osf->dreg));
+		break;
+	case NFTNL_EXPR_OSF_TTL:
+		memcpy(&osf->ttl, data, sizeof(osf->ttl));
+		break;
+	case NFTNL_EXPR_OSF_FLAGS:
+		memcpy(&osf->flags, data, sizeof(osf->flags));
+		break;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_osf_get(const struct nftnl_expr *e, uint16_t type,
+		   uint32_t *data_len)
+{
+	struct nftnl_expr_osf *osf = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_OSF_DREG:
+		*data_len = sizeof(osf->dreg);
+		return &osf->dreg;
+	case NFTNL_EXPR_OSF_TTL:
+		*data_len = sizeof(osf->ttl);
+		return &osf->ttl;
+	case NFTNL_EXPR_OSF_FLAGS:
+		*data_len = sizeof(osf->flags);
+		return &osf->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_osf_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_OSF_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTNL_EXPR_OSF_DREG:
+	case NFTNL_EXPR_OSF_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+
+	case NFTNL_EXPR_OSF_TTL:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_osf_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_osf *osf = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_OSF_DREG))
+		mnl_attr_put_u32(nlh, NFTNL_EXPR_OSF_DREG, htonl(osf->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_OSF_TTL))
+		mnl_attr_put_u8(nlh, NFTNL_EXPR_OSF_TTL, osf->ttl);
+	if (e->flags & (1 << NFTNL_EXPR_OSF_FLAGS))
+		if (osf->flags)
+			mnl_attr_put_u32(nlh, NFTNL_EXPR_OSF_FLAGS, htonl(osf->flags));
+}
+
+static int
+nftnl_expr_osf_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_osf *osf = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_OSF_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_osf_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_OSF_DREG]) {
+		osf->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_OSF_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_OSF_DREG);
+	}
+
+	if (tb[NFTA_OSF_TTL]) {
+		osf->ttl = mnl_attr_get_u8(tb[NFTA_OSF_TTL]);
+		e->flags |= (1 << NFTNL_EXPR_OSF_TTL);
+	}
+
+	if (tb[NFTA_OSF_FLAGS]) {
+		osf->flags = ntohl(mnl_attr_get_u32(tb[NFTA_OSF_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_OSF_FLAGS);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_osf_snprintf(char *buf, size_t len,
+			uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_osf *osf = nftnl_expr_data(e);
+	int ret, offset = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_OSF_DREG)) {
+		ret = snprintf(buf, len, "dreg %u ", osf->dreg);
+		SNPRINTF_BUFFER_SIZE(ret, len, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_osf = {
+	.name		= "osf",
+	.alloc_len	= sizeof(struct nftnl_expr_osf),
+	.max_attr	= NFTA_OSF_MAX,
+	.set		= nftnl_expr_osf_set,
+	.get		= nftnl_expr_osf_get,
+	.parse		= nftnl_expr_osf_parse,
+	.build		= nftnl_expr_osf_build,
+	.output		= nftnl_expr_osf_snprintf,
+};
diff --git a/src/expr/payload.c b/src/expr/payload.c
new file mode 100644
index 0000000..c633e33
--- /dev/null
+++ b/src/expr/payload.c
@@ -0,0 +1,250 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <limits.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_payload {
+	enum nft_registers	sreg;
+	enum nft_registers	dreg;
+	enum nft_payload_bases	base;
+	uint32_t		offset;
+	uint32_t		len;
+	uint32_t		csum_type;
+	uint32_t		csum_offset;
+	uint32_t		csum_flags;
+};
+
+static int
+nftnl_expr_payload_set(struct nftnl_expr *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_payload *payload = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_PAYLOAD_SREG:
+		memcpy(&payload->sreg, data, sizeof(payload->sreg));
+		break;
+	case NFTNL_EXPR_PAYLOAD_DREG:
+		memcpy(&payload->dreg, data, sizeof(payload->dreg));
+		break;
+	case NFTNL_EXPR_PAYLOAD_BASE:
+		memcpy(&payload->base, data, sizeof(payload->base));
+		break;
+	case NFTNL_EXPR_PAYLOAD_OFFSET:
+		memcpy(&payload->offset, data, sizeof(payload->offset));
+		break;
+	case NFTNL_EXPR_PAYLOAD_LEN:
+		memcpy(&payload->len, data, sizeof(payload->len));
+		break;
+	case NFTNL_EXPR_PAYLOAD_CSUM_TYPE:
+		memcpy(&payload->csum_type, data, sizeof(payload->csum_type));
+		break;
+	case NFTNL_EXPR_PAYLOAD_CSUM_OFFSET:
+		memcpy(&payload->csum_offset, data, sizeof(payload->csum_offset));
+		break;
+	case NFTNL_EXPR_PAYLOAD_FLAGS:
+		memcpy(&payload->csum_flags, data, sizeof(payload->csum_flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_payload_get(const struct nftnl_expr *e, uint16_t type,
+			  uint32_t *data_len)
+{
+	struct nftnl_expr_payload *payload = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_PAYLOAD_SREG:
+		*data_len = sizeof(payload->sreg);
+		return &payload->sreg;
+	case NFTNL_EXPR_PAYLOAD_DREG:
+		*data_len = sizeof(payload->dreg);
+		return &payload->dreg;
+	case NFTNL_EXPR_PAYLOAD_BASE:
+		*data_len = sizeof(payload->base);
+		return &payload->base;
+	case NFTNL_EXPR_PAYLOAD_OFFSET:
+		*data_len = sizeof(payload->offset);
+		return &payload->offset;
+	case NFTNL_EXPR_PAYLOAD_LEN:
+		*data_len = sizeof(payload->len);
+		return &payload->len;
+	case NFTNL_EXPR_PAYLOAD_CSUM_TYPE:
+		*data_len = sizeof(payload->csum_type);
+		return &payload->csum_type;
+	case NFTNL_EXPR_PAYLOAD_CSUM_OFFSET:
+		*data_len = sizeof(payload->csum_offset);
+		return &payload->csum_offset;
+	case NFTNL_EXPR_PAYLOAD_FLAGS:
+		*data_len = sizeof(payload->csum_flags);
+		return &payload->csum_flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_payload_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_PAYLOAD_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_PAYLOAD_SREG:
+	case NFTA_PAYLOAD_DREG:
+	case NFTA_PAYLOAD_BASE:
+	case NFTA_PAYLOAD_OFFSET:
+	case NFTA_PAYLOAD_LEN:
+	case NFTA_PAYLOAD_CSUM_TYPE:
+	case NFTA_PAYLOAD_CSUM_OFFSET:
+	case NFTA_PAYLOAD_CSUM_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_payload_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_payload *payload = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_SREG))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_SREG, htonl(payload->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_DREG))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_DREG, htonl(payload->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_BASE))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_BASE, htonl(payload->base));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_OFFSET))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_OFFSET, htonl(payload->offset));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_LEN))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_LEN, htonl(payload->len));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_CSUM_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_CSUM_TYPE,
+				 htonl(payload->csum_type));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_CSUM_OFFSET))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_CSUM_OFFSET,
+				 htonl(payload->csum_offset));
+	if (e->flags & (1 << NFTNL_EXPR_PAYLOAD_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_PAYLOAD_CSUM_FLAGS,
+				 htonl(payload->csum_flags));
+}
+
+static int
+nftnl_expr_payload_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_payload *payload = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_PAYLOAD_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_payload_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_PAYLOAD_SREG]) {
+		payload->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_SREG]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_SREG);
+	}
+	if (tb[NFTA_PAYLOAD_DREG]) {
+		payload->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_DREG);
+	}
+	if (tb[NFTA_PAYLOAD_BASE]) {
+		payload->base = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_BASE]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_BASE);
+	}
+	if (tb[NFTA_PAYLOAD_OFFSET]) {
+		payload->offset = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_OFFSET]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_OFFSET);
+	}
+	if (tb[NFTA_PAYLOAD_LEN]) {
+		payload->len = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_LEN]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_LEN);
+	}
+	if (tb[NFTA_PAYLOAD_CSUM_TYPE]) {
+		payload->csum_type = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_CSUM_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_CSUM_TYPE);
+	}
+	if (tb[NFTA_PAYLOAD_CSUM_OFFSET]) {
+		payload->csum_offset = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_CSUM_OFFSET]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_CSUM_OFFSET);
+	}
+	if (tb[NFTA_PAYLOAD_CSUM_FLAGS]) {
+		payload->csum_flags = ntohl(mnl_attr_get_u32(tb[NFTA_PAYLOAD_CSUM_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_PAYLOAD_FLAGS);
+	}
+	return 0;
+}
+
+static const char *base2str_array[NFT_PAYLOAD_TUN_HEADER + 1] = {
+	[NFT_PAYLOAD_LL_HEADER]		= "link",
+	[NFT_PAYLOAD_NETWORK_HEADER] 	= "network",
+	[NFT_PAYLOAD_TRANSPORT_HEADER]	= "transport",
+	[NFT_PAYLOAD_INNER_HEADER]	= "inner",
+	[NFT_PAYLOAD_TUN_HEADER]	= "tunnel",
+};
+
+static const char *base2str(enum nft_payload_bases base)
+{
+	if (base > NFT_PAYLOAD_INNER_HEADER)
+		return "unknown";
+
+	return base2str_array[base];
+}
+
+static int
+nftnl_expr_payload_snprintf(char *buf, size_t len,
+			    uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_payload *payload = nftnl_expr_data(e);
+
+	if (payload->sreg)
+		return snprintf(buf, len, "write reg %u => %ub @ %s header + %u csum_type %u csum_off %u csum_flags 0x%x ",
+				payload->sreg,
+				payload->len, base2str(payload->base),
+				payload->offset, payload->csum_type,
+				payload->csum_offset,
+				payload->csum_flags);
+	else
+		return snprintf(buf, len, "load %ub @ %s header + %u => reg %u ",
+				payload->len, base2str(payload->base),
+				payload->offset, payload->dreg);
+}
+
+struct expr_ops expr_ops_payload = {
+	.name		= "payload",
+	.alloc_len	= sizeof(struct nftnl_expr_payload),
+	.max_attr	= NFTA_PAYLOAD_MAX,
+	.set		= nftnl_expr_payload_set,
+	.get		= nftnl_expr_payload_get,
+	.parse		= nftnl_expr_payload_parse,
+	.build		= nftnl_expr_payload_build,
+	.output		= nftnl_expr_payload_snprintf,
+};
diff --git a/src/expr/queue.c b/src/expr/queue.c
new file mode 100644
index 0000000..de287f2
--- /dev/null
+++ b/src/expr/queue.c
@@ -0,0 +1,197 @@
+/*
+ * (C) 2013 by Eric Leblond <eric@regit.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_queue {
+	enum nft_registers	sreg_qnum;
+	uint16_t		queuenum;
+	uint16_t		queues_total;
+	uint16_t		flags;
+};
+
+static int nftnl_expr_queue_set(struct nftnl_expr *e, uint16_t type,
+				    const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_queue *queue = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_QUEUE_NUM:
+		memcpy(&queue->queuenum, data, sizeof(queue->queuenum));
+		break;
+	case NFTNL_EXPR_QUEUE_TOTAL:
+		memcpy(&queue->queues_total, data, sizeof(queue->queues_total));
+		break;
+	case NFTNL_EXPR_QUEUE_FLAGS:
+		memcpy(&queue->flags, data, sizeof(queue->flags));
+		break;
+	case NFTNL_EXPR_QUEUE_SREG_QNUM:
+		memcpy(&queue->sreg_qnum, data, sizeof(queue->sreg_qnum));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_queue_get(const struct nftnl_expr *e, uint16_t type,
+			 uint32_t *data_len)
+{
+	struct nftnl_expr_queue *queue = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_QUEUE_NUM:
+		*data_len = sizeof(queue->queuenum);
+		return &queue->queuenum;
+	case NFTNL_EXPR_QUEUE_TOTAL:
+		*data_len = sizeof(queue->queues_total);
+		return &queue->queues_total;
+	case NFTNL_EXPR_QUEUE_FLAGS:
+		*data_len = sizeof(queue->flags);
+		return &queue->flags;
+	case NFTNL_EXPR_QUEUE_SREG_QNUM:
+		*data_len = sizeof(queue->sreg_qnum);
+		return &queue->sreg_qnum;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_queue_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_QUEUE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_QUEUE_NUM:
+	case NFTA_QUEUE_TOTAL:
+	case NFTA_QUEUE_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_QUEUE_SREG_QNUM:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_queue_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_queue *queue = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_NUM))
+		mnl_attr_put_u16(nlh, NFTA_QUEUE_NUM, htons(queue->queuenum));
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_TOTAL))
+		mnl_attr_put_u16(nlh, NFTA_QUEUE_TOTAL, htons(queue->queues_total));
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_FLAGS))
+		mnl_attr_put_u16(nlh, NFTA_QUEUE_FLAGS, htons(queue->flags));
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_SREG_QNUM))
+		mnl_attr_put_u32(nlh, NFTA_QUEUE_SREG_QNUM, htonl(queue->sreg_qnum));
+}
+
+static int
+nftnl_expr_queue_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_queue *queue = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_QUEUE_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_queue_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_QUEUE_NUM]) {
+		queue->queuenum = ntohs(mnl_attr_get_u16(tb[NFTA_QUEUE_NUM]));
+		e->flags |= (1 << NFTNL_EXPR_QUEUE_NUM);
+	}
+	if (tb[NFTA_QUEUE_TOTAL]) {
+		queue->queues_total = ntohs(mnl_attr_get_u16(tb[NFTA_QUEUE_TOTAL]));
+		e->flags |= (1 << NFTNL_EXPR_QUEUE_TOTAL);
+	}
+	if (tb[NFTA_QUEUE_FLAGS]) {
+		queue->flags = ntohs(mnl_attr_get_u16(tb[NFTA_QUEUE_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_QUEUE_FLAGS);
+	}
+	if (tb[NFTA_QUEUE_SREG_QNUM]) {
+		queue->sreg_qnum = ntohl(mnl_attr_get_u32(tb[NFTA_QUEUE_SREG_QNUM]));
+		e->flags |= (1 << NFTNL_EXPR_QUEUE_SREG_QNUM);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_queue_snprintf(char *buf, size_t remain,
+			  uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_queue *queue = nftnl_expr_data(e);
+	uint16_t total_queues;
+	int ret, offset = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_NUM)) {
+		total_queues = queue->queuenum + queue->queues_total - 1;
+
+		ret = snprintf(buf + offset, remain, "num %u", queue->queuenum);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (queue->queues_total && total_queues != queue->queuenum) {
+			ret = snprintf(buf + offset, remain, "-%u", total_queues);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+
+		ret = snprintf(buf + offset, remain, " ");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_SREG_QNUM)) {
+		ret = snprintf(buf + offset, remain, "sreg_qnum %u ",
+			       queue->sreg_qnum);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_QUEUE_FLAGS)) {
+		if (queue->flags & (NFT_QUEUE_FLAG_BYPASS)) {
+			ret = snprintf(buf + offset, remain, "bypass ");
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+		if (queue->flags & (NFT_QUEUE_FLAG_CPU_FANOUT)) {
+			ret = snprintf(buf + offset, remain, "fanout ");
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+	}
+	return offset;
+}
+
+struct expr_ops expr_ops_queue = {
+	.name		= "queue",
+	.alloc_len	= sizeof(struct nftnl_expr_queue),
+	.max_attr	= NFTA_QUEUE_MAX,
+	.set		= nftnl_expr_queue_set,
+	.get		= nftnl_expr_queue_get,
+	.parse		= nftnl_expr_queue_parse,
+	.build		= nftnl_expr_queue_build,
+	.output		= nftnl_expr_queue_snprintf,
+};
diff --git a/src/expr/quota.c b/src/expr/quota.c
new file mode 100644
index 0000000..835729c
--- /dev/null
+++ b/src/expr/quota.c
@@ -0,0 +1,151 @@
+/*
+ * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_quota {
+	uint64_t	bytes;
+	uint64_t	consumed;
+	uint32_t	flags;
+};
+
+static int nftnl_expr_quota_set(struct nftnl_expr *e, uint16_t type,
+				const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_quota *quota = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_QUOTA_BYTES:
+		memcpy(&quota->bytes, data, sizeof(quota->bytes));
+		break;
+	case NFTNL_EXPR_QUOTA_CONSUMED:
+		memcpy(&quota->consumed, data, sizeof(quota->consumed));
+		break;
+	case NFTNL_EXPR_QUOTA_FLAGS:
+		memcpy(&quota->flags, data, sizeof(quota->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_quota_get(const struct nftnl_expr *e,
+					uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_quota *quota = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_QUOTA_BYTES:
+		*data_len = sizeof(quota->bytes);
+		return &quota->bytes;
+	case NFTNL_EXPR_QUOTA_CONSUMED:
+		*data_len = sizeof(quota->consumed);
+		return &quota->consumed;
+	case NFTNL_EXPR_QUOTA_FLAGS:
+		*data_len = sizeof(quota->flags);
+		return &quota->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_quota_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_QUOTA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_QUOTA_BYTES:
+	case NFTA_QUOTA_CONSUMED:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_QUOTA_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_quota_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_quota *quota = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_QUOTA_BYTES))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_BYTES, htobe64(quota->bytes));
+	if (e->flags & (1 << NFTNL_EXPR_QUOTA_CONSUMED))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_CONSUMED, htobe64(quota->consumed));
+	if (e->flags & (1 << NFTNL_EXPR_QUOTA_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_QUOTA_FLAGS, htonl(quota->flags));
+}
+
+static int
+nftnl_expr_quota_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_quota *quota = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_QUOTA_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_quota_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_QUOTA_BYTES]) {
+		quota->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_BYTES]));
+		e->flags |= (1 << NFTNL_EXPR_QUOTA_BYTES);
+	}
+	if (tb[NFTA_QUOTA_CONSUMED]) {
+		quota->consumed = be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_CONSUMED]));
+		e->flags |= (1 << NFTNL_EXPR_QUOTA_CONSUMED);
+	}
+	if (tb[NFTA_QUOTA_FLAGS]) {
+		quota->flags = ntohl(mnl_attr_get_u32(tb[NFTA_QUOTA_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_QUOTA_FLAGS);
+	}
+
+	return 0;
+}
+
+static int nftnl_expr_quota_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_expr *e)
+{
+	struct nftnl_expr_quota *quota = nftnl_expr_data(e);
+
+	return snprintf(buf, len,
+			"bytes %"PRIu64" consumed %"PRIu64" flags %u ",
+			quota->bytes, quota->consumed, quota->flags);
+}
+
+struct expr_ops expr_ops_quota = {
+	.name		= "quota",
+	.alloc_len	= sizeof(struct nftnl_expr_quota),
+	.max_attr	= NFTA_QUOTA_MAX,
+	.set		= nftnl_expr_quota_set,
+	.get		= nftnl_expr_quota_get,
+	.parse		= nftnl_expr_quota_parse,
+	.build		= nftnl_expr_quota_build,
+	.output		= nftnl_expr_quota_snprintf,
+};
diff --git a/src/expr/range.c b/src/expr/range.c
new file mode 100644
index 0000000..473add8
--- /dev/null
+++ b/src/expr/range.c
@@ -0,0 +1,217 @@
+/*
+ * (C) 2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_range {
+	union nftnl_data_reg	data_from;
+	union nftnl_data_reg	data_to;
+	enum nft_registers	sreg;
+	enum nft_range_ops	op;
+};
+
+static int nftnl_expr_range_set(struct nftnl_expr *e, uint16_t type,
+				const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_range *range = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_RANGE_SREG:
+		memcpy(&range->sreg, data, sizeof(range->sreg));
+		break;
+	case NFTNL_EXPR_RANGE_OP:
+		memcpy(&range->op, data, sizeof(range->op));
+		break;
+	case NFTNL_EXPR_RANGE_FROM_DATA:
+		memcpy(&range->data_from.val, data, data_len);
+		range->data_from.len = data_len;
+		break;
+	case NFTNL_EXPR_RANGE_TO_DATA:
+		memcpy(&range->data_to.val, data, data_len);
+		range->data_to.len = data_len;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_expr_range_get(const struct nftnl_expr *e,
+					uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_expr_range *range = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_RANGE_SREG:
+		*data_len = sizeof(range->sreg);
+		return &range->sreg;
+	case NFTNL_EXPR_RANGE_OP:
+		*data_len = sizeof(range->op);
+		return &range->op;
+	case NFTNL_EXPR_RANGE_FROM_DATA:
+		*data_len = range->data_from.len;
+		return &range->data_from.val;
+	case NFTNL_EXPR_RANGE_TO_DATA:
+		*data_len = range->data_to.len;
+		return &range->data_to.val;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_range_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_RANGE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_RANGE_SREG:
+	case NFTA_RANGE_OP:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_RANGE_FROM_DATA:
+	case NFTA_RANGE_TO_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_range_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_range *range = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_RANGE_SREG))
+		mnl_attr_put_u32(nlh, NFTA_RANGE_SREG, htonl(range->sreg));
+	if (e->flags & (1 << NFTNL_EXPR_RANGE_OP))
+		mnl_attr_put_u32(nlh, NFTA_RANGE_OP, htonl(range->op));
+	if (e->flags & (1 << NFTNL_EXPR_RANGE_FROM_DATA)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_RANGE_FROM_DATA);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, range->data_from.len,
+			     range->data_from.val);
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_RANGE_TO_DATA)) {
+		struct nlattr *nest;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_RANGE_TO_DATA);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, range->data_to.len,
+			     range->data_to.val);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int
+nftnl_expr_range_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_range *range = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_RANGE_MAX+1] = {};
+	int ret = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_range_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_RANGE_SREG]) {
+		range->sreg = ntohl(mnl_attr_get_u32(tb[NFTA_RANGE_SREG]));
+		e->flags |= (1 << NFTA_RANGE_SREG);
+	}
+	if (tb[NFTA_RANGE_OP]) {
+		range->op = ntohl(mnl_attr_get_u32(tb[NFTA_RANGE_OP]));
+		e->flags |= (1 << NFTA_RANGE_OP);
+	}
+	if (tb[NFTA_RANGE_FROM_DATA]) {
+		ret = nftnl_parse_data(&range->data_from,
+				       tb[NFTA_RANGE_FROM_DATA], NULL);
+		e->flags |= (1 << NFTA_RANGE_FROM_DATA);
+	}
+	if (tb[NFTA_RANGE_TO_DATA]) {
+		ret = nftnl_parse_data(&range->data_to,
+				       tb[NFTA_RANGE_TO_DATA], NULL);
+		e->flags |= (1 << NFTA_RANGE_TO_DATA);
+	}
+
+	return ret;
+}
+
+static const char *expr_range_str[] = {
+	[NFT_RANGE_EQ]	= "eq",
+	[NFT_RANGE_NEQ]	= "neq",
+};
+
+static const char *range2str(uint32_t op)
+{
+	if (op > NFT_RANGE_NEQ)
+		return "unknown";
+
+	return expr_range_str[op];
+}
+
+static inline int nftnl_str2range(const char *op)
+{
+	if (strcmp(op, "eq") == 0)
+		return NFT_RANGE_EQ;
+	else if (strcmp(op, "neq") == 0)
+		return NFT_RANGE_NEQ;
+	else {
+		errno = EINVAL;
+		return -1;
+	}
+}
+
+static int nftnl_expr_range_snprintf(char *buf, size_t remain,
+				     uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_range *range = nftnl_expr_data(e);
+	int offset = 0, ret;
+
+	ret = snprintf(buf, remain, "%s reg %u ",
+		       range2str(range->op), range->sreg);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &range->data_from,
+				      0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &range->data_to,
+				      0, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+struct expr_ops expr_ops_range = {
+	.name		= "range",
+	.alloc_len	= sizeof(struct nftnl_expr_range),
+	.max_attr	= NFTA_RANGE_MAX,
+	.set		= nftnl_expr_range_set,
+	.get		= nftnl_expr_range_get,
+	.parse		= nftnl_expr_range_parse,
+	.build		= nftnl_expr_range_build,
+	.output		= nftnl_expr_range_snprintf,
+};
diff --git a/src/expr/redir.c b/src/expr/redir.c
new file mode 100644
index 0000000..87c2acc
--- /dev/null
+++ b/src/expr/redir.c
@@ -0,0 +1,171 @@
+/*
+ * (C) 2014 by Arturo Borrero Gonzalez <arturo@debian.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_redir {
+	enum nft_registers sreg_proto_min;
+	enum nft_registers sreg_proto_max;
+	uint32_t	flags;
+};
+
+static int
+nftnl_expr_redir_set(struct nftnl_expr *e, uint16_t type,
+			const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_redir *redir = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_REDIR_REG_PROTO_MIN:
+		memcpy(&redir->sreg_proto_min, data, sizeof(redir->sreg_proto_min));
+		break;
+	case NFTNL_EXPR_REDIR_REG_PROTO_MAX:
+		memcpy(&redir->sreg_proto_max, data, sizeof(redir->sreg_proto_max));
+		break;
+	case NFTNL_EXPR_REDIR_FLAGS:
+		memcpy(&redir->flags, data, sizeof(redir->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_redir_get(const struct nftnl_expr *e, uint16_t type,
+			uint32_t *data_len)
+{
+	struct nftnl_expr_redir *redir = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_REDIR_REG_PROTO_MIN:
+		*data_len = sizeof(redir->sreg_proto_min);
+		return &redir->sreg_proto_min;
+	case NFTNL_EXPR_REDIR_REG_PROTO_MAX:
+		*data_len = sizeof(redir->sreg_proto_max);
+		return &redir->sreg_proto_max;
+	case NFTNL_EXPR_REDIR_FLAGS:
+		*data_len = sizeof(redir->flags);
+		return &redir->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_redir_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_REDIR_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_REDIR_REG_PROTO_MIN:
+	case NFTA_REDIR_REG_PROTO_MAX:
+	case NFTA_REDIR_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_redir_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_redir *redir = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_REDIR_REG_PROTO_MIN))
+		mnl_attr_put_u32(nlh, NFTA_REDIR_REG_PROTO_MIN,
+				 htobe32(redir->sreg_proto_min));
+	if (e->flags & (1 << NFTNL_EXPR_REDIR_REG_PROTO_MAX))
+		mnl_attr_put_u32(nlh, NFTA_REDIR_REG_PROTO_MAX,
+				 htobe32(redir->sreg_proto_max));
+	if (e->flags & (1 << NFTNL_EXPR_REDIR_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_REDIR_FLAGS, htobe32(redir->flags));
+}
+
+static int
+nftnl_expr_redir_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_redir *redir = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_REDIR_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_redir_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_REDIR_REG_PROTO_MIN]) {
+		redir->sreg_proto_min =
+			ntohl(mnl_attr_get_u32(tb[NFTA_REDIR_REG_PROTO_MIN]));
+		e->flags |= (1 << NFTNL_EXPR_REDIR_REG_PROTO_MIN);
+	}
+	if (tb[NFTA_REDIR_REG_PROTO_MAX]) {
+		redir->sreg_proto_max =
+			ntohl(mnl_attr_get_u32(tb[NFTA_REDIR_REG_PROTO_MAX]));
+		e->flags |= (1 << NFTNL_EXPR_REDIR_REG_PROTO_MAX);
+	}
+	if (tb[NFTA_REDIR_FLAGS]) {
+		redir->flags = be32toh(mnl_attr_get_u32(tb[NFTA_REDIR_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_REDIR_FLAGS);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_redir_snprintf(char *buf, size_t remain,
+			  uint32_t flags, const struct nftnl_expr *e)
+{
+	int ret, offset = 0;
+	struct nftnl_expr_redir *redir = nftnl_expr_data(e);
+
+	if (nftnl_expr_is_set(e, NFTNL_EXPR_REDIR_REG_PROTO_MIN)) {
+		ret = snprintf(buf + offset, remain, "proto_min reg %u ",
+			       redir->sreg_proto_min);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (nftnl_expr_is_set(e, NFTNL_EXPR_REDIR_REG_PROTO_MAX)) {
+		ret = snprintf(buf + offset, remain, "proto_max reg %u ",
+			       redir->sreg_proto_max);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (nftnl_expr_is_set(e, NFTNL_EXPR_REDIR_FLAGS)) {
+		ret = snprintf(buf + offset, remain, "flags 0x%x ",
+			       redir->flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_redir = {
+	.name		= "redir",
+	.alloc_len	= sizeof(struct nftnl_expr_redir),
+	.max_attr	= NFTA_REDIR_MAX,
+	.set		= nftnl_expr_redir_set,
+	.get		= nftnl_expr_redir_get,
+	.parse		= nftnl_expr_redir_parse,
+	.build		= nftnl_expr_redir_build,
+	.output		= nftnl_expr_redir_snprintf,
+};
diff --git a/src/expr/reject.c b/src/expr/reject.c
new file mode 100644
index 0000000..c7c9441
--- /dev/null
+++ b/src/expr/reject.c
@@ -0,0 +1,138 @@
+/*
+ * (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_reject {
+	uint32_t		type;
+	uint8_t			icmp_code;
+};
+
+static int nftnl_expr_reject_set(struct nftnl_expr *e, uint16_t type,
+				    const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_reject *reject = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_REJECT_TYPE:
+		memcpy(&reject->type, data, sizeof(reject->type));
+		break;
+	case NFTNL_EXPR_REJECT_CODE:
+		memcpy(&reject->icmp_code, data, sizeof(reject->icmp_code));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_reject_get(const struct nftnl_expr *e, uint16_t type,
+			 uint32_t *data_len)
+{
+	struct nftnl_expr_reject *reject = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_REJECT_TYPE:
+		*data_len = sizeof(reject->type);
+		return &reject->type;
+	case NFTNL_EXPR_REJECT_CODE:
+		*data_len = sizeof(reject->icmp_code);
+		return &reject->icmp_code;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_reject_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_REJECT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_REJECT_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_REJECT_ICMP_CODE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_reject_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_reject *reject = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_REJECT_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_REJECT_TYPE, htonl(reject->type));
+	if (e->flags & (1 << NFTNL_EXPR_REJECT_CODE))
+		mnl_attr_put_u8(nlh, NFTA_REJECT_ICMP_CODE, reject->icmp_code);
+}
+
+static int
+nftnl_expr_reject_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_reject *reject = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_REJECT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_reject_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_REJECT_TYPE]) {
+		reject->type = ntohl(mnl_attr_get_u32(tb[NFTA_REJECT_TYPE]));
+		e->flags |= (1 << NFTNL_EXPR_REJECT_TYPE);
+	}
+	if (tb[NFTA_REJECT_ICMP_CODE]) {
+		reject->icmp_code = mnl_attr_get_u8(tb[NFTA_REJECT_ICMP_CODE]);
+		e->flags |= (1 << NFTNL_EXPR_REJECT_CODE);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_reject_snprintf(char *buf, size_t len,
+			   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_reject *reject = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "type %u code %u ",
+			reject->type, reject->icmp_code);
+}
+
+struct expr_ops expr_ops_reject = {
+	.name		= "reject",
+	.alloc_len	= sizeof(struct nftnl_expr_reject),
+	.max_attr	= NFTA_REJECT_MAX,
+	.set		= nftnl_expr_reject_set,
+	.get		= nftnl_expr_reject_get,
+	.parse		= nftnl_expr_reject_parse,
+	.build		= nftnl_expr_reject_build,
+	.output		= nftnl_expr_reject_snprintf,
+};
diff --git a/src/expr/rt.c b/src/expr/rt.c
new file mode 100644
index 0000000..695a658
--- /dev/null
+++ b/src/expr/rt.c
@@ -0,0 +1,166 @@
+/*
+ * Copyright (c) 2016 Anders K. Pedersen <akp@cohaesio.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_rt {
+	enum nft_rt_keys	key;
+	enum nft_registers	dreg;
+};
+
+static int
+nftnl_expr_rt_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_rt *rt = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_RT_KEY:
+		memcpy(&rt->key, data, sizeof(rt->key));
+		break;
+	case NFTNL_EXPR_RT_DREG:
+		memcpy(&rt->dreg, data, sizeof(rt->dreg));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_rt_get(const struct nftnl_expr *e, uint16_t type,
+		       uint32_t *data_len)
+{
+	struct nftnl_expr_rt *rt = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_RT_KEY:
+		*data_len = sizeof(rt->key);
+		return &rt->key;
+	case NFTNL_EXPR_RT_DREG:
+		*data_len = sizeof(rt->dreg);
+		return &rt->dreg;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_rt_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_RT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_RT_KEY:
+	case NFTA_RT_DREG:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_rt_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_rt *rt = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_RT_KEY))
+		mnl_attr_put_u32(nlh, NFTA_RT_KEY, htonl(rt->key));
+	if (e->flags & (1 << NFTNL_EXPR_RT_DREG))
+		mnl_attr_put_u32(nlh, NFTA_RT_DREG, htonl(rt->dreg));
+}
+
+static int
+nftnl_expr_rt_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_rt *rt = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_RT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_rt_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_RT_KEY]) {
+		rt->key = ntohl(mnl_attr_get_u32(tb[NFTA_RT_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_RT_KEY);
+	}
+	if (tb[NFTA_RT_DREG]) {
+		rt->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_RT_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_RT_DREG);
+	}
+
+	return 0;
+}
+
+static const char *rt_key2str_array[NFT_RT_MAX + 1] = {
+	[NFT_RT_CLASSID]	= "classid",
+	[NFT_RT_NEXTHOP4]	= "nexthop4",
+	[NFT_RT_NEXTHOP6]	= "nexthop6",
+	[NFT_RT_TCPMSS]		= "tcpmss",
+	[NFT_RT_XFRM]		= "ipsec",
+};
+
+static const char *rt_key2str(uint8_t key)
+{
+	if (key <= NFT_RT_MAX)
+		return rt_key2str_array[key];
+
+	return "unknown";
+}
+
+static inline int str2rt_key(const char *str)
+{
+	int i;
+
+	for (i = 0; i < NFT_RT_MAX; i++) {
+		if (strcmp(str, rt_key2str_array[i]) == 0)
+			return i;
+	}
+
+	errno = EINVAL;
+	return -1;
+}
+
+static int
+nftnl_expr_rt_snprintf(char *buf, size_t len,
+		       uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_rt *rt = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_RT_DREG)) {
+		return snprintf(buf, len, "load %s => reg %u ",
+				rt_key2str(rt->key), rt->dreg);
+	}
+	return 0;
+}
+
+struct expr_ops expr_ops_rt = {
+	.name		= "rt",
+	.alloc_len	= sizeof(struct nftnl_expr_rt),
+	.max_attr	= NFTA_RT_MAX,
+	.set		= nftnl_expr_rt_set,
+	.get		= nftnl_expr_rt_get,
+	.parse		= nftnl_expr_rt_parse,
+	.build		= nftnl_expr_rt_build,
+	.output		= nftnl_expr_rt_snprintf,
+};
diff --git a/src/expr/socket.c b/src/expr/socket.c
new file mode 100644
index 0000000..83045c0
--- /dev/null
+++ b/src/expr/socket.c
@@ -0,0 +1,169 @@
+/*
+ * Copyright (c) 2018 Máté Eckl <ecklm94@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_socket {
+	enum nft_socket_keys	key;
+	enum nft_registers	dreg;
+	uint32_t		level;
+};
+
+static int
+nftnl_expr_socket_set(struct nftnl_expr *e, uint16_t type,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_SOCKET_KEY:
+		memcpy(&socket->key, data, sizeof(socket->key));
+		break;
+	case NFTNL_EXPR_SOCKET_DREG:
+		memcpy(&socket->dreg, data, sizeof(socket->dreg));
+		break;
+	case NFTNL_EXPR_SOCKET_LEVEL:
+		memcpy(&socket->level, data, sizeof(socket->level));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_socket_get(const struct nftnl_expr *e, uint16_t type,
+		       uint32_t *data_len)
+{
+	struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+	switch (type) {
+	case NFTNL_EXPR_SOCKET_KEY:
+		*data_len = sizeof(socket->key);
+		return &socket->key;
+	case NFTNL_EXPR_SOCKET_DREG:
+		*data_len = sizeof(socket->dreg);
+		return &socket->dreg;
+	case NFTNL_EXPR_SOCKET_LEVEL:
+		*data_len = sizeof(socket->level);
+		return &socket->level;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_socket_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_SOCKET_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_SOCKET_KEY:
+	case NFTA_SOCKET_DREG:
+	case NFTA_SOCKET_LEVEL:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_socket_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_SOCKET_KEY))
+		mnl_attr_put_u32(nlh, NFTA_SOCKET_KEY, htonl(socket->key));
+	if (e->flags & (1 << NFTNL_EXPR_SOCKET_DREG))
+		mnl_attr_put_u32(nlh, NFTA_SOCKET_DREG, htonl(socket->dreg));
+	if (e->flags & (1 << NFTNL_EXPR_SOCKET_LEVEL))
+		mnl_attr_put_u32(nlh, NFTA_SOCKET_LEVEL, htonl(socket->level));
+}
+
+static int
+nftnl_expr_socket_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_SOCKET_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_socket_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_SOCKET_KEY]) {
+		socket->key = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_SOCKET_KEY);
+	}
+	if (tb[NFTA_SOCKET_DREG]) {
+		socket->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_SOCKET_DREG);
+	}
+	if (tb[NFTA_SOCKET_LEVEL]) {
+		socket->level = ntohl(mnl_attr_get_u32(tb[NFTA_SOCKET_LEVEL]));
+		e->flags |= (1 << NFTNL_EXPR_SOCKET_LEVEL);
+	}
+
+	return 0;
+}
+
+static const char *socket_key2str_array[NFT_SOCKET_MAX + 1] = {
+	[NFT_SOCKET_TRANSPARENT] = "transparent",
+	[NFT_SOCKET_MARK] = "mark",
+	[NFT_SOCKET_WILDCARD] = "wildcard",
+	[NFT_SOCKET_CGROUPV2] = "cgroupv2",
+};
+
+static const char *socket_key2str(uint8_t key)
+{
+	if (key < NFT_SOCKET_MAX + 1)
+		return socket_key2str_array[key];
+
+	return "unknown";
+}
+
+static int
+nftnl_expr_socket_snprintf(char *buf, size_t len,
+		       uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_socket *socket = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_SOCKET_DREG)) {
+		return snprintf(buf, len, "load %s => reg %u ",
+				socket_key2str(socket->key), socket->dreg);
+	}
+	if (e->flags & (1 << NFTNL_EXPR_SOCKET_LEVEL))
+		return snprintf(buf, len, "level %u ", socket->level);
+
+	return 0;
+}
+
+struct expr_ops expr_ops_socket = {
+	.name		= "socket",
+	.alloc_len	= sizeof(struct nftnl_expr_socket),
+	.max_attr	= NFTA_SOCKET_MAX,
+	.set		= nftnl_expr_socket_set,
+	.get		= nftnl_expr_socket_get,
+	.parse		= nftnl_expr_socket_parse,
+	.build		= nftnl_expr_socket_build,
+	.output		= nftnl_expr_socket_snprintf,
+};
diff --git a/src/expr/synproxy.c b/src/expr/synproxy.c
new file mode 100644
index 0000000..47fcaef
--- /dev/null
+++ b/src/expr/synproxy.c
@@ -0,0 +1,156 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_synproxy {
+	uint16_t	mss;
+	uint8_t		wscale;
+	uint32_t	flags;
+};
+
+static int nftnl_expr_synproxy_set(struct nftnl_expr *e, uint16_t type,
+				   const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_synproxy *synproxy = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_SYNPROXY_MSS:
+		memcpy(&synproxy->mss, data, sizeof(synproxy->mss));
+		break;
+	case NFTNL_EXPR_SYNPROXY_WSCALE:
+		memcpy(&synproxy->wscale, data, sizeof(synproxy->wscale));
+		break;
+	case NFTNL_EXPR_SYNPROXY_FLAGS:
+		memcpy(&synproxy->flags, data, sizeof(synproxy->flags));
+		break;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_synproxy_get(const struct nftnl_expr *e, uint16_t type,
+			uint32_t *data_len)
+{
+	struct nftnl_expr_synproxy *synproxy = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_SYNPROXY_MSS:
+		*data_len = sizeof(synproxy->mss);
+		return &synproxy->mss;
+	case NFTNL_EXPR_SYNPROXY_WSCALE:
+		*data_len = sizeof(synproxy->wscale);
+		return &synproxy->wscale;
+	case NFTNL_EXPR_SYNPROXY_FLAGS:
+		*data_len = sizeof(synproxy->flags);
+		return &synproxy->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_synproxy_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_SYNPROXY_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTNL_EXPR_SYNPROXY_MSS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+
+	case NFTNL_EXPR_SYNPROXY_WSCALE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+
+	case NFTNL_EXPR_SYNPROXY_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_synproxy_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_synproxy *synproxy = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_SYNPROXY_MSS))
+		mnl_attr_put_u16(nlh, NFTNL_EXPR_SYNPROXY_MSS,
+				 htons(synproxy->mss));
+	if (e->flags & (1 << NFTNL_EXPR_SYNPROXY_WSCALE))
+		mnl_attr_put_u8(nlh, NFTNL_EXPR_SYNPROXY_WSCALE,
+				synproxy->wscale);
+	if (e->flags & (1 << NFTNL_EXPR_SYNPROXY_FLAGS))
+		mnl_attr_put_u32(nlh, NFTNL_EXPR_SYNPROXY_FLAGS,
+				 htonl(synproxy->flags));
+}
+
+static int
+nftnl_expr_synproxy_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_synproxy *synproxy = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_SYNPROXY_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_synproxy_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_SYNPROXY_MSS]) {
+		synproxy->mss = ntohs(mnl_attr_get_u16(tb[NFTA_SYNPROXY_MSS]));
+		e->flags |= (1 << NFTNL_EXPR_SYNPROXY_MSS);
+	}
+
+	if (tb[NFTA_SYNPROXY_WSCALE]) {
+		synproxy->wscale = mnl_attr_get_u8(tb[NFTA_SYNPROXY_WSCALE]);
+		e->flags |= (1 << NFTNL_EXPR_SYNPROXY_WSCALE);
+	}
+
+	if (tb[NFTA_SYNPROXY_FLAGS]) {
+		synproxy->flags = ntohl(mnl_attr_get_u32(tb[NFTA_SYNPROXY_FLAGS]));
+		e->flags |= (1 << NFTNL_EXPR_SYNPROXY_FLAGS);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_synproxy_snprintf(char *buf, size_t len,
+			     uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_synproxy *synproxy = nftnl_expr_data(e);
+	int ret, offset = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_SYNPROXY_MSS) &&
+	    e->flags & (1 << NFTNL_EXPR_SYNPROXY_WSCALE)) {
+		ret = snprintf(buf, len, "mss %u wscale %u ", synproxy->mss,
+			       synproxy->wscale);
+		SNPRINTF_BUFFER_SIZE(ret, len, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_synproxy = {
+	.name		= "synproxy",
+	.alloc_len	= sizeof(struct nftnl_expr_synproxy),
+	.max_attr	= NFTA_SYNPROXY_MAX,
+	.set		= nftnl_expr_synproxy_set,
+	.get		= nftnl_expr_synproxy_get,
+	.parse		= nftnl_expr_synproxy_parse,
+	.build		= nftnl_expr_synproxy_build,
+	.output		= nftnl_expr_synproxy_snprintf,
+};
diff --git a/src/expr/target.c b/src/expr/target.c
new file mode 100644
index 0000000..2a3fe8a
--- /dev/null
+++ b/src/expr/target.c
@@ -0,0 +1,193 @@
+/*
+ * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>	/* for memcpy */
+#include <arpa/inet.h>
+#include <errno.h>
+#include <libmnl/libmnl.h>
+
+#include <linux/netfilter/nf_tables.h>
+#include <linux/netfilter/nf_tables_compat.h>
+
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+/* From include/linux/netfilter/x_tables.h */
+#define XT_EXTENSION_MAXNAMELEN 29
+
+struct nftnl_expr_target {
+	char		name[XT_EXTENSION_MAXNAMELEN];
+	uint32_t	rev;
+	uint32_t	data_len;
+	const void	*data;
+};
+
+static int
+nftnl_expr_target_set(struct nftnl_expr *e, uint16_t type,
+			 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_target *tg = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_TG_NAME:
+		snprintf(tg->name, sizeof(tg->name), "%.*s", data_len,
+			 (const char *) data);
+		break;
+	case NFTNL_EXPR_TG_REV:
+		memcpy(&tg->rev, data, sizeof(tg->rev));
+		break;
+	case NFTNL_EXPR_TG_INFO:
+		if (e->flags & (1 << NFTNL_EXPR_TG_INFO))
+			xfree(tg->data);
+
+		tg->data = data;
+		tg->data_len = data_len;
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_target_get(const struct nftnl_expr *e, uint16_t type,
+			 uint32_t *data_len)
+{
+	struct nftnl_expr_target *tg = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_TG_NAME:
+		*data_len = sizeof(tg->name);
+		return tg->name;
+	case NFTNL_EXPR_TG_REV:
+		*data_len = sizeof(tg->rev);
+		return &tg->rev;
+	case NFTNL_EXPR_TG_INFO:
+		*data_len = tg->data_len;
+		return tg->data;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_target_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TARGET_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_TARGET_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TARGET_REV:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TARGET_INFO:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_target_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_target *tg = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_TG_NAME))
+		mnl_attr_put_strz(nlh, NFTA_TARGET_NAME, tg->name);
+	if (e->flags & (1 << NFTNL_EXPR_TG_REV))
+		mnl_attr_put_u32(nlh, NFTA_TARGET_REV, htonl(tg->rev));
+	if (e->flags & (1 << NFTNL_EXPR_TG_INFO))
+		mnl_attr_put(nlh, NFTA_TARGET_INFO, tg->data_len, tg->data);
+}
+
+static int nftnl_expr_target_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_target *target = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_TARGET_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_target_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TARGET_NAME]) {
+		snprintf(target->name, XT_EXTENSION_MAXNAMELEN, "%s",
+			 mnl_attr_get_str(tb[NFTA_TARGET_NAME]));
+
+		target->name[XT_EXTENSION_MAXNAMELEN-1] = '\0';
+		e->flags |= (1 << NFTNL_EXPR_TG_NAME);
+	}
+
+	if (tb[NFTA_TARGET_REV]) {
+		target->rev = ntohl(mnl_attr_get_u32(tb[NFTA_TARGET_REV]));
+		e->flags |= (1 << NFTNL_EXPR_TG_REV);
+	}
+
+	if (tb[NFTA_TARGET_INFO]) {
+		uint32_t len = mnl_attr_get_payload_len(tb[NFTA_TARGET_INFO]);
+		void *target_data;
+
+		if (target->data)
+			xfree(target->data);
+
+		target_data = calloc(1, len);
+		if (target_data == NULL)
+			return -1;
+
+		memcpy(target_data, mnl_attr_get_payload(tb[NFTA_TARGET_INFO]), len);
+
+		target->data = target_data;
+		target->data_len = len;
+
+		e->flags |= (1 << NFTNL_EXPR_TG_INFO);
+	}
+
+	return 0;
+}
+
+static int
+nftnl_expr_target_snprintf(char *buf, size_t len,
+			   uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_target *target = nftnl_expr_data(e);
+
+	return snprintf(buf, len, "name %s rev %u ", target->name, target->rev);
+}
+
+static void nftnl_expr_target_free(const struct nftnl_expr *e)
+{
+	struct nftnl_expr_target *target = nftnl_expr_data(e);
+
+	xfree(target->data);
+}
+
+struct expr_ops expr_ops_target = {
+	.name		= "target",
+	.alloc_len	= sizeof(struct nftnl_expr_target),
+	.max_attr	= NFTA_TARGET_MAX,
+	.free		= nftnl_expr_target_free,
+	.set		= nftnl_expr_target_set,
+	.get		= nftnl_expr_target_get,
+	.parse		= nftnl_expr_target_parse,
+	.build		= nftnl_expr_target_build,
+	.output		= nftnl_expr_target_snprintf,
+};
diff --git a/src/expr/tproxy.c b/src/expr/tproxy.c
new file mode 100644
index 0000000..bd5ffbf
--- /dev/null
+++ b/src/expr/tproxy.c
@@ -0,0 +1,174 @@
+/*
+ * Copyright (c) 2018 Máté Eckl <ecklm94@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include "internal.h"
+
+#include <stdio.h>
+#include <stdint.h>
+#include <limits.h>
+#include <string.h>
+#include <errno.h>
+#include <arpa/inet.h>
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nf_tables.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_tproxy {
+	enum nft_registers sreg_addr;
+	enum nft_registers sreg_port;
+	int                family;
+};
+
+static int
+nftnl_expr_tproxy_set(struct nftnl_expr *e, uint16_t type,
+		      const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_tproxy *tproxy = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_TPROXY_FAMILY:
+		memcpy(&tproxy->family, data, sizeof(tproxy->family));
+		break;
+	case NFTNL_EXPR_TPROXY_REG_ADDR:
+		memcpy(&tproxy->sreg_addr, data, sizeof(tproxy->sreg_addr));
+		break;
+	case NFTNL_EXPR_TPROXY_REG_PORT:
+		memcpy(&tproxy->sreg_port, data, sizeof(tproxy->sreg_port));
+		break;
+	default:
+		return -1;
+	}
+
+	return 0;
+}
+
+static const void *
+nftnl_expr_tproxy_get(const struct nftnl_expr *e, uint16_t type,
+		      uint32_t *data_len)
+{
+	struct nftnl_expr_tproxy *tproxy = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_TPROXY_FAMILY:
+		*data_len = sizeof(tproxy->family);
+		return &tproxy->family;
+	case NFTNL_EXPR_TPROXY_REG_ADDR:
+		*data_len = sizeof(tproxy->sreg_addr);
+		return &tproxy->sreg_addr;
+	case NFTNL_EXPR_TPROXY_REG_PORT:
+		*data_len = sizeof(tproxy->sreg_port);
+		return &tproxy->sreg_port;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_tproxy_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TPROXY_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_TPROXY_FAMILY:
+	case NFTA_TPROXY_REG_ADDR:
+	case NFTA_TPROXY_REG_PORT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_expr_tproxy_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_tproxy *tproxy = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_TPROXY_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_tproxy_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TPROXY_FAMILY]) {
+		tproxy->family = ntohl(mnl_attr_get_u32(tb[NFTA_TPROXY_FAMILY]));
+		e->flags |= (1 << NFTNL_EXPR_TPROXY_FAMILY);
+	}
+	if (tb[NFTA_TPROXY_REG_ADDR]) {
+		tproxy->sreg_addr =
+			ntohl(mnl_attr_get_u32(tb[NFTA_TPROXY_REG_ADDR]));
+		e->flags |= (1 << NFTNL_EXPR_TPROXY_REG_ADDR);
+	}
+	if (tb[NFTA_TPROXY_REG_PORT]) {
+		tproxy->sreg_port =
+			ntohl(mnl_attr_get_u32(tb[NFTA_TPROXY_REG_PORT]));
+		e->flags |= (1 << NFTNL_EXPR_TPROXY_REG_PORT);
+	}
+
+	return 0;
+}
+
+static void
+nftnl_expr_tproxy_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_tproxy *tproxy = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_TPROXY_FAMILY))
+		mnl_attr_put_u32(nlh, NFTA_TPROXY_FAMILY, htonl(tproxy->family));
+
+	if (e->flags & (1 << NFTNL_EXPR_TPROXY_REG_ADDR))
+		mnl_attr_put_u32(nlh, NFTA_TPROXY_REG_ADDR,
+				 htonl(tproxy->sreg_addr));
+
+	if (e->flags & (1 << NFTNL_EXPR_TPROXY_REG_PORT))
+		mnl_attr_put_u32(nlh, NFTA_TPROXY_REG_PORT,
+				 htonl(tproxy->sreg_port));
+}
+
+static int
+nftnl_expr_tproxy_snprintf(char *buf, size_t remain,
+			uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_tproxy *tproxy = nftnl_expr_data(e);
+	int offset = 0, ret = 0;
+
+	if (tproxy->family != NFTA_TPROXY_UNSPEC) {
+		ret = snprintf(buf + offset, remain, "%s ",
+			       nftnl_family2str(tproxy->family));
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_TPROXY_REG_ADDR)) {
+		ret = snprintf(buf + offset, remain,
+			       "addr reg %u ", tproxy->sreg_addr);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (e->flags & (1 << NFTNL_EXPR_TPROXY_REG_PORT)) {
+		ret = snprintf(buf + offset, remain,
+			       "port reg %u ", tproxy->sreg_port);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+struct expr_ops expr_ops_tproxy = {
+	.name		= "tproxy",
+	.alloc_len	= sizeof(struct nftnl_expr_tproxy),
+	.max_attr	= NFTA_TPROXY_MAX,
+	.set		= nftnl_expr_tproxy_set,
+	.get		= nftnl_expr_tproxy_get,
+	.parse		= nftnl_expr_tproxy_parse,
+	.build		= nftnl_expr_tproxy_build,
+	.output		= nftnl_expr_tproxy_snprintf,
+};
diff --git a/src/expr/tunnel.c b/src/expr/tunnel.c
new file mode 100644
index 0000000..a00f620
--- /dev/null
+++ b/src/expr/tunnel.c
@@ -0,0 +1,149 @@
+/*
+ * (C) 2018 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <string.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_tunnel {
+	enum nft_tunnel_keys	key;
+	enum nft_registers	dreg;
+};
+
+static int nftnl_expr_tunnel_set(struct nftnl_expr *e, uint16_t type,
+				 const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_tunnel *tunnel = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_TUNNEL_KEY:
+		memcpy(&tunnel->key, data, sizeof(tunnel->key));
+		break;
+	case NFTNL_EXPR_TUNNEL_DREG:
+		memcpy(&tunnel->dreg, data, sizeof(tunnel->dreg));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_tunnel_get(const struct nftnl_expr *e, uint16_t type,
+		       uint32_t *data_len)
+{
+	struct nftnl_expr_tunnel *tunnel = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_TUNNEL_KEY:
+		*data_len = sizeof(tunnel->key);
+		return &tunnel->key;
+	case NFTNL_EXPR_TUNNEL_DREG:
+		*data_len = sizeof(tunnel->dreg);
+		return &tunnel->dreg;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_tunnel_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_TUNNEL_KEY:
+	case NFTA_TUNNEL_DREG:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_tunnel_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_tunnel *tunnel = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_TUNNEL_KEY))
+		mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY, htonl(tunnel->key));
+	if (e->flags & (1 << NFTNL_EXPR_TUNNEL_DREG))
+		mnl_attr_put_u32(nlh, NFTA_TUNNEL_DREG, htonl(tunnel->dreg));
+}
+
+static int
+nftnl_expr_tunnel_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_tunnel *tunnel = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_TUNNEL_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_tunnel_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY]) {
+		tunnel->key = ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_TUNNEL_KEY);
+	}
+	if (tb[NFTA_TUNNEL_DREG]) {
+		tunnel->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_TUNNEL_DREG);
+	}
+
+	return 0;
+}
+
+static const char *tunnel_key2str_array[NFT_TUNNEL_MAX + 1] = {
+	[NFT_TUNNEL_PATH]	= "path",
+	[NFT_TUNNEL_ID]		= "id",
+};
+
+static const char *tunnel_key2str(uint8_t key)
+{
+	if (key <= NFT_TUNNEL_MAX)
+		return tunnel_key2str_array[key];
+
+	return "unknown";
+}
+
+static int
+nftnl_expr_tunnel_snprintf(char *buf, size_t len,
+			 uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_tunnel *tunnel = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_TUNNEL_DREG)) {
+		return snprintf(buf, len, "load %s => reg %u ",
+				tunnel_key2str(tunnel->key), tunnel->dreg);
+	}
+	return 0;
+}
+
+struct expr_ops expr_ops_tunnel = {
+	.name		= "tunnel",
+	.alloc_len	= sizeof(struct nftnl_expr_tunnel),
+	.max_attr	= NFTA_TUNNEL_MAX,
+	.set		= nftnl_expr_tunnel_set,
+	.get		= nftnl_expr_tunnel_get,
+	.parse		= nftnl_expr_tunnel_parse,
+	.build		= nftnl_expr_tunnel_build,
+	.output		= nftnl_expr_tunnel_snprintf,
+};
diff --git a/src/expr/xfrm.c b/src/expr/xfrm.c
new file mode 100644
index 0000000..2db00d5
--- /dev/null
+++ b/src/expr/xfrm.c
@@ -0,0 +1,200 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <linux/netfilter/nf_tables.h>
+#include <linux/xfrm.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/expr.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_expr_xfrm {
+	enum nft_registers	dreg;
+	enum nft_xfrm_keys	key;
+	uint32_t		spnum;
+	uint8_t			dir;
+};
+
+static int
+nftnl_expr_xfrm_set(struct nftnl_expr *e, uint16_t type,
+		    const void *data, uint32_t data_len)
+{
+	struct nftnl_expr_xfrm *x = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_XFRM_KEY:
+		memcpy(&x->key, data, sizeof(x->key));
+		break;
+	case NFTNL_EXPR_XFRM_DIR:
+		memcpy(&x->dir, data, sizeof(x->dir));
+		break;
+	case NFTNL_EXPR_XFRM_SPNUM:
+		memcpy(&x->spnum, data, sizeof(x->spnum));
+		break;
+	case NFTNL_EXPR_XFRM_DREG:
+		memcpy(&x->dreg, data, sizeof(x->dreg));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_expr_xfrm_get(const struct nftnl_expr *e, uint16_t type,
+		    uint32_t *data_len)
+{
+	struct nftnl_expr_xfrm *x = nftnl_expr_data(e);
+
+	switch(type) {
+	case NFTNL_EXPR_XFRM_KEY:
+		*data_len = sizeof(x->key);
+		return &x->key;
+	case NFTNL_EXPR_XFRM_DIR:
+		*data_len = sizeof(x->dir);
+		return &x->dir;
+	case NFTNL_EXPR_XFRM_SPNUM:
+		*data_len = sizeof(x->spnum);
+		return &x->spnum;
+	case NFTNL_EXPR_XFRM_DREG:
+		*data_len = sizeof(x->dreg);
+		return &x->dreg;
+	}
+	return NULL;
+}
+
+static int nftnl_expr_xfrm_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_XFRM_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_XFRM_DREG:
+	case NFTA_XFRM_KEY:
+	case NFTA_XFRM_SPNUM:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_XFRM_DIR:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_expr_xfrm_build(struct nlmsghdr *nlh, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_xfrm *x = nftnl_expr_data(e);
+
+	if (e->flags & (1 << NFTNL_EXPR_XFRM_KEY))
+		mnl_attr_put_u32(nlh, NFTA_XFRM_KEY, htonl(x->key));
+	if (e->flags & (1 << NFTNL_EXPR_XFRM_DIR))
+		mnl_attr_put_u8(nlh, NFTA_XFRM_DIR, x->dir);
+	if (e->flags & (1 << NFTNL_EXPR_XFRM_SPNUM))
+		mnl_attr_put_u32(nlh, NFTA_XFRM_SPNUM, htonl(x->spnum));
+	if (e->flags & (1 << NFTNL_EXPR_XFRM_DREG))
+		mnl_attr_put_u32(nlh, NFTA_XFRM_DREG, htonl(x->dreg));
+}
+
+static int
+nftnl_expr_xfrm_parse(struct nftnl_expr *e, struct nlattr *attr)
+{
+	struct nftnl_expr_xfrm *x = nftnl_expr_data(e);
+	struct nlattr *tb[NFTA_XFRM_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_expr_xfrm_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_XFRM_KEY]) {
+		x->key = ntohl(mnl_attr_get_u32(tb[NFTA_XFRM_KEY]));
+		e->flags |= (1 << NFTNL_EXPR_XFRM_KEY);
+	}
+	if (tb[NFTA_XFRM_DIR]) {
+		x->dir = mnl_attr_get_u8(tb[NFTA_XFRM_DIR]);
+		e->flags |= (1 << NFTNL_EXPR_XFRM_DIR);
+	}
+	if (tb[NFTA_XFRM_SPNUM]) {
+		x->spnum = ntohl(mnl_attr_get_u32(tb[NFTA_XFRM_SPNUM]));
+		e->flags |= (1 << NFTNL_EXPR_XFRM_SPNUM);
+	}
+	if (tb[NFTA_XFRM_DREG]) {
+		x->dreg = ntohl(mnl_attr_get_u32(tb[NFTA_XFRM_DREG]));
+		e->flags |= (1 << NFTNL_EXPR_XFRM_DREG);
+	}
+	return 0;
+}
+
+static const char *xfrmkey2str_array[] = {
+	[NFT_XFRM_KEY_DADDR_IP4]	= "daddr4",
+	[NFT_XFRM_KEY_SADDR_IP4]	= "saddr4",
+	[NFT_XFRM_KEY_DADDR_IP6]	= "daddr6",
+	[NFT_XFRM_KEY_SADDR_IP6]	= "saddr6",
+	[NFT_XFRM_KEY_REQID]		= "reqid",
+	[NFT_XFRM_KEY_SPI]		= "spi",
+};
+
+static const char *xfrmkey2str(uint32_t key)
+{
+	if (key >= sizeof(xfrmkey2str_array) / sizeof(xfrmkey2str_array[0]))
+		return "unknown";
+
+	return xfrmkey2str_array[key];
+}
+
+static const char *xfrmdir2str_array[] = {
+	[XFRM_POLICY_IN]	= "in",
+	[XFRM_POLICY_OUT]	= "out",
+};
+
+static const char *xfrmdir2str(uint8_t dir)
+{
+	if (dir >= sizeof(xfrmdir2str_array) / sizeof(xfrmdir2str_array[0]))
+		return "unknown";
+
+	return xfrmdir2str_array[dir];
+}
+
+static int
+nftnl_expr_xfrm_snprintf(char *buf, size_t remain,
+			 uint32_t flags, const struct nftnl_expr *e)
+{
+	struct nftnl_expr_xfrm *x = nftnl_expr_data(e);
+	int ret, offset = 0;
+
+	if (e->flags & (1 << NFTNL_EXPR_XFRM_DREG)) {
+		ret = snprintf(buf, remain, "load %s %u %s => reg %u ",
+				xfrmdir2str(x->dir),
+				x->spnum,
+			        xfrmkey2str(x->key), x->dreg);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	return offset;
+}
+
+struct expr_ops expr_ops_xfrm = {
+	.name		= "xfrm",
+	.alloc_len	= sizeof(struct nftnl_expr_xfrm),
+	.max_attr	= NFTA_XFRM_MAX,
+	.set		= nftnl_expr_xfrm_set,
+	.get		= nftnl_expr_xfrm_get,
+	.parse		= nftnl_expr_xfrm_parse,
+	.build		= nftnl_expr_xfrm_build,
+	.output		= nftnl_expr_xfrm_snprintf,
+};
diff --git a/src/expr_ops.c b/src/expr_ops.c
new file mode 100644
index 0000000..b85f472
--- /dev/null
+++ b/src/expr_ops.c
@@ -0,0 +1,106 @@
+#include <string.h>
+#include <linux_list.h>
+
+#include "expr_ops.h"
+
+/* Unfortunately, __attribute__((constructor)) breaks library static linking */
+extern struct expr_ops expr_ops_bitwise;
+extern struct expr_ops expr_ops_byteorder;
+extern struct expr_ops expr_ops_cmp;
+extern struct expr_ops expr_ops_connlimit;
+extern struct expr_ops expr_ops_counter;
+extern struct expr_ops expr_ops_ct;
+extern struct expr_ops expr_ops_dup;
+extern struct expr_ops expr_ops_exthdr;
+extern struct expr_ops expr_ops_fwd;
+extern struct expr_ops expr_ops_immediate;
+extern struct expr_ops expr_ops_inner;
+extern struct expr_ops expr_ops_last;
+extern struct expr_ops expr_ops_limit;
+extern struct expr_ops expr_ops_log;
+extern struct expr_ops expr_ops_lookup;
+extern struct expr_ops expr_ops_masq;
+extern struct expr_ops expr_ops_match;
+extern struct expr_ops expr_ops_meta;
+extern struct expr_ops expr_ops_ng;
+extern struct expr_ops expr_ops_nat;
+extern struct expr_ops expr_ops_tproxy;
+extern struct expr_ops expr_ops_objref;
+extern struct expr_ops expr_ops_payload;
+extern struct expr_ops expr_ops_range;
+extern struct expr_ops expr_ops_redir;
+extern struct expr_ops expr_ops_reject;
+extern struct expr_ops expr_ops_rt;
+extern struct expr_ops expr_ops_queue;
+extern struct expr_ops expr_ops_quota;
+extern struct expr_ops expr_ops_target;
+extern struct expr_ops expr_ops_dynset;
+extern struct expr_ops expr_ops_hash;
+extern struct expr_ops expr_ops_fib;
+extern struct expr_ops expr_ops_flow;
+extern struct expr_ops expr_ops_socket;
+extern struct expr_ops expr_ops_synproxy;
+extern struct expr_ops expr_ops_tunnel;
+extern struct expr_ops expr_ops_osf;
+extern struct expr_ops expr_ops_xfrm;
+
+static struct expr_ops expr_ops_notrack = {
+	.name	= "notrack",
+};
+
+static struct expr_ops *expr_ops[] = {
+	&expr_ops_bitwise,
+	&expr_ops_byteorder,
+	&expr_ops_cmp,
+	&expr_ops_connlimit,
+	&expr_ops_counter,
+	&expr_ops_ct,
+	&expr_ops_dup,
+	&expr_ops_exthdr,
+	&expr_ops_fwd,
+	&expr_ops_immediate,
+	&expr_ops_inner,
+	&expr_ops_last,
+	&expr_ops_limit,
+	&expr_ops_log,
+	&expr_ops_lookup,
+	&expr_ops_masq,
+	&expr_ops_match,
+	&expr_ops_meta,
+	&expr_ops_ng,
+	&expr_ops_nat,
+	&expr_ops_tproxy,
+	&expr_ops_notrack,
+	&expr_ops_payload,
+	&expr_ops_range,
+	&expr_ops_redir,
+	&expr_ops_reject,
+	&expr_ops_rt,
+	&expr_ops_queue,
+	&expr_ops_quota,
+	&expr_ops_target,
+	&expr_ops_dynset,
+	&expr_ops_hash,
+	&expr_ops_fib,
+	&expr_ops_objref,
+	&expr_ops_flow,
+	&expr_ops_socket,
+	&expr_ops_synproxy,
+	&expr_ops_tunnel,
+	&expr_ops_osf,
+	&expr_ops_xfrm,
+	NULL,
+};
+
+struct expr_ops *nftnl_expr_ops_lookup(const char *name)
+{
+	int i = 0;
+
+	while (expr_ops[i] != NULL) {
+		if (strcmp(expr_ops[i]->name, name) == 0)
+			return expr_ops[i];
+
+		i++;
+	}
+	return NULL;
+}
diff --git a/src/flowtable.c b/src/flowtable.c
new file mode 100644
index 0000000..e6c2475
--- /dev/null
+++ b/src/flowtable.c
@@ -0,0 +1,735 @@
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_arp.h>
+
+#include <libnftnl/flowtable.h>
+
+struct nftnl_flowtable {
+	struct list_head	head;
+	const char		*name;
+	const char		*table;
+	int			family;
+	uint32_t		hooknum;
+	int32_t			prio;
+	uint32_t		size;
+	const char		**dev_array;
+	uint32_t		dev_array_len;
+	uint32_t		ft_flags;
+	uint32_t		use;
+	uint32_t		flags;
+	uint64_t		handle;
+};
+
+EXPORT_SYMBOL(nftnl_flowtable_alloc);
+struct nftnl_flowtable *nftnl_flowtable_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_flowtable));
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_free);
+void nftnl_flowtable_free(const struct nftnl_flowtable *c)
+{
+	int i;
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
+		xfree(c->name);
+	if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
+		xfree(c->table);
+	if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
+		for (i = 0; i < c->dev_array_len; i++)
+			xfree(c->dev_array[i]);
+
+		xfree(c->dev_array);
+	}
+	xfree(c);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_is_set);
+bool nftnl_flowtable_is_set(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	return c->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_unset);
+void nftnl_flowtable_unset(struct nftnl_flowtable *c, uint16_t attr)
+{
+	int i;
+
+	if (!(c->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_FLOWTABLE_NAME:
+		xfree(c->name);
+		break;
+	case NFTNL_FLOWTABLE_TABLE:
+		xfree(c->table);
+		break;
+	case NFTNL_FLOWTABLE_HOOKNUM:
+	case NFTNL_FLOWTABLE_PRIO:
+	case NFTNL_FLOWTABLE_USE:
+	case NFTNL_FLOWTABLE_FAMILY:
+	case NFTNL_FLOWTABLE_FLAGS:
+	case NFTNL_FLOWTABLE_HANDLE:
+		break;
+	case NFTNL_FLOWTABLE_DEVICES:
+		for (i = 0; i < c->dev_array_len; i++)
+			xfree(c->dev_array[i]);
+		xfree(c->dev_array);
+		break;
+	default:
+		return;
+	}
+
+	c->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_flowtable_validate[NFTNL_FLOWTABLE_MAX + 1] = {
+	[NFTNL_FLOWTABLE_HOOKNUM]	= sizeof(uint32_t),
+	[NFTNL_FLOWTABLE_PRIO]		= sizeof(int32_t),
+	[NFTNL_FLOWTABLE_FAMILY]	= sizeof(uint32_t),
+	[NFTNL_FLOWTABLE_FLAGS]		= sizeof(uint32_t),
+	[NFTNL_FLOWTABLE_HANDLE]	= sizeof(uint64_t),
+};
+
+EXPORT_SYMBOL(nftnl_flowtable_set_data);
+int nftnl_flowtable_set_data(struct nftnl_flowtable *c, uint16_t attr,
+			     const void *data, uint32_t data_len)
+{
+	const char **dev_array;
+	int len = 0, i;
+
+	nftnl_assert_attr_exists(attr, NFTNL_FLOWTABLE_MAX);
+	nftnl_assert_validate(data, nftnl_flowtable_validate, attr, data_len);
+
+	switch(attr) {
+	case NFTNL_FLOWTABLE_NAME:
+		if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
+			xfree(c->name);
+
+		c->name = strdup(data);
+		if (!c->name)
+			return -1;
+		break;
+	case NFTNL_FLOWTABLE_TABLE:
+		if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
+			xfree(c->table);
+
+		c->table = strdup(data);
+		if (!c->table)
+			return -1;
+		break;
+	case NFTNL_FLOWTABLE_HOOKNUM:
+		memcpy(&c->hooknum, data, sizeof(c->hooknum));
+		break;
+	case NFTNL_FLOWTABLE_PRIO:
+		memcpy(&c->prio, data, sizeof(c->prio));
+		break;
+	case NFTNL_FLOWTABLE_FAMILY:
+		memcpy(&c->family, data, sizeof(c->family));
+		break;
+	case NFTNL_FLOWTABLE_DEVICES:
+		dev_array = (const char **)data;
+		while (dev_array[len] != NULL)
+			len++;
+
+		if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
+			for (i = 0; i < c->dev_array_len; i++)
+				xfree(c->dev_array[i]);
+			xfree(c->dev_array);
+		}
+
+		c->dev_array = calloc(len + 1, sizeof(char *));
+		if (!c->dev_array)
+			return -1;
+
+		for (i = 0; i < len; i++)
+			c->dev_array[i] = strdup(dev_array[i]);
+
+		c->dev_array_len = len;
+		break;
+	case NFTNL_FLOWTABLE_SIZE:
+		memcpy(&c->size, data, sizeof(c->size));
+		break;
+	case NFTNL_FLOWTABLE_FLAGS:
+		memcpy(&c->ft_flags, data, sizeof(c->ft_flags));
+		break;
+	case NFTNL_FLOWTABLE_HANDLE:
+		memcpy(&c->handle, data, sizeof(c->handle));
+		break;
+	}
+	c->flags |= (1 << attr);
+	return 0;
+}
+
+void nftnl_flowtable_set(struct nftnl_flowtable *c, uint16_t attr, const void *data) __visible;
+void nftnl_flowtable_set(struct nftnl_flowtable *c, uint16_t attr, const void *data)
+{
+	nftnl_flowtable_set_data(c, attr, data, nftnl_flowtable_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_set_u32);
+void nftnl_flowtable_set_u32(struct nftnl_flowtable *c, uint16_t attr, uint32_t data)
+{
+	nftnl_flowtable_set_data(c, attr, &data, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_set_s32);
+void nftnl_flowtable_set_s32(struct nftnl_flowtable *c, uint16_t attr, int32_t data)
+{
+	nftnl_flowtable_set_data(c, attr, &data, sizeof(int32_t));
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_set_str);
+int nftnl_flowtable_set_str(struct nftnl_flowtable *c, uint16_t attr, const char *str)
+{
+	return nftnl_flowtable_set_data(c, attr, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_set_u64);
+void nftnl_flowtable_set_u64(struct nftnl_flowtable *c, uint16_t attr, uint64_t data)
+{
+	nftnl_flowtable_set_data(c, attr, &data, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_set_array);
+int nftnl_flowtable_set_array(struct nftnl_flowtable *c, uint16_t attr,
+			      const char **data)
+{
+	return nftnl_flowtable_set_data(c, attr, data, 0);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get_data);
+const void *nftnl_flowtable_get_data(const struct nftnl_flowtable *c,
+				     uint16_t attr, uint32_t *data_len)
+{
+	if (!(c->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_FLOWTABLE_NAME:
+		*data_len = strlen(c->name) + 1;
+		return c->name;
+	case NFTNL_FLOWTABLE_TABLE:
+		*data_len = strlen(c->table) + 1;
+		return c->table;
+	case NFTNL_FLOWTABLE_HOOKNUM:
+		*data_len = sizeof(uint32_t);
+		return &c->hooknum;
+	case NFTNL_FLOWTABLE_PRIO:
+		*data_len = sizeof(int32_t);
+		return &c->prio;
+	case NFTNL_FLOWTABLE_FAMILY:
+		*data_len = sizeof(int32_t);
+		return &c->family;
+	case NFTNL_FLOWTABLE_DEVICES:
+		*data_len = 0;
+		return &c->dev_array[0];
+	case NFTNL_FLOWTABLE_SIZE:
+		*data_len = sizeof(int32_t);
+		return &c->size;
+	case NFTNL_FLOWTABLE_FLAGS:
+		*data_len = sizeof(int32_t);
+		return &c->ft_flags;
+	case NFTNL_FLOWTABLE_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &c->handle;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get);
+const void *nftnl_flowtable_get(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_flowtable_get_data(c, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get_str);
+const char *nftnl_flowtable_get_str(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	return nftnl_flowtable_get(c, attr);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get_u32);
+uint32_t nftnl_flowtable_get_u32(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	uint32_t data_len = 0;
+	const uint32_t *val = nftnl_flowtable_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint32_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get_u64);
+uint64_t nftnl_flowtable_get_u64(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	uint32_t data_len = 0;
+	const uint64_t *val = nftnl_flowtable_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint64_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get_s32);
+int32_t nftnl_flowtable_get_s32(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	uint32_t data_len = 0;
+	const int32_t *val = nftnl_flowtable_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(int32_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_get_array);
+const char *const *nftnl_flowtable_get_array(const struct nftnl_flowtable *c, uint16_t attr)
+{
+	uint32_t data_len;
+	const char * const *val = nftnl_flowtable_get_data(c, attr, &data_len);
+
+	nftnl_assert(val, attr, attr == NFTNL_FLOWTABLE_DEVICES);
+
+	return val;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_nlmsg_build_payload);
+void nftnl_flowtable_nlmsg_build_payload(struct nlmsghdr *nlh,
+					 const struct nftnl_flowtable *c)
+{
+	struct nlattr *nest = NULL;
+	int i;
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_FLOWTABLE_TABLE, c->table);
+	if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
+		mnl_attr_put_strz(nlh, NFTA_FLOWTABLE_NAME, c->name);
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM) ||
+	    c->flags & (1 << NFTNL_FLOWTABLE_PRIO) ||
+	    c->flags & (1 << NFTNL_FLOWTABLE_DEVICES))
+		nest = mnl_attr_nest_start(nlh, NFTA_FLOWTABLE_HOOK);
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM))
+		mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_HOOK_NUM, htonl(c->hooknum));
+	if (c->flags & (1 << NFTNL_FLOWTABLE_PRIO))
+		mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_HOOK_PRIORITY, htonl(c->prio));
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
+		struct nlattr *nest_dev;
+
+		nest_dev = mnl_attr_nest_start(nlh, NFTA_FLOWTABLE_HOOK_DEVS);
+		for (i = 0; i < c->dev_array_len; i++) {
+			mnl_attr_put_strz(nlh, NFTA_DEVICE_NAME,
+					  c->dev_array[i]);
+		}
+		mnl_attr_nest_end(nlh, nest_dev);
+	}
+
+	if (nest)
+		mnl_attr_nest_end(nlh, nest);
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_FLAGS, htonl(c->ft_flags));
+	if (c->flags & (1 << NFTNL_FLOWTABLE_USE))
+		mnl_attr_put_u32(nlh, NFTA_FLOWTABLE_USE, htonl(c->use));
+	if (c->flags & (1 << NFTNL_FLOWTABLE_HANDLE))
+		mnl_attr_put_u64(nlh, NFTA_FLOWTABLE_HANDLE, htobe64(c->handle));
+}
+
+static int nftnl_flowtable_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_FLOWTABLE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_FLOWTABLE_NAME:
+	case NFTA_FLOWTABLE_TABLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_FLOWTABLE_HOOK:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_FLOWTABLE_FLAGS:
+	case NFTA_FLOWTABLE_USE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_FLOWTABLE_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_flowtable_parse_hook_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_FLOWTABLE_HOOK_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_FLOWTABLE_HOOK_NUM:
+	case NFTA_FLOWTABLE_HOOK_PRIORITY:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_FLOWTABLE_HOOK_DEVS:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_flowtable_parse_devs(struct nlattr *nest,
+				      struct nftnl_flowtable *c)
+{
+	const char **dev_array, **tmp;
+	int len = 0, size = 8;
+	struct nlattr *attr;
+
+	dev_array = calloc(8, sizeof(char *));
+	if (!dev_array)
+		return -1;
+
+	mnl_attr_for_each_nested(attr, nest) {
+		if (mnl_attr_get_type(attr) != NFTA_DEVICE_NAME)
+			goto err;
+		dev_array[len++] = strdup(mnl_attr_get_str(attr));
+		if (len >= size) {
+			tmp = realloc(dev_array, size * 2 * sizeof(char *));
+			if (!tmp)
+				goto err;
+
+			size *= 2;
+			memset(&tmp[len], 0, (size - len) * sizeof(char *));
+			dev_array = tmp;
+		}
+	}
+
+	c->dev_array = dev_array;
+	c->dev_array_len = len;
+
+	return 0;
+err:
+	while (len--)
+		xfree(dev_array[len]);
+	xfree(dev_array);
+	return -1;
+}
+
+static int nftnl_flowtable_parse_hook(struct nlattr *attr, struct nftnl_flowtable *c)
+{
+	struct nlattr *tb[NFTA_FLOWTABLE_HOOK_MAX + 1] = {};
+	int ret;
+
+	if (mnl_attr_parse_nested(attr, nftnl_flowtable_parse_hook_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_FLOWTABLE_HOOK_NUM]) {
+		c->hooknum = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_HOOK_NUM]));
+		c->flags |= (1 << NFTNL_FLOWTABLE_HOOKNUM);
+	}
+	if (tb[NFTA_FLOWTABLE_HOOK_PRIORITY]) {
+		c->prio = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_HOOK_PRIORITY]));
+		c->flags |= (1 << NFTNL_FLOWTABLE_PRIO);
+	}
+	if (tb[NFTA_FLOWTABLE_HOOK_DEVS]) {
+		ret = nftnl_flowtable_parse_devs(tb[NFTA_FLOWTABLE_HOOK_DEVS], c);
+		if (ret < 0)
+			return -1;
+		c->flags |= (1 << NFTNL_FLOWTABLE_DEVICES);
+	}
+
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_nlmsg_parse);
+int nftnl_flowtable_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_flowtable *c)
+{
+	struct nlattr *tb[NFTA_FLOWTABLE_MAX + 1] = {};
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	int ret = 0;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_flowtable_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_FLOWTABLE_NAME]) {
+		if (c->flags & (1 << NFTNL_FLOWTABLE_NAME))
+			xfree(c->name);
+		c->name = strdup(mnl_attr_get_str(tb[NFTA_FLOWTABLE_NAME]));
+		if (!c->name)
+			return -1;
+		c->flags |= (1 << NFTNL_FLOWTABLE_NAME);
+	}
+	if (tb[NFTA_FLOWTABLE_TABLE]) {
+		if (c->flags & (1 << NFTNL_FLOWTABLE_TABLE))
+			xfree(c->table);
+		c->table = strdup(mnl_attr_get_str(tb[NFTA_FLOWTABLE_TABLE]));
+		if (!c->table)
+			return -1;
+		c->flags |= (1 << NFTNL_FLOWTABLE_TABLE);
+	}
+	if (tb[NFTA_FLOWTABLE_HOOK]) {
+		ret = nftnl_flowtable_parse_hook(tb[NFTA_FLOWTABLE_HOOK], c);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_FLOWTABLE_FLAGS]) {
+		c->ft_flags = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_FLAGS]));
+		c->flags |= (1 << NFTNL_FLOWTABLE_FLAGS);
+	}
+	if (tb[NFTA_FLOWTABLE_USE]) {
+		c->use = ntohl(mnl_attr_get_u32(tb[NFTA_FLOWTABLE_USE]));
+		c->flags |= (1 << NFTNL_FLOWTABLE_USE);
+	}
+	if (tb[NFTA_FLOWTABLE_HANDLE]) {
+		c->handle = be64toh(mnl_attr_get_u64(tb[NFTA_FLOWTABLE_HANDLE]));
+		c->flags |= (1 << NFTNL_FLOWTABLE_HANDLE);
+	}
+
+	c->family = nfg->nfgen_family;
+	c->flags |= (1 << NFTNL_FLOWTABLE_FAMILY);
+
+	return ret;
+}
+
+static const char *nftnl_hooknum2str(int family, int hooknum)
+{
+	switch (family) {
+	case NFPROTO_IPV4:
+	case NFPROTO_IPV6:
+	case NFPROTO_INET:
+	case NFPROTO_BRIDGE:
+		switch (hooknum) {
+		case NF_INET_PRE_ROUTING:
+			return "prerouting";
+		case NF_INET_LOCAL_IN:
+			return "input";
+		case NF_INET_FORWARD:
+			return "forward";
+		case NF_INET_LOCAL_OUT:
+			return "output";
+		case NF_INET_POST_ROUTING:
+			return "postrouting";
+		}
+		break;
+	case NFPROTO_ARP:
+		switch (hooknum) {
+		case NF_ARP_IN:
+			return "input";
+		case NF_ARP_OUT:
+			return "output";
+		case NF_ARP_FORWARD:
+			return "forward";
+		}
+		break;
+	case NFPROTO_NETDEV:
+		switch (hooknum) {
+		case NF_NETDEV_INGRESS:
+			return "ingress";
+		}
+		break;
+	}
+	return "unknown";
+}
+
+static inline int nftnl_str2hooknum(int family, const char *hook)
+{
+	int hooknum;
+
+	for (hooknum = 0; hooknum < NF_INET_NUMHOOKS; hooknum++) {
+		if (strcmp(hook, nftnl_hooknum2str(family, hooknum)) == 0)
+			return hooknum;
+	}
+	return -1;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_parse);
+int nftnl_flowtable_parse(struct nftnl_flowtable *c, enum nftnl_parse_type type,
+			  const char *data, struct nftnl_parse_err *err)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_parse_file);
+int nftnl_flowtable_parse_file(struct nftnl_flowtable *c,
+			       enum nftnl_parse_type type,
+			       FILE *fp, struct nftnl_parse_err *err)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+static int nftnl_flowtable_snprintf_default(char *buf, size_t remain,
+					    const struct nftnl_flowtable *c)
+{
+	int ret, offset = 0, i;
+
+	ret = snprintf(buf, remain, "flow table %s %s use %u size %u flags %x",
+		       c->table, c->name, c->use, c->size, c->ft_flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (c->flags & (1 << NFTNL_FLOWTABLE_HOOKNUM)) {
+		ret = snprintf(buf + offset, remain, " hook %s prio %d ",
+			       nftnl_hooknum2str(c->family, c->hooknum),
+			       c->prio);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (c->flags & (1 << NFTNL_FLOWTABLE_DEVICES)) {
+			ret = snprintf(buf + offset, remain, " dev { ");
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+			for (i = 0; i < c->dev_array_len; i++) {
+				ret = snprintf(buf + offset, remain, " %s ",
+					       c->dev_array[i]);
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+			ret = snprintf(buf + offset, remain, " } ");
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+	}
+
+	return offset;
+}
+
+static int nftnl_flowtable_cmd_snprintf(char *buf, size_t remain,
+					const struct nftnl_flowtable *c,
+					uint32_t cmd, uint32_t type,
+					uint32_t flags)
+{
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = nftnl_flowtable_snprintf_default(buf + offset, remain, c);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_snprintf);
+int nftnl_flowtable_snprintf(char *buf, size_t size, const struct nftnl_flowtable *c,
+			 uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_flowtable_cmd_snprintf(buf, size, c, nftnl_flag2cmd(flags),
+					    type, flags);
+}
+
+static int nftnl_flowtable_do_snprintf(char *buf, size_t size, const void *c,
+				   uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_flowtable_snprintf(buf, size, c, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_fprintf);
+int nftnl_flowtable_fprintf(FILE *fp, const struct nftnl_flowtable *c,
+			    uint32_t type, uint32_t flags)
+{
+	return nftnl_fprintf(fp, c, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_flowtable_do_snprintf);
+}
+
+struct nftnl_flowtable_list {
+	struct list_head list;
+};
+
+EXPORT_SYMBOL(nftnl_flowtable_list_alloc);
+struct nftnl_flowtable_list *nftnl_flowtable_list_alloc(void)
+{
+	struct nftnl_flowtable_list *list;
+
+	list = calloc(1, sizeof(struct nftnl_flowtable_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+
+	return list;
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_list_free);
+void nftnl_flowtable_list_free(struct nftnl_flowtable_list *list)
+{
+	struct nftnl_flowtable *s, *tmp;
+
+	list_for_each_entry_safe(s, tmp, &list->list, head) {
+		list_del(&s->head);
+		nftnl_flowtable_free(s);
+	}
+	xfree(list);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_list_is_empty);
+int nftnl_flowtable_list_is_empty(const struct nftnl_flowtable_list *list)
+{
+	return list_empty(&list->list);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_list_add);
+void nftnl_flowtable_list_add(struct nftnl_flowtable *s,
+			      struct nftnl_flowtable_list *list)
+{
+	list_add(&s->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_list_add_tail);
+void nftnl_flowtable_list_add_tail(struct nftnl_flowtable *s,
+				   struct nftnl_flowtable_list *list)
+{
+	list_add_tail(&s->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_list_del);
+void nftnl_flowtable_list_del(struct nftnl_flowtable *s)
+{
+	list_del(&s->head);
+}
+
+EXPORT_SYMBOL(nftnl_flowtable_list_foreach);
+int nftnl_flowtable_list_foreach(struct nftnl_flowtable_list *flowtable_list,
+				 int (*cb)(struct nftnl_flowtable *t, void *data), void *data)
+{
+	struct nftnl_flowtable *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &flowtable_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
diff --git a/src/gen.c b/src/gen.c
new file mode 100644
index 0000000..88efbaa
--- /dev/null
+++ b/src/gen.c
@@ -0,0 +1,196 @@
+/*
+ * (C) 2012-2014 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/gen.h>
+
+struct nftnl_gen {
+	uint32_t id;
+
+	uint32_t flags;
+};
+
+EXPORT_SYMBOL(nftnl_gen_alloc);
+struct nftnl_gen *nftnl_gen_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_gen));
+}
+
+EXPORT_SYMBOL(nftnl_gen_free);
+void nftnl_gen_free(const struct nftnl_gen *gen)
+{
+	xfree(gen);
+}
+
+EXPORT_SYMBOL(nftnl_gen_is_set);
+bool nftnl_gen_is_set(const struct nftnl_gen *gen, uint16_t attr)
+{
+	return gen->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_gen_unset);
+void nftnl_gen_unset(struct nftnl_gen *gen, uint16_t attr)
+{
+	if (!(gen->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_GEN_ID:
+		break;
+	}
+	gen->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_gen_validate[NFTNL_GEN_MAX + 1] = {
+	[NFTNL_GEN_ID]	= sizeof(uint32_t),
+};
+
+EXPORT_SYMBOL(nftnl_gen_set_data);
+int nftnl_gen_set_data(struct nftnl_gen *gen, uint16_t attr,
+		       const void *data, uint32_t data_len)
+{
+	nftnl_assert_attr_exists(attr, NFTNL_GEN_MAX);
+	nftnl_assert_validate(data, nftnl_gen_validate, attr, data_len);
+
+	switch (attr) {
+	case NFTNL_GEN_ID:
+		memcpy(&gen->id, data, sizeof(gen->id));
+		break;
+	}
+	gen->flags |= (1 << attr);
+	return 0;
+}
+
+int nftnl_gen_set(struct nftnl_gen *gen, uint16_t attr, const void *data) __visible;
+int nftnl_gen_set(struct nftnl_gen *gen, uint16_t attr, const void *data)
+{
+	return nftnl_gen_set_data(gen, attr, data, nftnl_gen_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_gen_set_u32);
+void nftnl_gen_set_u32(struct nftnl_gen *gen, uint16_t attr, uint32_t val)
+{
+	nftnl_gen_set_data(gen, attr, &val, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_gen_get_data);
+const void *nftnl_gen_get_data(const struct nftnl_gen *gen, uint16_t attr,
+			       uint32_t *data_len)
+{
+	if (!(gen->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_GEN_ID:
+		*data_len = sizeof(gen->id);
+		return &gen->id;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_gen_get);
+const void *nftnl_gen_get(const struct nftnl_gen *gen, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_gen_get_data(gen, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_gen_get_u32);
+uint32_t nftnl_gen_get_u32(const struct nftnl_gen *gen, uint16_t attr)
+{
+	const void *ret = nftnl_gen_get(gen, attr);
+	return ret == NULL ? 0 : *((uint32_t *)ret);
+}
+
+static int nftnl_gen_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_GEN_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_GEN_ID:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+EXPORT_SYMBOL(nftnl_gen_nlmsg_parse);
+int nftnl_gen_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_gen *gen)
+{
+	struct nlattr *tb[NFTA_GEN_MAX + 1] = {};
+
+	if (mnl_attr_parse(nlh, sizeof(struct nfgenmsg),
+			   nftnl_gen_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_GEN_ID]) {
+		gen->id = ntohl(mnl_attr_get_u32(tb[NFTA_GEN_ID]));
+		gen->flags |= (1 << NFTNL_GEN_ID);
+	}
+	return 0;
+}
+
+static int nftnl_gen_cmd_snprintf(char *buf, size_t remain,
+				  const struct nftnl_gen *gen, uint32_t cmd,
+				  uint32_t type, uint32_t flags)
+{
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = snprintf(buf, remain, "ruleset generation ID %u", gen->id);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_gen_snprintf);
+int nftnl_gen_snprintf(char *buf, size_t size, const struct nftnl_gen *gen,
+		       uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_gen_cmd_snprintf(buf, size, gen, nftnl_flag2cmd(flags), type,
+				    flags);
+}
+
+static int nftnl_gen_do_snprintf(char *buf, size_t size, const void *gen,
+				 uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_gen_snprintf(buf, size, gen, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_gen_fprintf);
+int nftnl_gen_fprintf(FILE *fp, const struct nftnl_gen *gen, uint32_t type,
+		      uint32_t flags)
+{
+	return nftnl_fprintf(fp, gen, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_gen_do_snprintf);
+}
diff --git a/src/libnftnl.map b/src/libnftnl.map
new file mode 100644
index 0000000..ad8f2af
--- /dev/null
+++ b/src/libnftnl.map
@@ -0,0 +1,389 @@
+LIBNFTNL_11 {
+global:
+  nftnl_table_alloc;
+  nftnl_table_free;
+  nftnl_table_is_set;
+  nftnl_table_unset;
+  nftnl_table_set;
+  nftnl_table_get;
+  nftnl_table_set_u8;
+  nftnl_table_set_u32;
+  nftnl_table_set_u64;
+  nftnl_table_set_str;
+  nftnl_table_get_u8;
+  nftnl_table_get_u32;
+  nftnl_table_get_u64;
+  nftnl_table_get_str;
+  nftnl_table_parse;
+  nftnl_table_parse_file;
+  nftnl_table_snprintf;
+  nftnl_table_fprintf;
+  nftnl_table_nlmsg_build_payload;
+  nftnl_table_nlmsg_parse;
+  nftnl_table_list_alloc;
+  nftnl_table_list_free;
+  nftnl_table_list_is_empty;
+  nftnl_table_list_foreach;
+  nftnl_table_list_add;
+  nftnl_table_list_add_tail;
+  nftnl_table_list_del;
+  nftnl_table_list_iter_create;
+  nftnl_table_list_iter_next;
+  nftnl_table_list_iter_destroy;
+
+  nftnl_chain_alloc;
+  nftnl_chain_free;
+  nftnl_chain_is_set;
+  nftnl_chain_unset;
+  nftnl_chain_set;
+  nftnl_chain_set_u8;
+  nftnl_chain_set_u32;
+  nftnl_chain_set_s32;
+  nftnl_chain_set_u64;
+  nftnl_chain_set_str;
+  nftnl_chain_get;
+  nftnl_chain_get_u8;
+  nftnl_chain_get_u32;
+  nftnl_chain_get_s32;
+  nftnl_chain_get_u64;
+  nftnl_chain_get_str;
+  nftnl_chain_parse;
+  nftnl_chain_parse_file;
+  nftnl_chain_snprintf;
+  nftnl_chain_fprintf;
+  nftnl_chain_nlmsg_build_payload;
+  nftnl_chain_nlmsg_parse;
+  nftnl_chain_list_alloc;
+  nftnl_chain_list_free;
+  nftnl_chain_list_is_empty;
+  nftnl_chain_list_add;
+  nftnl_chain_list_add_tail;
+  nftnl_chain_list_del;
+  nftnl_chain_list_foreach;
+  nftnl_chain_list_iter_create;
+  nftnl_chain_list_iter_next;
+  nftnl_chain_list_iter_destroy;
+
+  nftnl_rule_alloc;
+  nftnl_rule_free;
+  nftnl_rule_is_set;
+  nftnl_rule_unset;
+  nftnl_rule_set;
+  nftnl_rule_set_u32;
+  nftnl_rule_set_u64;
+  nftnl_rule_set_str;
+  nftnl_rule_get;
+  nftnl_rule_get_u8;
+  nftnl_rule_get_u32;
+  nftnl_rule_get_u64;
+  nftnl_rule_get_str;
+  nftnl_rule_parse;
+  nftnl_rule_parse_file;
+  nftnl_rule_snprintf;
+  nftnl_rule_fprintf;
+  nftnl_rule_nlmsg_build_payload;
+  nftnl_rule_nlmsg_parse;
+  nftnl_rule_add_expr;
+
+  nftnl_expr_foreach;
+  nftnl_expr_iter_create;
+  nftnl_expr_iter_next;
+  nftnl_expr_iter_destroy;
+
+  nftnl_expr_alloc;
+  nftnl_expr_is_set;
+  nftnl_expr_set;
+  nftnl_expr_set_u8;
+  nftnl_expr_set_u16;
+  nftnl_expr_set_u32;
+  nftnl_expr_set_u64;
+  nftnl_expr_set_str;
+  nftnl_expr_get;
+  nftnl_expr_get_u8;
+  nftnl_expr_get_u16;
+  nftnl_expr_get_u32;
+  nftnl_expr_get_u64;
+  nftnl_expr_get_str;
+  nftnl_expr_snprintf;
+  nftnl_expr_free;
+
+  nftnl_rule_list_alloc;
+  nftnl_rule_list_free;
+  nftnl_rule_list_is_empty;
+  nftnl_rule_list_add;
+  nftnl_rule_list_add_tail;
+  nftnl_rule_list_del;
+  nftnl_rule_list_foreach;
+  nftnl_rule_list_iter_create;
+  nftnl_rule_list_iter_cur;
+  nftnl_rule_list_iter_next;
+  nftnl_rule_list_iter_destroy;
+
+  nftnl_set_alloc;
+  nftnl_set_free;
+  nftnl_set_unset;
+  nftnl_set_is_set;
+  nftnl_set_set;
+  nftnl_set_set_u32;
+  nftnl_set_set_u64;
+  nftnl_set_set_str;
+  nftnl_set_get;
+  nftnl_set_get_str;
+  nftnl_set_get_u32;
+  nftnl_set_get_u64;
+  nftnl_set_nlmsg_build_payload;
+  nftnl_set_nlmsg_parse;
+  nftnl_set_parse;
+  nftnl_set_parse_file;
+  nftnl_set_snprintf;
+  nftnl_set_fprintf;
+
+  nftnl_set_list_alloc;
+  nftnl_set_list_free;
+  nftnl_set_list_add;
+  nftnl_set_list_add_tail;
+  nftnl_set_list_del;
+  nftnl_set_list_is_empty;
+  nftnl_set_list_foreach;
+
+  nftnl_set_list_iter_create;
+  nftnl_set_list_iter_cur;
+  nftnl_set_list_iter_next;
+  nftnl_set_list_iter_destroy;
+
+  nftnl_set_elem_alloc;
+  nftnl_set_elem_free;
+  nftnl_set_elem_add;
+  nftnl_set_elem_foreach;
+  nftnl_set_elem_is_set;
+  nftnl_set_elem_unset;
+  nftnl_set_elem_set;
+  nftnl_set_elem_set_u32;
+  nftnl_set_elem_set_u64;
+  nftnl_set_elem_set_str;
+  nftnl_set_elem_get;
+  nftnl_set_elem_get_str;
+  nftnl_set_elem_get_u32;
+  nftnl_set_elem_get_u64;
+  nftnl_set_elem_nlmsg_build_payload;
+  nftnl_set_elem_parse;
+  nftnl_set_elem_parse_file;
+  nftnl_set_elem_snprintf;
+  nftnl_set_elem_fprintf;
+
+  nftnl_set_elems_nlmsg_build_payload;
+  nftnl_set_elems_nlmsg_parse;
+
+  nftnl_set_elems_foreach;
+
+  nftnl_set_elems_iter_create;
+  nftnl_set_elems_iter_cur;
+  nftnl_set_elems_iter_next;
+  nftnl_set_elems_iter_destroy;
+
+  nftnl_ruleset_alloc;
+  nftnl_ruleset_free;
+  nftnl_ruleset_is_set;
+  nftnl_ruleset_unset;
+  nftnl_ruleset_set;
+  nftnl_ruleset_get;
+  nftnl_ruleset_parse;
+  nftnl_ruleset_parse_file;
+  nftnl_ruleset_snprintf;
+  nftnl_ruleset_fprintf;
+
+  nftnl_nlmsg_build_hdr;
+
+  nftnl_parse_err_alloc;
+  nftnl_parse_err_free;
+  nftnl_parse_perror;
+
+  nftnl_table_set_data;
+  nftnl_table_get_data;
+  nftnl_chain_set_data;
+  nftnl_chain_get_data;
+  nftnl_rule_set_data;
+  nftnl_rule_get_data;
+  nftnl_set_set_data;
+  nftnl_set_get_data;
+
+  nftnl_set_elems_nlmsg_build_payload_iter;
+  nftnl_batch_is_supported;
+  nftnl_batch_begin;
+  nftnl_batch_end;
+
+  nftnl_gen_alloc;
+  nftnl_gen_free;
+  nftnl_gen_is_set;
+  nftnl_gen_unset;
+  nftnl_gen_set_data;
+  nftnl_gen_set;
+  nftnl_gen_set_u32;
+  nftnl_gen_get_data;
+  nftnl_gen_get;
+  nftnl_gen_get_u32;
+  nftnl_gen_nlmsg_parse;
+  nftnl_gen_snprintf;
+  nftnl_gen_fprintf;
+
+  nftnl_ruleset_ctx_is_set;
+  nftnl_ruleset_ctx_get;
+  nftnl_ruleset_ctx_get_u32;
+  nftnl_ruleset_parse_file_cb;
+  nftnl_ruleset_parse_buffer_cb;
+  nftnl_ruleset_ctx_free;
+
+  nftnl_batch_alloc;
+  nftnl_batch_update;
+  nftnl_batch_free;
+  nftnl_batch_buffer;
+  nftnl_batch_buffer_len;
+  nftnl_batch_iovec_len;
+  nftnl_batch_iovec;
+
+  nftnl_trace_alloc;
+  nftnl_trace_free;
+
+  nftnl_trace_is_set;
+
+  nftnl_trace_get_u16;
+  nftnl_trace_get_u32;
+  nftnl_trace_get_u64;
+  nftnl_trace_get_str;
+  nftnl_trace_get_data;
+
+  nftnl_trace_nlmsg_parse;
+
+  nftnl_udata_buf_alloc;
+  nftnl_udata_buf_free;
+  nftnl_udata_buf_len;
+  nftnl_udata_buf_data;
+  nftnl_udata_buf_put;
+  nftnl_udata_start;
+  nftnl_udata_end;
+  nftnl_udata_put;
+  nftnl_udata_put_strz;
+  nftnl_udata_put_u32;
+  nftnl_udata_type;
+  nftnl_udata_len;
+  nftnl_udata_get;
+  nftnl_udata_get_u32;
+  nftnl_udata_next;
+  nftnl_udata_parse;
+
+  nftnl_obj_alloc;
+  nftnl_obj_free;
+  nftnl_obj_is_set;
+  nftnl_obj_unset;
+  nftnl_obj_set;
+  nftnl_obj_get;
+  nftnl_obj_set_u8;
+  nftnl_obj_set_u16;
+  nftnl_obj_set_u32;
+  nftnl_obj_set_u64;
+  nftnl_obj_set_str;
+  nftnl_obj_get_u8;
+  nftnl_obj_get_u16;
+  nftnl_obj_get_u32;
+  nftnl_obj_get_str;
+  nftnl_obj_get_u64;
+  nftnl_obj_parse;
+  nftnl_obj_parse_file;
+  nftnl_obj_snprintf;
+  nftnl_obj_fprintf;
+  nftnl_obj_nlmsg_build_payload;
+  nftnl_obj_nlmsg_parse;
+  nftnl_obj_list_alloc;
+  nftnl_obj_list_free;
+  nftnl_obj_list_is_empty;
+  nftnl_obj_list_foreach;
+  nftnl_obj_list_add;
+  nftnl_obj_list_add_tail;
+  nftnl_obj_list_del;
+  nftnl_obj_list_iter_create;
+  nftnl_obj_list_iter_next;
+  nftnl_obj_list_iter_destroy;
+
+  nftnl_expr_fprintf;
+
+  nftnl_flowtable_alloc;
+  nftnl_flowtable_free;
+  nftnl_flowtable_is_set;
+  nftnl_flowtable_unset;
+  nftnl_flowtable_set;
+  nftnl_flowtable_set_u32;
+  nftnl_flowtable_set_s32;
+  nftnl_flowtable_set_str;
+  nftnl_flowtable_set_u64;
+  nftnl_flowtable_get;
+  nftnl_flowtable_get_u32;
+  nftnl_flowtable_get_s32;
+  nftnl_flowtable_get_str;
+  nftnl_flowtable_get_u64;
+  nftnl_flowtable_parse;
+  nftnl_flowtable_parse_file;
+  nftnl_flowtable_snprintf;
+  nftnl_flowtable_fprintf;
+  nftnl_flowtable_nlmsg_build_payload;
+  nftnl_flowtable_nlmsg_parse;
+  nftnl_flowtable_list_alloc;
+  nftnl_flowtable_list_free;
+  nftnl_flowtable_list_is_empty;
+  nftnl_flowtable_list_add;
+  nftnl_flowtable_list_add_tail;
+  nftnl_flowtable_list_del;
+  nftnl_flowtable_list_foreach;
+
+  nftnl_rule_list_insert_at;
+
+local: *;
+};
+
+LIBNFTNL_12 {
+  nftnl_chain_rule_add;
+  nftnl_chain_rule_add_tail;
+  nftnl_chain_rule_del;
+  nftnl_chain_rule_insert_at;
+  nftnl_chain_rule_append_at;
+  nftnl_rule_foreach;
+  nftnl_rule_iter_create;
+  nftnl_rule_iter_next;
+  nftnl_rule_iter_destroy;
+
+  nftnl_chain_list_lookup_byname;
+  nftnl_rule_lookup_byindex;
+} LIBNFTNL_11;
+
+LIBNFTNL_13 {
+  nftnl_set_list_lookup_byname;
+  nftnl_obj_set_data;
+  nftnl_flowtable_set_data;
+} LIBNFTNL_12;
+
+LIBNFTNL_14 {
+  nftnl_udata_nest_start;
+  nftnl_udata_nest_end;
+  nftnl_chain_set_array;
+  nftnl_chain_get_array;
+  nftnl_flowtable_set_array;
+  nftnl_flowtable_get_array;
+} LIBNFTNL_13;
+
+LIBNFTNL_15 {
+  nftnl_obj_get_data;
+  nftnl_expr_build_payload;
+  nftnl_rule_del_expr;
+} LIBNFTNL_14;
+
+LIBNFTNL_16 {
+  nftnl_set_add_expr;
+  nftnl_set_expr_foreach;
+  nftnl_set_elem_add_expr;
+  nftnl_set_elem_expr_foreach;
+  nftnl_expr_add_expr;
+  nftnl_expr_expr_foreach;
+} LIBNFTNL_15;
+
+LIBNFTNL_17 {
+  nftnl_set_elem_nlmsg_build;
+} LIBNFTNL_16;
diff --git a/src/obj/counter.c b/src/obj/counter.c
new file mode 100644
index 0000000..ebf3e74
--- /dev/null
+++ b/src/obj/counter.c
@@ -0,0 +1,131 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "internal.h"
+#include "obj.h"
+
+static int
+nftnl_obj_counter_set(struct nftnl_obj *e, uint16_t type,
+			  const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	switch(type) {
+	case NFTNL_OBJ_CTR_BYTES:
+		memcpy(&ctr->bytes, data, sizeof(ctr->bytes));
+		break;
+	case NFTNL_OBJ_CTR_PKTS:
+		memcpy(&ctr->pkts, data, sizeof(ctr->pkts));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_obj_counter_get(const struct nftnl_obj *e, uint16_t type,
+			  uint32_t *data_len)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	switch(type) {
+	case NFTNL_OBJ_CTR_BYTES:
+		*data_len = sizeof(ctr->bytes);
+		return &ctr->bytes;
+	case NFTNL_OBJ_CTR_PKTS:
+		*data_len = sizeof(ctr->pkts);
+		return &ctr->pkts;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_counter_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_COUNTER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_COUNTER_BYTES:
+	case NFTA_COUNTER_PACKETS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_counter_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_CTR_BYTES))
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_BYTES, htobe64(ctr->bytes));
+	if (e->flags & (1 << NFTNL_OBJ_CTR_PKTS))
+		mnl_attr_put_u64(nlh, NFTA_COUNTER_PACKETS, htobe64(ctr->pkts));
+}
+
+static int
+nftnl_obj_counter_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_COUNTER_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_counter_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_COUNTER_BYTES]) {
+		ctr->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_BYTES]));
+		e->flags |= (1 << NFTNL_OBJ_CTR_BYTES);
+	}
+	if (tb[NFTA_COUNTER_PACKETS]) {
+		ctr->pkts = be64toh(mnl_attr_get_u64(tb[NFTA_COUNTER_PACKETS]));
+		e->flags |= (1 << NFTNL_OBJ_CTR_PKTS);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_counter_snprintf(char *buf, size_t len, uint32_t flags,
+				      const struct nftnl_obj *e)
+{
+	struct nftnl_obj_counter *ctr = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "pkts %"PRIu64" bytes %"PRIu64" ",
+			ctr->pkts, ctr->bytes);
+}
+
+struct obj_ops obj_ops_counter = {
+	.name		= "counter",
+	.type		= NFT_OBJECT_COUNTER,
+	.alloc_len	= sizeof(struct nftnl_obj_counter),
+	.max_attr	= NFTA_COUNTER_MAX,
+	.set		= nftnl_obj_counter_set,
+	.get		= nftnl_obj_counter_get,
+	.parse		= nftnl_obj_counter_parse,
+	.build		= nftnl_obj_counter_build,
+	.output		= nftnl_obj_counter_snprintf,
+};
diff --git a/src/obj/ct_expect.c b/src/obj/ct_expect.c
new file mode 100644
index 0000000..810ba9a
--- /dev/null
+++ b/src/obj/ct_expect.c
@@ -0,0 +1,200 @@
+/*
+ * (C) 2019 by Stéphane Veyret <sveyret@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <arpa/inet.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+
+#include "obj.h"
+
+static int nftnl_obj_ct_expect_set(struct nftnl_obj *e, uint16_t type,
+				   const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_ct_expect *exp = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_CT_EXPECT_L3PROTO:
+		memcpy(&exp->l3proto, data, sizeof(exp->l3proto));
+		break;
+	case NFTNL_OBJ_CT_EXPECT_L4PROTO:
+		memcpy(&exp->l4proto, data, sizeof(exp->l4proto));
+		break;
+	case NFTNL_OBJ_CT_EXPECT_DPORT:
+		memcpy(&exp->dport, data, sizeof(exp->dport));
+		break;
+	case NFTNL_OBJ_CT_EXPECT_TIMEOUT:
+		memcpy(&exp->timeout, data, sizeof(exp->timeout));
+		break;
+	case NFTNL_OBJ_CT_EXPECT_SIZE:
+		memcpy(&exp->size, data, sizeof(exp->size));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_ct_expect_get(const struct nftnl_obj *e,
+					   uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_ct_expect *exp = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_CT_EXPECT_L3PROTO:
+		*data_len = sizeof(exp->l3proto);
+		return &exp->l3proto;
+	case NFTNL_OBJ_CT_EXPECT_L4PROTO:
+		*data_len = sizeof(exp->l4proto);
+		return &exp->l4proto;
+	case NFTNL_OBJ_CT_EXPECT_DPORT:
+		*data_len = sizeof(exp->dport);
+		return &exp->dport;
+	case NFTNL_OBJ_CT_EXPECT_TIMEOUT:
+		*data_len = sizeof(exp->timeout);
+		return &exp->timeout;
+	case NFTNL_OBJ_CT_EXPECT_SIZE:
+		*data_len = sizeof(exp->size);
+		return &exp->size;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_ct_expect_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_CT_EXPECT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_CT_EXPECT_L3PROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_EXPECT_L4PROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_EXPECT_DPORT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_EXPECT_TIMEOUT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_EXPECT_SIZE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_ct_expect_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_ct_expect *exp = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_L3PROTO))
+		mnl_attr_put_u16(nlh, NFTA_CT_EXPECT_L3PROTO, htons(exp->l3proto));
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_L4PROTO))
+		mnl_attr_put_u8(nlh, NFTA_CT_EXPECT_L4PROTO, exp->l4proto);
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_DPORT))
+		mnl_attr_put_u16(nlh, NFTA_CT_EXPECT_DPORT, htons(exp->dport));
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_TIMEOUT))
+		mnl_attr_put_u32(nlh, NFTA_CT_EXPECT_TIMEOUT, exp->timeout);
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_SIZE))
+		mnl_attr_put_u8(nlh, NFTA_CT_EXPECT_SIZE, exp->size);
+}
+
+static int
+nftnl_obj_ct_expect_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_ct_expect *exp = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_CT_EXPECT_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_ct_expect_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CT_EXPECT_L3PROTO]) {
+		exp->l3proto = ntohs(mnl_attr_get_u16(tb[NFTA_CT_EXPECT_L3PROTO]));
+		e->flags |= (1 << NFTNL_OBJ_CT_EXPECT_L3PROTO);
+	}
+	if (tb[NFTA_CT_EXPECT_L4PROTO]) {
+		exp->l4proto = mnl_attr_get_u8(tb[NFTA_CT_EXPECT_L4PROTO]);
+		e->flags |= (1 << NFTNL_OBJ_CT_EXPECT_L4PROTO);
+	}
+	if (tb[NFTA_CT_EXPECT_DPORT]) {
+		exp->dport = ntohs(mnl_attr_get_u16(tb[NFTA_CT_EXPECT_DPORT]));
+		e->flags |= (1 << NFTNL_OBJ_CT_EXPECT_DPORT);
+	}
+	if (tb[NFTA_CT_EXPECT_TIMEOUT]) {
+		exp->timeout = mnl_attr_get_u32(tb[NFTA_CT_EXPECT_TIMEOUT]);
+		e->flags |= (1 << NFTNL_OBJ_CT_EXPECT_TIMEOUT);
+	}
+	if (tb[NFTA_CT_EXPECT_SIZE]) {
+		exp->size = mnl_attr_get_u8(tb[NFTA_CT_EXPECT_SIZE]);
+		e->flags |= (1 << NFTNL_OBJ_CT_EXPECT_SIZE);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_ct_expect_snprintf(char *buf, size_t remain,
+					uint32_t flags,
+					const struct nftnl_obj *e)
+{
+	struct nftnl_obj_ct_expect *exp = nftnl_obj_data(e);
+	int ret = 0, offset = 0;
+
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_L3PROTO)) {
+		ret = snprintf(buf + offset, remain,
+			       "family %d ", exp->l3proto);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_L4PROTO)) {
+		ret = snprintf(buf + offset, remain,
+			       "protocol %d ", exp->l4proto);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_DPORT)) {
+		ret = snprintf(buf + offset, remain,
+			       "dport %d ", exp->dport);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_TIMEOUT)) {
+		ret = snprintf(buf + offset, remain,
+			       "timeout %d ", exp->timeout);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_CT_EXPECT_SIZE)) {
+		ret = snprintf(buf + offset, remain, "size %d ", exp->size);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	buf[offset] = '\0';
+	return offset;
+}
+
+struct obj_ops obj_ops_ct_expect = {
+	.name		= "ct_expect",
+	.type		= NFT_OBJECT_CT_EXPECT,
+	.alloc_len	= sizeof(struct nftnl_obj_ct_expect),
+	.max_attr	= NFTA_CT_EXPECT_MAX,
+	.set		= nftnl_obj_ct_expect_set,
+	.get		= nftnl_obj_ct_expect_get,
+	.parse		= nftnl_obj_ct_expect_parse,
+	.build		= nftnl_obj_ct_expect_build,
+	.output		= nftnl_obj_ct_expect_snprintf,
+};
diff --git a/src/obj/ct_helper.c b/src/obj/ct_helper.c
new file mode 100644
index 0000000..a31bd6f
--- /dev/null
+++ b/src/obj/ct_helper.c
@@ -0,0 +1,154 @@
+/*
+ * (C) 2017 Red Hat GmbH
+ * Author: Florian Westphal <fw@strlen.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static int nftnl_obj_ct_helper_set(struct nftnl_obj *e, uint16_t type,
+				   const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_ct_helper *helper = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_CT_HELPER_NAME:
+		snprintf(helper->name, sizeof(helper->name), "%s", (const char *)data);
+		break;
+	case NFTNL_OBJ_CT_HELPER_L3PROTO:
+		memcpy(&helper->l3proto, data, sizeof(helper->l3proto));
+		break;
+	case NFTNL_OBJ_CT_HELPER_L4PROTO:
+		memcpy(&helper->l4proto, data, sizeof(helper->l4proto));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_ct_helper_get(const struct nftnl_obj *e,
+					   uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_ct_helper *helper = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_CT_HELPER_NAME:
+		*data_len = strlen(helper->name);
+		return helper->name;
+	case NFTNL_OBJ_CT_HELPER_L3PROTO:
+		*data_len = sizeof(helper->l3proto);
+		return &helper->l3proto;
+	case NFTNL_OBJ_CT_HELPER_L4PROTO:
+		*data_len = sizeof(helper->l4proto);
+		return &helper->l4proto;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_ct_helper_cb(const struct nlattr *attr, void *data)
+{
+	const struct nftnl_obj_ct_helper *helper = NULL;
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_CT_HELPER_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_CT_HELPER_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		if (mnl_attr_get_payload_len(attr) >= sizeof(helper->name))
+			abi_breakage();
+		break;
+	case NFTA_CT_HELPER_L3PROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_HELPER_L4PROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_ct_helper_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_ct_helper *helper = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_CT_HELPER_NAME))
+		mnl_attr_put_str(nlh, NFTA_CT_HELPER_NAME, helper->name);
+	if (e->flags & (1 << NFTNL_OBJ_CT_HELPER_L3PROTO))
+		mnl_attr_put_u16(nlh, NFTA_CT_HELPER_L3PROTO, htons(helper->l3proto));
+	if (e->flags & (1 << NFTNL_OBJ_CT_HELPER_L4PROTO))
+		mnl_attr_put_u8(nlh, NFTA_CT_HELPER_L4PROTO, helper->l4proto);
+}
+
+static int
+nftnl_obj_ct_helper_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_ct_helper *helper = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_CT_HELPER_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_ct_helper_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CT_HELPER_NAME]) {
+		snprintf(helper->name, sizeof(helper->name), "%s",
+			 mnl_attr_get_str(tb[NFTA_CT_HELPER_NAME]));
+		e->flags |= (1 << NFTNL_OBJ_CT_HELPER_NAME);
+	}
+	if (tb[NFTA_CT_HELPER_L3PROTO]) {
+		helper->l3proto = ntohs(mnl_attr_get_u16(tb[NFTA_CT_HELPER_L3PROTO]));
+		e->flags |= (1 << NFTNL_OBJ_CT_HELPER_L3PROTO);
+	}
+	if (tb[NFTA_CT_HELPER_L4PROTO]) {
+		helper->l4proto = mnl_attr_get_u8(tb[NFTA_CT_HELPER_L4PROTO]);
+		e->flags |= (1 << NFTNL_OBJ_CT_HELPER_L4PROTO);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_ct_helper_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_obj *e)
+{
+	struct nftnl_obj_ct_helper *helper = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "name %s family %d protocol %d ",
+			helper->name, helper->l3proto, helper->l4proto);
+}
+
+struct obj_ops obj_ops_ct_helper = {
+	.name		= "ct_helper",
+	.type		= NFT_OBJECT_CT_HELPER,
+	.alloc_len	= sizeof(struct nftnl_obj_ct_helper),
+	.max_attr	= NFTA_CT_HELPER_MAX,
+	.set		= nftnl_obj_ct_helper_set,
+	.get		= nftnl_obj_ct_helper_get,
+	.parse		= nftnl_obj_ct_helper_parse,
+	.build		= nftnl_obj_ct_helper_build,
+	.output		= nftnl_obj_ct_helper_snprintf,
+};
diff --git a/src/obj/ct_timeout.c b/src/obj/ct_timeout.c
new file mode 100644
index 0000000..65b48bd
--- /dev/null
+++ b/src/obj/ct_timeout.c
@@ -0,0 +1,320 @@
+/*
+ * (C) 2018 by Harsha Sharma <harshasharmaiitr@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static const char *const tcp_state_to_name[] = {
+	[NFTNL_CTTIMEOUT_TCP_SYN_SENT]		= "SYN_SENT",
+	[NFTNL_CTTIMEOUT_TCP_SYN_RECV]		= "SYN_RECV",
+	[NFTNL_CTTIMEOUT_TCP_ESTABLISHED]	= "ESTABLISHED",
+	[NFTNL_CTTIMEOUT_TCP_FIN_WAIT]		= "FIN_WAIT",
+	[NFTNL_CTTIMEOUT_TCP_CLOSE_WAIT]	= "CLOSE_WAIT",
+	[NFTNL_CTTIMEOUT_TCP_LAST_ACK]		= "LAST_ACK",
+	[NFTNL_CTTIMEOUT_TCP_TIME_WAIT]		= "TIME_WAIT",
+	[NFTNL_CTTIMEOUT_TCP_CLOSE]		= "CLOSE",
+	[NFTNL_CTTIMEOUT_TCP_SYN_SENT2]		= "SYN_SENT2",
+	[NFTNL_CTTIMEOUT_TCP_RETRANS]		= "RETRANS",
+	[NFTNL_CTTIMEOUT_TCP_UNACK]		= "UNACKNOWLEDGED",
+};
+
+static uint32_t tcp_dflt_timeout[] = {
+	[NFTNL_CTTIMEOUT_TCP_SYN_SENT]		= 120,
+	[NFTNL_CTTIMEOUT_TCP_SYN_RECV]		= 60,
+	[NFTNL_CTTIMEOUT_TCP_ESTABLISHED]	= 432000,
+	[NFTNL_CTTIMEOUT_TCP_FIN_WAIT]		= 120,
+	[NFTNL_CTTIMEOUT_TCP_CLOSE_WAIT]	= 60,
+	[NFTNL_CTTIMEOUT_TCP_LAST_ACK]		= 30,
+	[NFTNL_CTTIMEOUT_TCP_TIME_WAIT]		= 120,
+	[NFTNL_CTTIMEOUT_TCP_CLOSE]		= 10,
+	[NFTNL_CTTIMEOUT_TCP_SYN_SENT2] 	= 120,
+	[NFTNL_CTTIMEOUT_TCP_RETRANS]		= 300,
+	[NFTNL_CTTIMEOUT_TCP_UNACK]		= 300,
+};
+
+static const char *const udp_state_to_name[] = {
+	[NFTNL_CTTIMEOUT_UDP_UNREPLIED]		= "UNREPLIED",
+	[NFTNL_CTTIMEOUT_UDP_REPLIED]		= "REPLIED",
+};
+
+static uint32_t udp_dflt_timeout[] = {
+	[NFTNL_CTTIMEOUT_UDP_UNREPLIED]		= 30,
+	[NFTNL_CTTIMEOUT_UDP_REPLIED]		= 180,
+};
+
+static struct {
+	uint32_t attr_max;
+	const char *const *state_to_name;
+	uint32_t *dflt_timeout;
+} timeout_protocol[IPPROTO_MAX] = {
+	[IPPROTO_TCP]	= {
+		.attr_max	= NFTNL_CTTIMEOUT_TCP_MAX,
+		.state_to_name	= tcp_state_to_name,
+		.dflt_timeout	= tcp_dflt_timeout,
+	},
+	[IPPROTO_UDP]	= {
+		.attr_max	= NFTNL_CTTIMEOUT_UDP_MAX,
+		.state_to_name	= udp_state_to_name,
+		.dflt_timeout	= udp_dflt_timeout,
+	},
+};
+
+struct _container_policy_cb {
+	unsigned int nlattr_max;
+	void *tb;
+};
+
+static int
+nftnl_timeout_policy_attr_set_u32(struct nftnl_obj *e,
+				 uint32_t type, uint32_t data)
+{
+	struct nftnl_obj_ct_timeout *t = nftnl_obj_data(e);
+
+	if (type >= NFTNL_CTTIMEOUT_ARRAY_MAX)
+		return -1;
+
+	t->timeout[type] = data;
+
+	if (!(e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_ARRAY)))
+		e->flags |= (1 << NFTNL_OBJ_CT_TIMEOUT_ARRAY);
+
+	return 0;
+}
+
+static int
+parse_timeout_attr_policy_cb(const struct nlattr *attr, void *data)
+{
+	struct _container_policy_cb *data_cb = data;
+	const struct nlattr **tb = data_cb->tb;
+	uint16_t type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, data_cb->nlattr_max) < 0)
+		return MNL_CB_OK;
+
+	if (type > 0 && type <= data_cb->nlattr_max) {
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		tb[type - 1] = attr;
+	}
+	return MNL_CB_OK;
+}
+
+static int
+timeout_parse_attr_data(struct nftnl_obj *e,
+			const struct nlattr *nest)
+{
+	struct nftnl_obj_ct_timeout *t = nftnl_obj_data(e);
+	unsigned int attr_max = timeout_protocol[t->l4proto].attr_max;
+	struct nlattr *tb[attr_max];
+	struct _container_policy_cb cnt = {
+		.nlattr_max = attr_max,
+		.tb = tb,
+	};
+	unsigned int i;
+
+	memset(tb, 0, sizeof(struct nlattr *) * attr_max);
+
+	if (mnl_attr_parse_nested(nest, parse_timeout_attr_policy_cb, &cnt) < 0)
+		return -1;
+
+	for (i = 0; i < array_size(tb); i++) {
+		if (tb[i]) {
+			nftnl_timeout_policy_attr_set_u32(e, i,
+				ntohl(mnl_attr_get_u32(tb[i])));
+		}
+	}
+	return 0;
+}
+
+static int nftnl_obj_ct_timeout_set(struct nftnl_obj *e, uint16_t type,
+				   const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_ct_timeout *timeout = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_CT_TIMEOUT_L3PROTO:
+		memcpy(&timeout->l3proto, data, sizeof(timeout->l3proto));
+		break;
+	case NFTNL_OBJ_CT_TIMEOUT_L4PROTO:
+		memcpy(&timeout->l4proto, data, sizeof(timeout->l4proto));
+		break;
+	case NFTNL_OBJ_CT_TIMEOUT_ARRAY:
+		memcpy(timeout->timeout, data,
+		       sizeof(uint32_t) * NFTNL_CTTIMEOUT_ARRAY_MAX);
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_ct_timeout_get(const struct nftnl_obj *e,
+					   uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_ct_timeout *timeout = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_CT_TIMEOUT_L3PROTO:
+		*data_len = sizeof(timeout->l3proto);
+		return &timeout->l3proto;
+	case NFTNL_OBJ_CT_TIMEOUT_L4PROTO:
+		*data_len = sizeof(timeout->l4proto);
+		return &timeout->l4proto;
+	case NFTNL_OBJ_CT_TIMEOUT_ARRAY:
+		*data_len = sizeof(uint32_t) * NFTNL_CTTIMEOUT_ARRAY_MAX;
+		return timeout->timeout;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_ct_timeout_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_CT_TIMEOUT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_CT_TIMEOUT_L3PROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_TIMEOUT_L4PROTO:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	case NFTA_CT_TIMEOUT_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_ct_timeout_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_ct_timeout *timeout = nftnl_obj_data(e);
+	struct nlattr *nest;
+
+	if (e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_L3PROTO))
+		mnl_attr_put_u16(nlh, NFTA_CT_TIMEOUT_L3PROTO, htons(timeout->l3proto));
+	if (e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_L4PROTO))
+		mnl_attr_put_u8(nlh, NFTA_CT_TIMEOUT_L4PROTO, timeout->l4proto);
+	if (e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_ARRAY)) {
+		int i;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_CT_TIMEOUT_DATA);
+		for (i = 0; i < timeout_protocol[timeout->l4proto].attr_max; i++)
+			mnl_attr_put_u32(nlh, i+1, htonl(timeout->timeout[i]));
+
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int
+nftnl_obj_ct_timeout_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_ct_timeout *timeout = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_CT_TIMEOUT_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_ct_timeout_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_CT_TIMEOUT_L3PROTO]) {
+		timeout->l3proto = ntohs(mnl_attr_get_u16(tb[NFTA_CT_TIMEOUT_L3PROTO]));
+		e->flags |= (1 << NFTNL_OBJ_CT_TIMEOUT_L3PROTO);
+	}
+	if (tb[NFTA_CT_TIMEOUT_L4PROTO]) {
+		timeout->l4proto = mnl_attr_get_u8(tb[NFTA_CT_TIMEOUT_L4PROTO]);
+		e->flags |= (1 << NFTNL_OBJ_CT_TIMEOUT_L4PROTO);
+	}
+	if (tb[NFTA_CT_TIMEOUT_DATA]) {
+		if (timeout_parse_attr_data(e, tb[NFTA_CT_TIMEOUT_DATA]) < 0)
+			return -1;
+		e->flags |= (1 << NFTNL_OBJ_CT_TIMEOUT_ARRAY);
+	}
+	return 0;
+}
+
+static int nftnl_obj_ct_timeout_snprintf(char *buf, size_t remain,
+				       uint32_t flags,
+				       const struct nftnl_obj *e)
+{
+	int ret = 0, offset = 0;
+
+	struct nftnl_obj_ct_timeout *timeout = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_L3PROTO)) {
+		ret = snprintf(buf + offset, remain, "family %d ",
+			       timeout->l3proto);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_L4PROTO)) {
+		ret = snprintf(buf + offset, remain, "protocol %d ",
+				timeout->l4proto);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_CT_TIMEOUT_ARRAY)) {
+		uint8_t l4num = timeout->l4proto;
+		int i;
+
+		/* default to generic protocol tracker. */
+		if (timeout_protocol[timeout->l4proto].attr_max == 0)
+			l4num = IPPROTO_RAW;
+
+		ret = snprintf(buf + offset, remain, "policy = {");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		for (i = 0; i < timeout_protocol[l4num].attr_max; i++) {
+			const char *state_name =
+				timeout_protocol[l4num].state_to_name[i][0] ?
+				timeout_protocol[l4num].state_to_name[i] :
+				"UNKNOWN";
+
+			if (timeout->timeout[i] != timeout_protocol[l4num].dflt_timeout[i]) {
+				ret = snprintf(buf + offset, remain,
+					"%s = %u,", state_name, timeout->timeout[i]);
+				SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+			}
+		}
+
+		ret = snprintf(buf + offset, remain, "}");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	buf[offset] = '\0';
+
+	return offset;
+}
+
+struct obj_ops obj_ops_ct_timeout = {
+	.name		= "ct_timeout",
+	.type		= NFT_OBJECT_CT_TIMEOUT,
+	.alloc_len	= sizeof(struct nftnl_obj_ct_timeout),
+	.max_attr	= NFTA_CT_TIMEOUT_MAX,
+	.set		= nftnl_obj_ct_timeout_set,
+	.get		= nftnl_obj_ct_timeout_get,
+	.parse		= nftnl_obj_ct_timeout_parse,
+	.build		= nftnl_obj_ct_timeout_build,
+	.output		= nftnl_obj_ct_timeout_snprintf,
+};
diff --git a/src/obj/limit.c b/src/obj/limit.c
new file mode 100644
index 0000000..d7b1aed
--- /dev/null
+++ b/src/obj/limit.c
@@ -0,0 +1,172 @@
+/*
+ * Copyright (c) 2017 Pablo M. Bermudo Garay <pablombg@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static int nftnl_obj_limit_set(struct nftnl_obj *e, uint16_t type,
+			       const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_limit *limit = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_LIMIT_RATE:
+		memcpy(&limit->rate, data, sizeof(limit->rate));
+		break;
+	case NFTNL_OBJ_LIMIT_UNIT:
+		memcpy(&limit->unit, data, sizeof(limit->unit));
+		break;
+	case NFTNL_OBJ_LIMIT_BURST:
+		memcpy(&limit->burst, data, sizeof(limit->burst));
+		break;
+	case NFTNL_OBJ_LIMIT_TYPE:
+		memcpy(&limit->type, data, sizeof(limit->type));
+		break;
+	case NFTNL_OBJ_LIMIT_FLAGS:
+		memcpy(&limit->flags, data, sizeof(limit->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_limit_get(const struct nftnl_obj *e,
+				       uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_limit *limit = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_LIMIT_RATE:
+		*data_len = sizeof(limit->rate);
+		return &limit->rate;
+	case NFTNL_OBJ_LIMIT_UNIT:
+		*data_len = sizeof(limit->unit);
+		return &limit->unit;
+	case NFTNL_OBJ_LIMIT_BURST:
+		*data_len = sizeof(limit->burst);
+		return &limit->burst;
+	case NFTNL_OBJ_LIMIT_TYPE:
+		*data_len = sizeof(limit->type);
+		return &limit->type;
+	case NFTNL_OBJ_LIMIT_FLAGS:
+		*data_len = sizeof(limit->flags);
+		return &limit->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_limit_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_LIMIT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_LIMIT_RATE:
+	case NFTA_LIMIT_UNIT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_LIMIT_BURST:
+	case NFTA_LIMIT_TYPE:
+	case NFTA_LIMIT_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_obj_limit_build(struct nlmsghdr *nlh,
+				  const struct nftnl_obj *e)
+{
+	struct nftnl_obj_limit *limit = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_LIMIT_RATE))
+		mnl_attr_put_u64(nlh, NFTA_LIMIT_RATE, htobe64(limit->rate));
+	if (e->flags & (1 << NFTNL_OBJ_LIMIT_UNIT))
+		mnl_attr_put_u64(nlh, NFTA_LIMIT_UNIT, htobe64(limit->unit));
+	if (e->flags & (1 << NFTNL_OBJ_LIMIT_BURST))
+		mnl_attr_put_u32(nlh, NFTA_LIMIT_BURST, htonl(limit->burst));
+	if (e->flags & (1 << NFTNL_OBJ_LIMIT_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_LIMIT_TYPE, htonl(limit->type));
+	if (e->flags & (1 << NFTNL_OBJ_LIMIT_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_LIMIT_FLAGS, htonl(limit->flags));
+}
+
+static int nftnl_obj_limit_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_limit *limit = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_LIMIT_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_limit_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_LIMIT_RATE]) {
+		limit->rate = be64toh(mnl_attr_get_u64(tb[NFTA_LIMIT_RATE]));
+		e->flags |= (1 << NFTNL_OBJ_LIMIT_RATE);
+	}
+	if (tb[NFTA_LIMIT_UNIT]) {
+		limit->unit = be64toh(mnl_attr_get_u64(tb[NFTA_LIMIT_UNIT]));
+		e->flags |= (1 << NFTNL_OBJ_LIMIT_UNIT);
+	}
+	if (tb[NFTA_LIMIT_BURST]) {
+		limit->burst = ntohl(mnl_attr_get_u32(tb[NFTA_LIMIT_BURST]));
+		e->flags |= (1 << NFTNL_OBJ_LIMIT_BURST);
+	}
+	if (tb[NFTA_LIMIT_TYPE]) {
+		limit->type = ntohl(mnl_attr_get_u32(tb[NFTA_LIMIT_TYPE]));
+		e->flags |= (1 << NFTNL_OBJ_LIMIT_TYPE);
+	}
+	if (tb[NFTA_LIMIT_FLAGS]) {
+		limit->flags = ntohl(mnl_attr_get_u32(tb[NFTA_LIMIT_FLAGS]));
+		e->flags |= (1 << NFTNL_OBJ_LIMIT_FLAGS);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_limit_snprintf(char *buf, size_t len,
+				    uint32_t flags,
+				    const struct nftnl_obj *e)
+{
+	struct nftnl_obj_limit *limit = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "rate %"PRIu64" unit %"PRIu64" burst %u "
+			"type %u flags %u ", limit->rate, limit->unit,
+			limit->burst, limit->type, limit->flags);
+}
+
+struct obj_ops obj_ops_limit = {
+	.name		= "limit",
+	.type		= NFT_OBJECT_LIMIT,
+	.alloc_len	= sizeof(struct nftnl_obj_limit),
+	.max_attr	= NFTA_LIMIT_MAX,
+	.set		= nftnl_obj_limit_set,
+	.get		= nftnl_obj_limit_get,
+	.parse		= nftnl_obj_limit_parse,
+	.build		= nftnl_obj_limit_build,
+	.output		= nftnl_obj_limit_snprintf,
+};
diff --git a/src/obj/quota.c b/src/obj/quota.c
new file mode 100644
index 0000000..6c7559a
--- /dev/null
+++ b/src/obj/quota.c
@@ -0,0 +1,148 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static int nftnl_obj_quota_set(struct nftnl_obj *e, uint16_t type,
+				const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_QUOTA_BYTES:
+		memcpy(&quota->bytes, data, sizeof(quota->bytes));
+		break;
+	case NFTNL_OBJ_QUOTA_CONSUMED:
+		memcpy(&quota->consumed, data, sizeof(quota->consumed));
+		break;
+	case NFTNL_OBJ_QUOTA_FLAGS:
+		memcpy(&quota->flags, data, sizeof(quota->flags));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_quota_get(const struct nftnl_obj *e,
+					uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_QUOTA_BYTES:
+		*data_len = sizeof(quota->bytes);
+		return &quota->bytes;
+	case NFTNL_OBJ_QUOTA_CONSUMED:
+		*data_len = sizeof(quota->consumed);
+		return &quota->consumed;
+	case NFTNL_OBJ_QUOTA_FLAGS:
+		*data_len = sizeof(quota->flags);
+		return &quota->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_quota_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_QUOTA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_QUOTA_BYTES:
+	case NFTA_QUOTA_CONSUMED:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_QUOTA_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_quota_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_BYTES))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_BYTES, htobe64(quota->bytes));
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_CONSUMED))
+		mnl_attr_put_u64(nlh, NFTA_QUOTA_CONSUMED,
+				 htobe64(quota->consumed));
+	if (e->flags & (1 << NFTNL_OBJ_QUOTA_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_QUOTA_FLAGS, htonl(quota->flags));
+}
+
+static int
+nftnl_obj_quota_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_QUOTA_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_quota_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_QUOTA_BYTES]) {
+		quota->bytes = be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_BYTES]));
+		e->flags |= (1 << NFTNL_OBJ_QUOTA_BYTES);
+	}
+	if (tb[NFTA_QUOTA_CONSUMED]) {
+		quota->consumed =
+			be64toh(mnl_attr_get_u64(tb[NFTA_QUOTA_CONSUMED]));
+		e->flags |= (1 << NFTNL_OBJ_QUOTA_CONSUMED);
+	}
+	if (tb[NFTA_QUOTA_FLAGS]) {
+		quota->flags = ntohl(mnl_attr_get_u32(tb[NFTA_QUOTA_FLAGS]));
+		e->flags |= (1 << NFTNL_OBJ_QUOTA_FLAGS);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_quota_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_obj *e)
+{
+	struct nftnl_obj_quota *quota = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "bytes %"PRIu64" flags %u ",
+			quota->bytes, quota->flags);
+}
+
+struct obj_ops obj_ops_quota = {
+	.name		= "quota",
+	.type		= NFT_OBJECT_QUOTA,
+	.alloc_len	= sizeof(struct nftnl_obj_quota),
+	.max_attr	= NFTA_QUOTA_MAX,
+	.set		= nftnl_obj_quota_set,
+	.get		= nftnl_obj_quota_get,
+	.parse		= nftnl_obj_quota_parse,
+	.build		= nftnl_obj_quota_build,
+	.output		= nftnl_obj_quota_snprintf,
+};
diff --git a/src/obj/secmark.c b/src/obj/secmark.c
new file mode 100644
index 0000000..e5c24b3
--- /dev/null
+++ b/src/obj/secmark.c
@@ -0,0 +1,120 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static int nftnl_obj_secmark_set(struct nftnl_obj *e, uint16_t type,
+				const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_secmark *secmark = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_SECMARK_CTX:
+		snprintf(secmark->ctx, sizeof(secmark->ctx), "%s", (const char *)data);
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_secmark_get(const struct nftnl_obj *e,
+					uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_secmark *secmark = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_SECMARK_CTX:
+		*data_len = strlen(secmark->ctx);
+		return secmark->ctx;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_secmark_cb(const struct nlattr *attr, void *data)
+{
+	const struct nftnl_obj_secmark *secmark = NULL;
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_SECMARK_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_SECMARK_CTX:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		if (mnl_attr_get_payload_len(attr) >= sizeof(secmark->ctx))
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_secmark_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_secmark *secmark = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_SECMARK_CTX))
+		mnl_attr_put_str(nlh, NFTA_SECMARK_CTX, secmark->ctx);
+}
+
+static int
+nftnl_obj_secmark_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_secmark *secmark = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_SECMARK_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_secmark_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_SECMARK_CTX]) {
+		snprintf(secmark->ctx, sizeof(secmark->ctx), "%s",
+			 mnl_attr_get_str(tb[NFTA_SECMARK_CTX]));
+		e->flags |= (1 << NFTNL_OBJ_SECMARK_CTX);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_secmark_snprintf(char *buf, size_t len,
+				       uint32_t flags,
+				       const struct nftnl_obj *e)
+{
+	struct nftnl_obj_secmark *secmark = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "context %s ", secmark->ctx);
+}
+
+struct obj_ops obj_ops_secmark = {
+	.name		= "secmark",
+	.type		= NFT_OBJECT_SECMARK,
+	.alloc_len	= sizeof(struct nftnl_obj_secmark),
+	.max_attr	= NFTA_SECMARK_MAX,
+	.set		= nftnl_obj_secmark_set,
+	.get		= nftnl_obj_secmark_get,
+	.parse		= nftnl_obj_secmark_parse,
+	.build		= nftnl_obj_secmark_build,
+	.output		= nftnl_obj_secmark_snprintf,
+};
diff --git a/src/obj/synproxy.c b/src/obj/synproxy.c
new file mode 100644
index 0000000..baef5c2
--- /dev/null
+++ b/src/obj/synproxy.c
@@ -0,0 +1,147 @@
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include "internal.h"
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "obj.h"
+
+static int nftnl_obj_synproxy_set(struct nftnl_obj *e, uint16_t type,
+				  const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_synproxy *synproxy = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_SYNPROXY_MSS:
+		synproxy->mss = *((uint16_t *)data);
+		break;
+	case NFTNL_OBJ_SYNPROXY_WSCALE:
+		synproxy->wscale = *((uint8_t *)data);
+		break;
+	case NFTNL_OBJ_SYNPROXY_FLAGS:
+		synproxy->flags = *((uint32_t *)data);
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *nftnl_obj_synproxy_get(const struct nftnl_obj *e,
+					  uint16_t type, uint32_t *data_len)
+{
+	struct nftnl_obj_synproxy *synproxy = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_SYNPROXY_MSS:
+		*data_len = sizeof(synproxy->mss);
+		return &synproxy->mss;
+	case NFTNL_OBJ_SYNPROXY_WSCALE:
+		*data_len = sizeof(synproxy->wscale);
+		return &synproxy->wscale;
+	case NFTNL_OBJ_SYNPROXY_FLAGS:
+		*data_len = sizeof(synproxy->flags);
+		return &synproxy->flags;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_synproxy_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_SYNPROXY_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_SYNPROXY_MSS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SYNPROXY_WSCALE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SYNPROXY_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void nftnl_obj_synproxy_build(struct nlmsghdr *nlh,
+				     const struct nftnl_obj *e)
+{
+	struct nftnl_obj_synproxy *synproxy = nftnl_obj_data(e);
+
+	if (e->flags & (1 << NFTNL_OBJ_SYNPROXY_MSS))
+		mnl_attr_put_u16(nlh, NFTA_SYNPROXY_MSS, htons(synproxy->mss));
+	if (e->flags & (1 << NFTNL_OBJ_SYNPROXY_WSCALE))
+		mnl_attr_put_u8(nlh, NFTA_SYNPROXY_WSCALE, synproxy->wscale);
+	if (e->flags & (1 << NFTNL_OBJ_SYNPROXY_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_SYNPROXY_FLAGS,
+				 htonl(synproxy->flags));
+}
+
+static int nftnl_obj_synproxy_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_synproxy *synproxy = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_SYNPROXY_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_synproxy_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_SYNPROXY_MSS]) {
+		synproxy->mss = ntohs(mnl_attr_get_u16(tb[NFTA_SYNPROXY_MSS]));
+		e->flags |= (1 << NFTNL_OBJ_SYNPROXY_MSS);
+	}
+	if (tb[NFTA_SYNPROXY_WSCALE]) {
+		synproxy->wscale = mnl_attr_get_u8(tb[NFTA_SYNPROXY_WSCALE]);
+		e->flags |= (1 << NFTNL_OBJ_SYNPROXY_WSCALE);
+	}
+	if (tb[NFTA_SYNPROXY_FLAGS]) {
+		synproxy->flags = ntohl(mnl_attr_get_u32(tb[NFTA_SYNPROXY_FLAGS]));
+		e->flags |= (1 << NFTNL_OBJ_SYNPROXY_FLAGS);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_synproxy_snprintf(char *buf, size_t len,
+				    uint32_t flags,
+				    const struct nftnl_obj *e)
+{
+	struct nftnl_obj_synproxy *synproxy = nftnl_obj_data(e);
+        int ret, offset = 0;
+
+        if (e->flags & (1 << NFTNL_OBJ_SYNPROXY_MSS) &&
+            e->flags & (1 << NFTNL_OBJ_SYNPROXY_WSCALE)) {
+                ret = snprintf(buf, len, "mss %u wscale %u ", synproxy->mss,
+                               synproxy->wscale);
+                SNPRINTF_BUFFER_SIZE(ret, len, offset);
+        }
+
+        return offset;
+}
+
+struct obj_ops obj_ops_synproxy = {
+	.name		= "synproxy",
+	.type		= NFT_OBJECT_SYNPROXY,
+	.alloc_len	= sizeof(struct nftnl_obj_synproxy),
+	.max_attr	= NFTA_SYNPROXY_MAX,
+	.set		= nftnl_obj_synproxy_set,
+	.get		= nftnl_obj_synproxy_get,
+	.parse		= nftnl_obj_synproxy_parse,
+	.build		= nftnl_obj_synproxy_build,
+	.output		= nftnl_obj_synproxy_snprintf,
+};
diff --git a/src/obj/tunnel.c b/src/obj/tunnel.c
new file mode 100644
index 0000000..d2503dc
--- /dev/null
+++ b/src/obj/tunnel.c
@@ -0,0 +1,551 @@
+/*
+ * (C) 2018 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <stdio.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <linux/netfilter/nf_tables.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/object.h>
+
+#include "internal.h"
+#include "obj.h"
+
+static int
+nftnl_obj_tunnel_set(struct nftnl_obj *e, uint16_t type,
+		     const void *data, uint32_t data_len)
+{
+	struct nftnl_obj_tunnel *tun = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_TUNNEL_ID:
+		memcpy(&tun->id, data, sizeof(tun->id));
+		break;
+	case NFTNL_OBJ_TUNNEL_IPV4_SRC:
+		memcpy(&tun->src_v4, data, sizeof(tun->src_v4));
+		break;
+	case NFTNL_OBJ_TUNNEL_IPV4_DST:
+		memcpy(&tun->dst_v4, data, sizeof(tun->dst_v4));
+		break;
+	case NFTNL_OBJ_TUNNEL_IPV6_SRC:
+		memcpy(&tun->src_v6, data, sizeof(struct in6_addr));
+		break;
+	case NFTNL_OBJ_TUNNEL_IPV6_DST:
+		memcpy(&tun->dst_v6, data, sizeof(struct in6_addr));
+		break;
+	case NFTNL_OBJ_TUNNEL_IPV6_FLOWLABEL:
+		memcpy(&tun->flowlabel, data, sizeof(tun->flowlabel));
+		break;
+	case NFTNL_OBJ_TUNNEL_SPORT:
+		memcpy(&tun->sport, data, sizeof(tun->sport));
+		break;
+	case NFTNL_OBJ_TUNNEL_DPORT:
+		memcpy(&tun->dport, data, sizeof(tun->dport));
+		break;
+	case NFTNL_OBJ_TUNNEL_FLAGS:
+		memcpy(&tun->tun_flags, data, sizeof(tun->tun_flags));
+		break;
+	case NFTNL_OBJ_TUNNEL_TOS:
+		memcpy(&tun->tun_tos, data, sizeof(tun->tun_tos));
+		break;
+	case NFTNL_OBJ_TUNNEL_TTL:
+		memcpy(&tun->tun_ttl, data, sizeof(tun->tun_ttl));
+		break;
+	case NFTNL_OBJ_TUNNEL_VXLAN_GBP:
+		memcpy(&tun->u.tun_vxlan.gbp, data, sizeof(tun->u.tun_vxlan.gbp));
+		break;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_VERSION:
+		memcpy(&tun->u.tun_erspan.version, data, sizeof(tun->u.tun_erspan.version));
+		break;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX:
+		memcpy(&tun->u.tun_erspan.u.v1_index, data, sizeof(tun->u.tun_erspan.u.v1_index));
+		break;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID:
+		memcpy(&tun->u.tun_erspan.u.v2.hwid, data, sizeof(tun->u.tun_erspan.u.v2.hwid));
+		break;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR:
+		memcpy(&tun->u.tun_erspan.u.v2.dir, data, sizeof(tun->u.tun_erspan.u.v2.dir));
+		break;
+	default:
+		return -1;
+	}
+	return 0;
+}
+
+static const void *
+nftnl_obj_tunnel_get(const struct nftnl_obj *e, uint16_t type,
+		     uint32_t *data_len)
+{
+	struct nftnl_obj_tunnel *tun = nftnl_obj_data(e);
+
+	switch (type) {
+	case NFTNL_OBJ_TUNNEL_ID:
+		*data_len = sizeof(tun->id);
+		return &tun->id;
+	case NFTNL_OBJ_TUNNEL_IPV4_SRC:
+		*data_len = sizeof(tun->src_v4);
+		return &tun->src_v4;
+	case NFTNL_OBJ_TUNNEL_IPV4_DST:
+		*data_len = sizeof(tun->dst_v4);
+		return &tun->dst_v4;
+	case NFTNL_OBJ_TUNNEL_IPV6_SRC:
+		*data_len = sizeof(tun->src_v6);
+		return &tun->src_v6;
+	case NFTNL_OBJ_TUNNEL_IPV6_DST:
+		*data_len = sizeof(tun->dst_v6);
+		return &tun->dst_v6;
+	case NFTNL_OBJ_TUNNEL_IPV6_FLOWLABEL:
+		*data_len = sizeof(tun->flowlabel);
+		return &tun->flowlabel;
+	case NFTNL_OBJ_TUNNEL_SPORT:
+		*data_len = sizeof(tun->sport);
+		return &tun->sport;
+	case NFTNL_OBJ_TUNNEL_DPORT:
+		*data_len = sizeof(tun->dport);
+		return &tun->dport;
+	case NFTNL_OBJ_TUNNEL_FLAGS:
+		*data_len = sizeof(tun->tun_flags);
+		return &tun->tun_flags;
+	case NFTNL_OBJ_TUNNEL_TOS:
+		*data_len = sizeof(tun->tun_tos);
+		return &tun->tun_tos;
+	case NFTNL_OBJ_TUNNEL_TTL:
+		*data_len = sizeof(tun->tun_ttl);
+		return &tun->tun_ttl;
+	case NFTNL_OBJ_TUNNEL_VXLAN_GBP:
+		*data_len = sizeof(tun->u.tun_vxlan.gbp);
+		return &tun->u.tun_vxlan.gbp;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_VERSION:
+		*data_len = sizeof(tun->u.tun_erspan.version);
+		return &tun->u.tun_erspan.version;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX:
+		*data_len = sizeof(tun->u.tun_erspan.u.v1_index);
+		return &tun->u.tun_erspan.u.v1_index;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID:
+		*data_len = sizeof(tun->u.tun_erspan.u.v2.hwid);
+		return &tun->u.tun_erspan.u.v2.hwid;
+	case NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR:
+		*data_len = sizeof(tun->u.tun_erspan.u.v2.dir);
+		return &tun->u.tun_erspan.u.v2.dir;
+	}
+	return NULL;
+}
+
+static int nftnl_obj_tunnel_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_KEY_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_TUNNEL_KEY_ID:
+	case NFTA_TUNNEL_KEY_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TUNNEL_KEY_IP:
+	case NFTA_TUNNEL_KEY_IP6:
+	case NFTA_TUNNEL_KEY_OPTS:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TUNNEL_KEY_SPORT:
+	case NFTA_TUNNEL_KEY_DPORT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TUNNEL_KEY_TOS:
+	case NFTA_TUNNEL_KEY_TTL:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static void
+nftnl_obj_tunnel_build(struct nlmsghdr *nlh, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_tunnel *tun = nftnl_obj_data(e);
+	struct nlattr *nest;
+
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_ID))
+		mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_ID, htonl(tun->id));
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV4_SRC) ||
+	    e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV4_DST)) {
+		nest = mnl_attr_nest_start(nlh, NFTA_TUNNEL_KEY_IP);
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV4_SRC))
+			mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_IP_SRC, tun->src_v4);
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV4_DST))
+			mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_IP_DST, tun->dst_v4);
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV6_SRC) ||
+	    e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV6_DST)) {
+		nest = mnl_attr_nest_start(nlh, NFTA_TUNNEL_KEY_IP6);
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV6_SRC))
+			mnl_attr_put(nlh, NFTA_TUNNEL_KEY_IP6_SRC,
+				     sizeof(tun->src_v6), &tun->src_v6);
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV6_DST))
+			mnl_attr_put(nlh, NFTA_TUNNEL_KEY_IP6_DST,
+				     sizeof(tun->dst_v6), &tun->dst_v6);
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_IPV6_FLOWLABEL))
+			mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
+					 htonl(tun->flowlabel));
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_SPORT))
+		mnl_attr_put_u16(nlh, NFTA_TUNNEL_KEY_SPORT, htons(tun->sport));
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_DPORT))
+		mnl_attr_put_u16(nlh, NFTA_TUNNEL_KEY_DPORT, htons(tun->dport));
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_TOS))
+		mnl_attr_put_u8(nlh, NFTA_TUNNEL_KEY_TOS, tun->tun_tos);
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_TTL))
+		mnl_attr_put_u8(nlh, NFTA_TUNNEL_KEY_TTL, tun->tun_ttl);
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_FLAGS, htonl(tun->tun_flags));
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_VXLAN_GBP)) {
+		nest = mnl_attr_nest_start(nlh, NFTA_TUNNEL_KEY_OPTS);
+		mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_VXLAN_GBP,
+				 htonl(tun->u.tun_vxlan.gbp));
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (e->flags & (1 << NFTNL_OBJ_TUNNEL_ERSPAN_VERSION) &&
+	    (e->flags & (1 << NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX) ||
+	     (e->flags & (1 << NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID) &&
+	      e->flags & (1u << NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR)))) {
+		struct nlattr *nest_inner;
+
+		nest = mnl_attr_nest_start(nlh, NFTA_TUNNEL_KEY_OPTS);
+		nest_inner = mnl_attr_nest_start(nlh, NFTA_TUNNEL_KEY_OPTS_ERSPAN);
+		mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_ERSPAN_VERSION,
+				 htonl(tun->u.tun_erspan.version));
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX))
+			mnl_attr_put_u32(nlh, NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
+					 htonl(tun->u.tun_erspan.u.v1_index));
+		if (e->flags & (1 << NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID))
+			mnl_attr_put_u8(nlh, NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
+					tun->u.tun_erspan.u.v2.hwid);
+		if (e->flags & (1u << NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR))
+			mnl_attr_put_u8(nlh, NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
+					tun->u.tun_erspan.u.v2.dir);
+		mnl_attr_nest_end(nlh, nest_inner);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int nftnl_obj_tunnel_ip_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_KEY_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_TUNNEL_KEY_IP_SRC:
+	case NFTA_TUNNEL_KEY_IP_DST:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_obj_tunnel_parse_ip(struct nftnl_obj *e, struct nlattr *attr,
+				     struct nftnl_obj_tunnel *tun)
+{
+	struct nlattr *tb[NFTA_TUNNEL_KEY_IP_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_tunnel_ip_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY_IP_SRC]) {
+		tun->src_v4 = mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_IP_SRC]);
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_IPV4_SRC);
+	}
+	if (tb[NFTA_TUNNEL_KEY_IP_DST]) {
+		tun->dst_v4 = mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_IP_DST]);
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_IPV4_DST);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_tunnel_ip6_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_KEY_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_TUNNEL_KEY_IP6_SRC:
+	case NFTA_TUNNEL_KEY_IP6_DST:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TUNNEL_KEY_IP6_FLOWLABEL:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_obj_tunnel_parse_ip6(struct nftnl_obj *e, struct nlattr *attr,
+				      struct nftnl_obj_tunnel *tun)
+{
+	struct nlattr *tb[NFTA_TUNNEL_KEY_IP6_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_tunnel_ip6_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY_IP6_SRC]) {
+		memcpy(&tun->src_v6,
+		       mnl_attr_get_payload(tb[NFTA_TUNNEL_KEY_IP6_SRC]),
+		       sizeof(struct in6_addr));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_IPV6_SRC);
+	}
+	if (tb[NFTA_TUNNEL_KEY_IP6_DST]) {
+		memcpy(&tun->dst_v6,
+		       mnl_attr_get_payload(tb[NFTA_TUNNEL_KEY_IP6_DST]),
+		       sizeof(struct in6_addr));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_IPV6_DST);
+	}
+	if (tb[NFTA_TUNNEL_KEY_IP6_FLOWLABEL]) {
+		tun->flowlabel =
+			ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_IP6_FLOWLABEL]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_IPV6_FLOWLABEL);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_tunnel_vxlan_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_KEY_VXLAN_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_TUNNEL_KEY_VXLAN_GBP:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_obj_tunnel_parse_vxlan(struct nftnl_obj *e, struct nlattr *attr,
+			     struct nftnl_obj_tunnel *tun)
+{
+	struct nlattr *tb[NFTA_TUNNEL_KEY_VXLAN_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_tunnel_vxlan_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY_VXLAN_GBP]) {
+		tun->u.tun_vxlan.gbp =
+			ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_VXLAN_GBP]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_VXLAN_GBP);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_tunnel_erspan_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_KEY_ERSPAN_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_TUNNEL_KEY_ERSPAN_VERSION:
+	case NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TUNNEL_KEY_ERSPAN_V2_HWID:
+	case NFTA_TUNNEL_KEY_ERSPAN_V2_DIR:
+		if (mnl_attr_validate(attr, MNL_TYPE_U8) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_obj_tunnel_parse_erspan(struct nftnl_obj *e, struct nlattr *attr,
+			      struct nftnl_obj_tunnel *tun)
+{
+	struct nlattr *tb[NFTA_TUNNEL_KEY_ERSPAN_MAX + 1] = {};
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_tunnel_erspan_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION]) {
+		tun->u.tun_erspan.version =
+			ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_ERSPAN_VERSION);
+	}
+	if (tb[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX]) {
+		tun->u.tun_erspan.u.v1_index =
+			ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_ERSPAN_V1_INDEX);
+	}
+	if (tb[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID]) {
+		tun->u.tun_erspan.u.v2.hwid =
+			mnl_attr_get_u8(tb[NFTA_TUNNEL_KEY_ERSPAN_V2_HWID]);
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_ERSPAN_V2_HWID);
+	}
+	if (tb[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR]) {
+		tun->u.tun_erspan.u.v2.dir =
+			mnl_attr_get_u8(tb[NFTA_TUNNEL_KEY_ERSPAN_V2_DIR]);
+		e->flags |= (1u << NFTNL_OBJ_TUNNEL_ERSPAN_V2_DIR);
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_tunnel_opts_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TUNNEL_KEY_OPTS_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_TUNNEL_KEY_OPTS_VXLAN:
+	case NFTA_TUNNEL_KEY_OPTS_ERSPAN:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_obj_tunnel_parse_opts(struct nftnl_obj *e, struct nlattr *attr,
+			    struct nftnl_obj_tunnel *tun)
+{
+	struct nlattr *tb[NFTA_TUNNEL_KEY_OPTS_MAX + 1] = {};
+	int err = 0;
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_tunnel_opts_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY_OPTS_VXLAN]) {
+		err = nftnl_obj_tunnel_parse_vxlan(e, tb[NFTA_TUNNEL_KEY_OPTS_VXLAN],
+						   tun);
+	} else if (tb[NFTA_TUNNEL_KEY_OPTS_ERSPAN]) {
+		err = nftnl_obj_tunnel_parse_erspan(e, tb[NFTA_TUNNEL_KEY_OPTS_ERSPAN],
+						    tun);
+	}
+
+	return err;
+}
+
+static int
+nftnl_obj_tunnel_parse(struct nftnl_obj *e, struct nlattr *attr)
+{
+	struct nftnl_obj_tunnel *tun = nftnl_obj_data(e);
+	struct nlattr *tb[NFTA_TUNNEL_KEY_MAX + 1] = {};
+	int err;
+
+	if (mnl_attr_parse_nested(attr, nftnl_obj_tunnel_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TUNNEL_KEY_ID]) {
+		tun->id = ntohl(mnl_attr_get_u32(tb[NFTA_TUNNEL_KEY_ID]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_ID);
+	}
+	if (tb[NFTA_TUNNEL_KEY_IP]) {
+		err = nftnl_obj_tunnel_parse_ip(e, tb[NFTA_TUNNEL_KEY_IP], tun);
+		if (err < 0)
+			return err;
+	} else if (tb[NFTA_TUNNEL_KEY_IP6]) {
+		err = nftnl_obj_tunnel_parse_ip6(e, tb[NFTA_TUNNEL_KEY_IP6], tun);
+		if (err < 0)
+			return err;
+	}
+
+	if (tb[NFTA_TUNNEL_KEY_SPORT]) {
+		tun->sport = ntohs(mnl_attr_get_u16(tb[NFTA_TUNNEL_KEY_SPORT]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_SPORT);
+	}
+	if (tb[NFTA_TUNNEL_KEY_DPORT]) {
+		tun->dport = ntohs(mnl_attr_get_u16(tb[NFTA_TUNNEL_KEY_DPORT]));
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_DPORT);
+	}
+	if (tb[NFTA_TUNNEL_KEY_TOS]) {
+		tun->tun_tos = mnl_attr_get_u8(tb[NFTA_TUNNEL_KEY_TOS]);
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_TOS);
+	}
+	if (tb[NFTA_TUNNEL_KEY_TTL]) {
+		tun->tun_ttl = mnl_attr_get_u8(tb[NFTA_TUNNEL_KEY_TTL]);
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_TTL);
+	}
+	if (tb[NFTA_TUNNEL_KEY_FLAGS]) {
+		tun->tun_flags = mnl_attr_get_u8(tb[NFTA_TUNNEL_KEY_FLAGS]);
+		e->flags |= (1 << NFTNL_OBJ_TUNNEL_FLAGS);
+	}
+	if (tb[NFTA_TUNNEL_KEY_OPTS]) {
+		err = nftnl_obj_tunnel_parse_opts(e, tb[NFTA_TUNNEL_KEY_OPTS], tun);
+		if (err < 0)
+			return err;
+	}
+
+	return 0;
+}
+
+static int nftnl_obj_tunnel_snprintf(char *buf, size_t len,
+				     uint32_t flags, const struct nftnl_obj *e)
+{
+	struct nftnl_obj_tunnel *tun = nftnl_obj_data(e);
+
+	return snprintf(buf, len, "id %u ", tun->id);
+}
+
+struct obj_ops obj_ops_tunnel = {
+	.name		= "tunnel",
+	.type		= NFT_OBJECT_TUNNEL,
+	.alloc_len	= sizeof(struct nftnl_obj_tunnel),
+	.max_attr	= NFTA_TUNNEL_KEY_MAX,
+	.set		= nftnl_obj_tunnel_set,
+	.get		= nftnl_obj_tunnel_get,
+	.parse		= nftnl_obj_tunnel_parse,
+	.build		= nftnl_obj_tunnel_build,
+	.output		= nftnl_obj_tunnel_snprintf,
+};
diff --git a/src/object.c b/src/object.c
new file mode 100644
index 0000000..232b97a
--- /dev/null
+++ b/src/object.c
@@ -0,0 +1,562 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/object.h>
+#include "obj.h"
+
+static struct obj_ops *obj_ops[__NFT_OBJECT_MAX] = {
+	[NFT_OBJECT_COUNTER]	= &obj_ops_counter,
+	[NFT_OBJECT_QUOTA]	= &obj_ops_quota,
+	[NFT_OBJECT_CT_HELPER]	= &obj_ops_ct_helper,
+	[NFT_OBJECT_LIMIT]	= &obj_ops_limit,
+	[NFT_OBJECT_TUNNEL]	= &obj_ops_tunnel,
+	[NFT_OBJECT_CT_TIMEOUT] = &obj_ops_ct_timeout,
+	[NFT_OBJECT_SECMARK]	= &obj_ops_secmark,
+	[NFT_OBJECT_CT_EXPECT]	= &obj_ops_ct_expect,
+	[NFT_OBJECT_SYNPROXY]	= &obj_ops_synproxy,
+};
+
+static struct obj_ops *nftnl_obj_ops_lookup(uint32_t type)
+{
+	if (type > NFT_OBJECT_MAX)
+		return NULL;
+
+	return obj_ops[type];
+}
+
+EXPORT_SYMBOL(nftnl_obj_alloc);
+struct nftnl_obj *nftnl_obj_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_obj));
+}
+
+EXPORT_SYMBOL(nftnl_obj_free);
+void nftnl_obj_free(const struct nftnl_obj *obj)
+{
+	if (obj->flags & (1 << NFTNL_OBJ_TABLE))
+		xfree(obj->table);
+	if (obj->flags & (1 << NFTNL_OBJ_NAME))
+		xfree(obj->name);
+	if (obj->flags & (1 << NFTNL_OBJ_USERDATA))
+		xfree(obj->user.data);
+
+	xfree(obj);
+}
+
+EXPORT_SYMBOL(nftnl_obj_is_set);
+bool nftnl_obj_is_set(const struct nftnl_obj *obj, uint16_t attr)
+{
+	return obj->flags & (1 << attr);
+}
+
+static uint32_t nftnl_obj_validate[NFTNL_OBJ_MAX + 1] = {
+	[NFTNL_OBJ_FAMILY]	= sizeof(uint32_t),
+	[NFTNL_OBJ_USE]		= sizeof(uint32_t),
+	[NFTNL_OBJ_HANDLE]	= sizeof(uint64_t),
+};
+
+EXPORT_SYMBOL(nftnl_obj_set_data);
+void nftnl_obj_set_data(struct nftnl_obj *obj, uint16_t attr,
+			const void *data, uint32_t data_len)
+{
+	if (attr < NFTNL_OBJ_MAX)
+		nftnl_assert_validate(data, nftnl_obj_validate, attr, data_len);
+
+	switch (attr) {
+	case NFTNL_OBJ_TABLE:
+		xfree(obj->table);
+		obj->table = strdup(data);
+		break;
+	case NFTNL_OBJ_NAME:
+		xfree(obj->name);
+		obj->name = strdup(data);
+		break;
+	case NFTNL_OBJ_TYPE:
+		obj->ops = nftnl_obj_ops_lookup(*((uint32_t *)data));
+		if (!obj->ops)
+			return;
+		break;
+	case NFTNL_OBJ_FAMILY:
+		memcpy(&obj->family, data, sizeof(obj->family));
+		break;
+	case NFTNL_OBJ_USE:
+		memcpy(&obj->use, data, sizeof(obj->use));
+		break;
+	case NFTNL_OBJ_HANDLE:
+		memcpy(&obj->handle, data, sizeof(obj->handle));
+		break;
+	case NFTNL_OBJ_USERDATA:
+		if (obj->flags & (1 << NFTNL_OBJ_USERDATA))
+			xfree(obj->user.data);
+
+		obj->user.data = malloc(data_len);
+		if (!obj->user.data)
+			return;
+		memcpy(obj->user.data, data, data_len);
+		obj->user.len = data_len;
+		break;
+	default:
+		if (obj->ops)
+			obj->ops->set(obj, attr, data, data_len);
+		break;
+	}
+	obj->flags |= (1 << attr);
+}
+
+void nftnl_obj_set(struct nftnl_obj *obj, uint16_t attr, const void *data) __visible;
+void nftnl_obj_set(struct nftnl_obj *obj, uint16_t attr, const void *data)
+{
+	nftnl_obj_set_data(obj, attr, data, nftnl_obj_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_obj_set_u8);
+void nftnl_obj_set_u8(struct nftnl_obj *obj, uint16_t attr, uint8_t val)
+{
+	nftnl_obj_set_data(obj, attr, &val, sizeof(uint8_t));
+}
+
+EXPORT_SYMBOL(nftnl_obj_set_u16);
+void nftnl_obj_set_u16(struct nftnl_obj *obj, uint16_t attr, uint16_t val)
+{
+	nftnl_obj_set_data(obj, attr, &val, sizeof(uint16_t));
+}
+
+EXPORT_SYMBOL(nftnl_obj_set_u32);
+void nftnl_obj_set_u32(struct nftnl_obj *obj, uint16_t attr, uint32_t val)
+{
+	nftnl_obj_set_data(obj, attr, &val, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_obj_set_u64);
+void nftnl_obj_set_u64(struct nftnl_obj *obj, uint16_t attr, uint64_t val)
+{
+	nftnl_obj_set_data(obj, attr, &val, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_obj_set_str);
+void nftnl_obj_set_str(struct nftnl_obj *obj, uint16_t attr, const char *str)
+{
+	nftnl_obj_set_data(obj, attr, str, 0);
+}
+
+EXPORT_SYMBOL(nftnl_obj_get_data);
+const void *nftnl_obj_get_data(struct nftnl_obj *obj, uint16_t attr,
+			       uint32_t *data_len)
+{
+	if (!(obj->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_OBJ_TABLE:
+		return obj->table;
+	case NFTNL_OBJ_NAME:
+		return obj->name;
+	case NFTNL_OBJ_TYPE:
+		if (!obj->ops)
+			return NULL;
+
+		*data_len = sizeof(uint32_t);
+		return &obj->ops->type;
+	case NFTNL_OBJ_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &obj->family;
+	case NFTNL_OBJ_USE:
+		*data_len = sizeof(uint32_t);
+		return &obj->use;
+	case NFTNL_OBJ_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &obj->handle;
+	case NFTNL_OBJ_USERDATA:
+		*data_len = obj->user.len;
+		return obj->user.data;
+	default:
+		if (obj->ops)
+			return obj->ops->get(obj, attr, data_len);
+		break;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_obj_get);
+const void *nftnl_obj_get(struct nftnl_obj *obj, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_obj_get_data(obj, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_obj_get_u8);
+uint8_t nftnl_obj_get_u8(struct nftnl_obj *obj, uint16_t attr)
+{
+	const void *ret = nftnl_obj_get(obj, attr);
+	return ret == NULL ? 0 : *((uint8_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_obj_get_u16);
+uint16_t nftnl_obj_get_u16(struct nftnl_obj *obj, uint16_t attr)
+{
+	const void *ret = nftnl_obj_get(obj, attr);
+	return ret == NULL ? 0 : *((uint16_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_obj_get_u32);
+uint32_t nftnl_obj_get_u32(struct nftnl_obj *obj, uint16_t attr)
+{
+	const void *ret = nftnl_obj_get(obj, attr);
+	return ret == NULL ? 0 : *((uint32_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_obj_get_u64);
+uint64_t nftnl_obj_get_u64(struct nftnl_obj *obj, uint16_t attr)
+{
+	const void *ret = nftnl_obj_get(obj, attr);
+	return ret == NULL ? 0 : *((uint64_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_obj_get_str);
+const char *nftnl_obj_get_str(struct nftnl_obj *obj, uint16_t attr)
+{
+	return nftnl_obj_get(obj, attr);
+}
+
+EXPORT_SYMBOL(nftnl_obj_nlmsg_build_payload);
+void nftnl_obj_nlmsg_build_payload(struct nlmsghdr *nlh,
+				   const struct nftnl_obj *obj)
+{
+	if (obj->flags & (1 << NFTNL_OBJ_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_OBJ_TABLE, obj->table);
+	if (obj->flags & (1 << NFTNL_OBJ_NAME))
+		mnl_attr_put_strz(nlh, NFTA_OBJ_NAME, obj->name);
+	if (obj->flags & (1 << NFTNL_OBJ_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_OBJ_TYPE, htonl(obj->ops->type));
+	if (obj->flags & (1 << NFTNL_OBJ_HANDLE))
+		mnl_attr_put_u64(nlh, NFTA_OBJ_HANDLE, htobe64(obj->handle));
+	if (obj->flags & (1 << NFTNL_OBJ_USERDATA))
+		mnl_attr_put(nlh, NFTA_OBJ_USERDATA, obj->user.len, obj->user.data);
+	if (obj->ops) {
+		struct nlattr *nest = mnl_attr_nest_start(nlh, NFTA_OBJ_DATA);
+
+		obj->ops->build(nlh, obj);
+		mnl_attr_nest_end(nlh, nest);
+	}
+}
+
+static int nftnl_obj_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_OBJ_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_OBJ_TABLE:
+	case NFTA_OBJ_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJ_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJ_DATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJ_USE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_OBJ_USERDATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+EXPORT_SYMBOL(nftnl_obj_nlmsg_parse);
+int nftnl_obj_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_obj *obj)
+{
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	struct nlattr *tb[NFTA_OBJ_MAX + 1] = {};
+	int err;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_obj_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_OBJ_TABLE]) {
+		obj->table = strdup(mnl_attr_get_str(tb[NFTA_OBJ_TABLE]));
+		obj->flags |= (1 << NFTNL_OBJ_TABLE);
+	}
+	if (tb[NFTA_OBJ_NAME]) {
+		obj->name = strdup(mnl_attr_get_str(tb[NFTA_OBJ_NAME]));
+		obj->flags |= (1 << NFTNL_OBJ_NAME);
+	}
+	if (tb[NFTA_OBJ_TYPE]) {
+		uint32_t type = ntohl(mnl_attr_get_u32(tb[NFTA_OBJ_TYPE]));
+
+		obj->ops = nftnl_obj_ops_lookup(type);
+		if (obj->ops)
+			obj->flags |= (1 << NFTNL_OBJ_TYPE);
+	}
+	if (tb[NFTA_OBJ_DATA]) {
+		if (obj->ops) {
+			err = obj->ops->parse(obj, tb[NFTA_OBJ_DATA]);
+			if (err < 0)
+				return err;
+		}
+	}
+	if (tb[NFTA_OBJ_USE]) {
+		obj->use = ntohl(mnl_attr_get_u32(tb[NFTA_OBJ_USE]));
+		obj->flags |= (1 << NFTNL_OBJ_USE);
+	}
+	if (tb[NFTA_OBJ_HANDLE]) {
+		obj->handle = be64toh(mnl_attr_get_u64(tb[NFTA_OBJ_HANDLE]));
+		obj->flags |= (1 << NFTNL_OBJ_HANDLE);
+	}
+	if (tb[NFTA_OBJ_USERDATA]) {
+		nftnl_obj_set_data(obj, NFTNL_OBJ_USERDATA,
+				   mnl_attr_get_payload(tb[NFTA_OBJ_USERDATA]),
+				   mnl_attr_get_payload_len(tb[NFTA_OBJ_USERDATA]));
+	}
+
+	obj->family = nfg->nfgen_family;
+	obj->flags |= (1 << NFTNL_OBJ_FAMILY);
+
+	return 0;
+}
+
+static int nftnl_obj_do_parse(struct nftnl_obj *obj, enum nftnl_parse_type type,
+			      const void *data, struct nftnl_parse_err *err,
+			      enum nftnl_parse_input input)
+{
+	struct nftnl_parse_err perr = {};
+	int ret;
+
+	switch (type) {
+	case NFTNL_PARSE_JSON:
+	case NFTNL_PARSE_XML:
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+
+	if (err != NULL)
+		*err = perr;
+
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_obj_parse);
+int nftnl_obj_parse(struct nftnl_obj *obj, enum nftnl_parse_type type,
+		      const char *data, struct nftnl_parse_err *err)
+{
+	return nftnl_obj_do_parse(obj, type, data, err, NFTNL_PARSE_BUFFER);
+}
+
+EXPORT_SYMBOL(nftnl_obj_parse_file);
+int nftnl_obj_parse_file(struct nftnl_obj *obj, enum nftnl_parse_type type,
+			   FILE *fp, struct nftnl_parse_err *err)
+{
+	return nftnl_obj_do_parse(obj, type, fp, err, NFTNL_PARSE_FILE);
+}
+
+static int nftnl_obj_snprintf_dflt(char *buf, size_t remain,
+				   const struct nftnl_obj *obj,
+				   uint32_t type, uint32_t flags)
+{
+	const char *name = obj->ops ? obj->ops->name : "(unknown)";
+	int ret, offset = 0;
+
+	ret = snprintf(buf, remain, "table %s name %s use %u [ %s ",
+		       obj->table, obj->name, obj->use, name);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (obj->ops) {
+		ret = obj->ops->output(buf + offset, remain, flags, obj);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+	ret = snprintf(buf + offset, remain, "]");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+static int nftnl_obj_cmd_snprintf(char *buf, size_t remain,
+				    const struct nftnl_obj *obj, uint32_t cmd,
+				    uint32_t type, uint32_t flags)
+{
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = nftnl_obj_snprintf_dflt(buf + offset, remain, obj, type, flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_obj_snprintf);
+int nftnl_obj_snprintf(char *buf, size_t size, const struct nftnl_obj *obj,
+		       uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_obj_cmd_snprintf(buf, size, obj, nftnl_flag2cmd(flags),
+				      type, flags);
+}
+
+static int nftnl_obj_do_snprintf(char *buf, size_t size, const void *obj,
+				 uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_obj_snprintf(buf, size, obj, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_obj_fprintf);
+int nftnl_obj_fprintf(FILE *fp, const struct nftnl_obj *obj, uint32_t type,
+		      uint32_t flags)
+{
+	return nftnl_fprintf(fp, obj, NFTNL_CMD_UNSPEC, type, flags,
+			     nftnl_obj_do_snprintf);
+}
+
+struct nftnl_obj_list {
+	struct list_head list;
+};
+
+EXPORT_SYMBOL(nftnl_obj_list_alloc);
+struct nftnl_obj_list *nftnl_obj_list_alloc(void)
+{
+	struct nftnl_obj_list *list;
+
+	list = calloc(1, sizeof(struct nftnl_obj_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+
+	return list;
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_free);
+void nftnl_obj_list_free(struct nftnl_obj_list *list)
+{
+	struct nftnl_obj *r, *tmp;
+
+	list_for_each_entry_safe(r, tmp, &list->list, head) {
+		list_del(&r->head);
+		nftnl_obj_free(r);
+	}
+	xfree(list);
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_is_empty);
+int nftnl_obj_list_is_empty(struct nftnl_obj_list *list)
+{
+	return list_empty(&list->list);
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_add);
+void nftnl_obj_list_add(struct nftnl_obj *r, struct nftnl_obj_list *list)
+{
+	list_add(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_add_tail);
+void nftnl_obj_list_add_tail(struct nftnl_obj *r,
+			       struct nftnl_obj_list *list)
+{
+	list_add_tail(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_del);
+void nftnl_obj_list_del(struct nftnl_obj *t)
+{
+	list_del(&t->head);
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_foreach);
+int nftnl_obj_list_foreach(struct nftnl_obj_list *table_list,
+			     int (*cb)(struct nftnl_obj *t, void *data),
+			     void *data)
+{
+	struct nftnl_obj *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &table_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+struct nftnl_obj_list_iter {
+	struct nftnl_obj_list	*list;
+	struct nftnl_obj	*cur;
+};
+
+EXPORT_SYMBOL(nftnl_obj_list_iter_create);
+struct nftnl_obj_list_iter *
+nftnl_obj_list_iter_create(struct nftnl_obj_list *l)
+{
+	struct nftnl_obj_list_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_obj_list_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->list = l;
+	if (nftnl_obj_list_is_empty(l))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(l->list.next, struct nftnl_obj, head);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_iter_next);
+struct nftnl_obj *nftnl_obj_list_iter_next(struct nftnl_obj_list_iter *iter)
+{
+	struct nftnl_obj *r = iter->cur;
+
+	if (r == NULL)
+		return NULL;
+
+	/* get next table, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_obj, head);
+	if (&iter->cur->head == iter->list->list.next)
+		return NULL;
+
+	return r;
+}
+
+EXPORT_SYMBOL(nftnl_obj_list_iter_destroy);
+void nftnl_obj_list_iter_destroy(struct nftnl_obj_list_iter *iter)
+{
+	xfree(iter);
+}
diff --git a/src/rule.c b/src/rule.c
new file mode 100644
index 0000000..a52012b
--- /dev/null
+++ b/src/rule.c
@@ -0,0 +1,876 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <limits.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+#include <inttypes.h>
+#include <ctype.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/rule.h>
+#include <libnftnl/set.h>
+#include <libnftnl/expr.h>
+
+EXPORT_SYMBOL(nftnl_rule_alloc);
+struct nftnl_rule *nftnl_rule_alloc(void)
+{
+	struct nftnl_rule *r;
+
+	r = calloc(1, sizeof(struct nftnl_rule));
+	if (r == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&r->expr_list);
+
+	return r;
+}
+
+EXPORT_SYMBOL(nftnl_rule_free);
+void nftnl_rule_free(const struct nftnl_rule *r)
+{
+	struct nftnl_expr *e, *tmp;
+
+	list_for_each_entry_safe(e, tmp, &r->expr_list, head)
+		nftnl_expr_free(e);
+
+	if (r->flags & (1 << (NFTNL_RULE_TABLE)))
+		xfree(r->table);
+	if (r->flags & (1 << (NFTNL_RULE_CHAIN)))
+		xfree(r->chain);
+	if (r->flags & (1 << (NFTNL_RULE_USERDATA)))
+		xfree(r->user.data);
+
+	xfree(r);
+}
+
+EXPORT_SYMBOL(nftnl_rule_is_set);
+bool nftnl_rule_is_set(const struct nftnl_rule *r, uint16_t attr)
+{
+	return r->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_rule_unset);
+void nftnl_rule_unset(struct nftnl_rule *r, uint16_t attr)
+{
+	if (!(r->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_RULE_TABLE:
+		xfree(r->table);
+		break;
+	case NFTNL_RULE_CHAIN:
+		xfree(r->chain);
+		break;
+	case NFTNL_RULE_HANDLE:
+	case NFTNL_RULE_COMPAT_PROTO:
+	case NFTNL_RULE_COMPAT_FLAGS:
+	case NFTNL_RULE_POSITION:
+	case NFTNL_RULE_FAMILY:
+	case NFTNL_RULE_ID:
+	case NFTNL_RULE_POSITION_ID:
+		break;
+	case NFTNL_RULE_USERDATA:
+		xfree(r->user.data);
+		break;
+	}
+
+	r->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_rule_validate[NFTNL_RULE_MAX + 1] = {
+	[NFTNL_RULE_HANDLE]		= sizeof(uint64_t),
+	[NFTNL_RULE_COMPAT_PROTO]	= sizeof(uint32_t),
+	[NFTNL_RULE_COMPAT_FLAGS]	= sizeof(uint32_t),
+	[NFTNL_RULE_FAMILY]		= sizeof(uint32_t),
+	[NFTNL_RULE_POSITION]		= sizeof(uint64_t),
+	[NFTNL_RULE_ID]			= sizeof(uint32_t),
+	[NFTNL_RULE_POSITION_ID]	= sizeof(uint32_t),
+};
+
+EXPORT_SYMBOL(nftnl_rule_set_data);
+int nftnl_rule_set_data(struct nftnl_rule *r, uint16_t attr,
+			const void *data, uint32_t data_len)
+{
+	nftnl_assert_attr_exists(attr, NFTNL_RULE_MAX);
+	nftnl_assert_validate(data, nftnl_rule_validate, attr, data_len);
+
+	switch(attr) {
+	case NFTNL_RULE_TABLE:
+		if (r->flags & (1 << NFTNL_RULE_TABLE))
+			xfree(r->table);
+
+		r->table = strdup(data);
+		if (!r->table)
+			return -1;
+		break;
+	case NFTNL_RULE_CHAIN:
+		if (r->flags & (1 << NFTNL_RULE_CHAIN))
+			xfree(r->chain);
+
+		r->chain = strdup(data);
+		if (!r->chain)
+			return -1;
+		break;
+	case NFTNL_RULE_HANDLE:
+		memcpy(&r->handle, data, sizeof(r->handle));
+		break;
+	case NFTNL_RULE_COMPAT_PROTO:
+		memcpy(&r->compat.proto, data, sizeof(r->compat.proto));
+		break;
+	case NFTNL_RULE_COMPAT_FLAGS:
+		memcpy(&r->compat.flags, data, sizeof(r->compat.flags));
+		break;
+	case NFTNL_RULE_FAMILY:
+		memcpy(&r->family, data, sizeof(r->family));
+		break;
+	case NFTNL_RULE_POSITION:
+		memcpy(&r->position, data, sizeof(r->position));
+		break;
+	case NFTNL_RULE_USERDATA:
+		if (r->flags & (1 << NFTNL_RULE_USERDATA))
+			xfree(r->user.data);
+
+		r->user.data = malloc(data_len);
+		if (!r->user.data)
+			return -1;
+
+		memcpy(r->user.data, data, data_len);
+		r->user.len = data_len;
+		break;
+	case NFTNL_RULE_ID:
+		memcpy(&r->id, data, sizeof(r->id));
+		break;
+	case NFTNL_RULE_POSITION_ID:
+		memcpy(&r->position_id, data, sizeof(r->position_id));
+		break;
+	}
+	r->flags |= (1 << attr);
+	return 0;
+}
+
+int nftnl_rule_set(struct nftnl_rule *r, uint16_t attr, const void *data) __visible;
+int nftnl_rule_set(struct nftnl_rule *r, uint16_t attr, const void *data)
+{
+	return nftnl_rule_set_data(r, attr, data, nftnl_rule_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_rule_set_u32);
+void nftnl_rule_set_u32(struct nftnl_rule *r, uint16_t attr, uint32_t val)
+{
+	nftnl_rule_set_data(r, attr, &val, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_rule_set_u64);
+void nftnl_rule_set_u64(struct nftnl_rule *r, uint16_t attr, uint64_t val)
+{
+	nftnl_rule_set_data(r, attr, &val, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_rule_set_str);
+int nftnl_rule_set_str(struct nftnl_rule *r, uint16_t attr, const char *str)
+{
+	return nftnl_rule_set_data(r, attr, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_rule_get_data);
+const void *nftnl_rule_get_data(const struct nftnl_rule *r, uint16_t attr,
+				   uint32_t *data_len)
+{
+	if (!(r->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_RULE_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &r->family;
+	case NFTNL_RULE_TABLE:
+		*data_len = strlen(r->table) + 1;
+		return r->table;
+	case NFTNL_RULE_CHAIN:
+		*data_len = strlen(r->chain) + 1;
+		return r->chain;
+	case NFTNL_RULE_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &r->handle;
+	case NFTNL_RULE_COMPAT_PROTO:
+		*data_len = sizeof(uint32_t);
+		return &r->compat.proto;
+	case NFTNL_RULE_COMPAT_FLAGS:
+		*data_len = sizeof(uint32_t);
+		return &r->compat.flags;
+	case NFTNL_RULE_POSITION:
+		*data_len = sizeof(uint64_t);
+		return &r->position;
+	case NFTNL_RULE_USERDATA:
+		*data_len = r->user.len;
+		return r->user.data;
+	case NFTNL_RULE_ID:
+		*data_len = sizeof(uint32_t);
+		return &r->id;
+	case NFTNL_RULE_POSITION_ID:
+		*data_len = sizeof(uint32_t);
+		return &r->position_id;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_rule_get);
+const void *nftnl_rule_get(const struct nftnl_rule *r, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_rule_get_data(r, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_rule_get_str);
+const char *nftnl_rule_get_str(const struct nftnl_rule *r, uint16_t attr)
+{
+	return nftnl_rule_get(r, attr);
+}
+
+EXPORT_SYMBOL(nftnl_rule_get_u32);
+uint32_t nftnl_rule_get_u32(const struct nftnl_rule *r, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint32_t *val = nftnl_rule_get_data(r, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint32_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_rule_get_u64);
+uint64_t nftnl_rule_get_u64(const struct nftnl_rule *r, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint64_t *val = nftnl_rule_get_data(r, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint64_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_rule_get_u8);
+uint8_t nftnl_rule_get_u8(const struct nftnl_rule *r, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint8_t *val = nftnl_rule_get_data(r, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint8_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_rule_nlmsg_build_payload);
+void nftnl_rule_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_rule *r)
+{
+	struct nftnl_expr *expr;
+	struct nlattr *nest, *nest2;
+
+	if (r->flags & (1 << NFTNL_RULE_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_RULE_TABLE, r->table);
+	if (r->flags & (1 << NFTNL_RULE_CHAIN))
+		mnl_attr_put_strz(nlh, NFTA_RULE_CHAIN, r->chain);
+	if (r->flags & (1 << NFTNL_RULE_HANDLE))
+		mnl_attr_put_u64(nlh, NFTA_RULE_HANDLE, htobe64(r->handle));
+	if (r->flags & (1 << NFTNL_RULE_POSITION))
+		mnl_attr_put_u64(nlh, NFTA_RULE_POSITION, htobe64(r->position));
+	if (r->flags & (1 << NFTNL_RULE_USERDATA)) {
+		mnl_attr_put(nlh, NFTA_RULE_USERDATA, r->user.len,
+			     r->user.data);
+	}
+
+	if (!list_empty(&r->expr_list)) {
+		nest = mnl_attr_nest_start(nlh, NFTA_RULE_EXPRESSIONS);
+		list_for_each_entry(expr, &r->expr_list, head) {
+			nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
+			nftnl_expr_build_payload(nlh, expr);
+			mnl_attr_nest_end(nlh, nest2);
+		}
+		mnl_attr_nest_end(nlh, nest);
+	}
+
+	if (r->flags & (1 << NFTNL_RULE_COMPAT_PROTO) &&
+	    r->flags & (1 << NFTNL_RULE_COMPAT_FLAGS)) {
+
+		nest = mnl_attr_nest_start(nlh, NFTA_RULE_COMPAT);
+		mnl_attr_put_u32(nlh, NFTA_RULE_COMPAT_PROTO,
+				 htonl(r->compat.proto));
+		mnl_attr_put_u32(nlh, NFTA_RULE_COMPAT_FLAGS,
+				 htonl(r->compat.flags));
+		mnl_attr_nest_end(nlh, nest);
+	}
+	if (r->flags & (1 << NFTNL_RULE_ID))
+		mnl_attr_put_u32(nlh, NFTA_RULE_ID, htonl(r->id));
+	if (r->flags & (1 << NFTNL_RULE_POSITION_ID))
+		mnl_attr_put_u32(nlh, NFTA_RULE_POSITION_ID, htonl(r->position_id));
+}
+
+EXPORT_SYMBOL(nftnl_rule_add_expr);
+void nftnl_rule_add_expr(struct nftnl_rule *r, struct nftnl_expr *expr)
+{
+	list_add_tail(&expr->head, &r->expr_list);
+}
+
+EXPORT_SYMBOL(nftnl_rule_del_expr);
+void nftnl_rule_del_expr(struct nftnl_expr *expr)
+{
+	list_del(&expr->head);
+}
+
+static int nftnl_rule_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_RULE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_RULE_TABLE:
+	case NFTA_RULE_CHAIN:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_RULE_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_RULE_COMPAT:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_RULE_POSITION:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_RULE_USERDATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	case NFTA_RULE_ID:
+	case NFTA_RULE_POSITION_ID:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_rule_parse_expr(struct nlattr *nest, struct nftnl_rule *r)
+{
+	struct nftnl_expr *expr;
+	struct nlattr *attr;
+
+	mnl_attr_for_each_nested(attr, nest) {
+		if (mnl_attr_get_type(attr) != NFTA_LIST_ELEM)
+			return -1;
+
+		expr = nftnl_expr_parse(attr);
+		if (expr == NULL)
+			return -1;
+
+		list_add_tail(&expr->head, &r->expr_list);
+	}
+	return 0;
+}
+
+static int nftnl_rule_parse_compat_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_RULE_COMPAT_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_RULE_COMPAT_PROTO:
+	case NFTA_RULE_COMPAT_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_rule_parse_compat(struct nlattr *nest, struct nftnl_rule *r)
+{
+	struct nlattr *tb[NFTA_RULE_COMPAT_MAX+1] = {};
+
+	if (mnl_attr_parse_nested(nest, nftnl_rule_parse_compat_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_RULE_COMPAT_PROTO]) {
+		r->compat.proto =
+			ntohl(mnl_attr_get_u32(tb[NFTA_RULE_COMPAT_PROTO]));
+		r->flags |= (1 << NFTNL_RULE_COMPAT_PROTO);
+	}
+	if (tb[NFTA_RULE_COMPAT_FLAGS]) {
+		r->compat.flags =
+			ntohl(mnl_attr_get_u32(tb[NFTA_RULE_COMPAT_FLAGS]));
+		r->flags |= (1 << NFTNL_RULE_COMPAT_FLAGS);
+	}
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_rule_nlmsg_parse);
+int nftnl_rule_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_rule *r)
+{
+	struct nlattr *tb[NFTA_RULE_MAX+1] = {};
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	int ret;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_rule_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_RULE_TABLE]) {
+		if (r->flags & (1 << NFTNL_RULE_TABLE))
+			xfree(r->table);
+		r->table = strdup(mnl_attr_get_str(tb[NFTA_RULE_TABLE]));
+		if (!r->table)
+			return -1;
+		r->flags |= (1 << NFTNL_RULE_TABLE);
+	}
+	if (tb[NFTA_RULE_CHAIN]) {
+		if (r->flags & (1 << NFTNL_RULE_CHAIN))
+			xfree(r->chain);
+		r->chain = strdup(mnl_attr_get_str(tb[NFTA_RULE_CHAIN]));
+		if (!r->chain)
+			return -1;
+		r->flags |= (1 << NFTNL_RULE_CHAIN);
+	}
+	if (tb[NFTA_RULE_HANDLE]) {
+		r->handle = be64toh(mnl_attr_get_u64(tb[NFTA_RULE_HANDLE]));
+		r->flags |= (1 << NFTNL_RULE_HANDLE);
+	}
+	if (tb[NFTA_RULE_EXPRESSIONS]) {
+		ret = nftnl_rule_parse_expr(tb[NFTA_RULE_EXPRESSIONS], r);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_RULE_COMPAT]) {
+		ret = nftnl_rule_parse_compat(tb[NFTA_RULE_COMPAT], r);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_RULE_POSITION]) {
+		r->position = be64toh(mnl_attr_get_u64(tb[NFTA_RULE_POSITION]));
+		r->flags |= (1 << NFTNL_RULE_POSITION);
+	}
+	if (tb[NFTA_RULE_USERDATA]) {
+		const void *udata =
+			mnl_attr_get_payload(tb[NFTA_RULE_USERDATA]);
+
+		if (r->flags & (1 << NFTNL_RULE_USERDATA))
+			xfree(r->user.data);
+
+		r->user.len = mnl_attr_get_payload_len(tb[NFTA_RULE_USERDATA]);
+
+		r->user.data = malloc(r->user.len);
+		if (r->user.data == NULL)
+			return -1;
+
+		memcpy(r->user.data, udata, r->user.len);
+		r->flags |= (1 << NFTNL_RULE_USERDATA);
+	}
+	if (tb[NFTA_RULE_ID]) {
+		r->id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_ID]));
+		r->flags |= (1 << NFTNL_RULE_ID);
+	}
+	if (tb[NFTA_RULE_POSITION_ID]) {
+		r->position_id = ntohl(mnl_attr_get_u32(tb[NFTA_RULE_POSITION_ID]));
+		r->flags |= (1 << NFTNL_RULE_POSITION_ID);
+	}
+
+	r->family = nfg->nfgen_family;
+	r->flags |= (1 << NFTNL_RULE_FAMILY);
+
+	return 0;
+}
+
+static int nftnl_rule_do_parse(struct nftnl_rule *r, enum nftnl_parse_type type,
+			     const void *data, struct nftnl_parse_err *err,
+			     enum nftnl_parse_input input)
+{
+	int ret;
+	struct nftnl_parse_err perr = {};
+
+	switch (type) {
+	case NFTNL_PARSE_JSON:
+	case NFTNL_PARSE_XML:
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+	if (err != NULL)
+		*err = perr;
+
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_rule_parse);
+int nftnl_rule_parse(struct nftnl_rule *r, enum nftnl_parse_type type,
+		   const char *data, struct nftnl_parse_err *err)
+{
+	return nftnl_rule_do_parse(r, type, data, err, NFTNL_PARSE_BUFFER);
+}
+
+EXPORT_SYMBOL(nftnl_rule_parse_file);
+int nftnl_rule_parse_file(struct nftnl_rule *r, enum nftnl_parse_type type,
+			FILE *fp, struct nftnl_parse_err *err)
+{
+	return nftnl_rule_do_parse(r, type, fp, err, NFTNL_PARSE_FILE);
+}
+
+static int nftnl_rule_snprintf_default(char *buf, size_t remain,
+				       const struct nftnl_rule *r,
+				       uint32_t type, uint32_t flags)
+{
+	struct nftnl_expr *expr;
+	int ret, offset = 0, i;
+	const char *sep = "";
+
+	if (r->flags & (1 << NFTNL_RULE_FAMILY)) {
+		ret = snprintf(buf + offset, remain, "%s%s", sep,
+			       nftnl_family2str(r->family));
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+
+	if (r->flags & (1 << NFTNL_RULE_TABLE)) {
+		ret = snprintf(buf + offset, remain, "%s%s", sep,
+			       r->table);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+
+	if (r->flags & (1 << NFTNL_RULE_CHAIN)) {
+		ret = snprintf(buf + offset, remain, "%s%s", sep,
+			       r->chain);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+	if (r->flags & (1 << NFTNL_RULE_HANDLE)) {
+		ret = snprintf(buf + offset, remain, "%s%" PRIu64, sep,
+			       r->handle);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+
+	if (r->flags & (1 << NFTNL_RULE_POSITION)) {
+		ret = snprintf(buf + offset, remain, "%s%" PRIu64, sep,
+			       r->position);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+
+	if (r->flags & (1 << NFTNL_RULE_ID)) {
+		ret = snprintf(buf + offset, remain, "%s%u", sep, r->id);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+
+	if (r->flags & (1 << NFTNL_RULE_POSITION_ID)) {
+		ret = snprintf(buf + offset, remain, "%s%u", sep,
+			       r->position_id);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		sep = " ";
+	}
+
+	ret = snprintf(buf + offset, remain, "\n");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	list_for_each_entry(expr, &r->expr_list, head) {
+		ret = snprintf(buf + offset, remain, "  [ %s ", expr->ops->name);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_expr_snprintf(buf + offset, remain, expr,
+					     type, flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = snprintf(buf + offset, remain, "]\n");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (r->user.len) {
+		ret = snprintf(buf + offset, remain, "  userdata = { ");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		for (i = 0; i < r->user.len; i++) {
+			char *c = r->user.data;
+
+			ret = snprintf(buf + offset, remain,
+				       isprint(c[i]) ? "%c" : "\\x%02hhx",
+				       c[i]);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+
+		ret = snprintf(buf + offset, remain, " }");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	}
+
+	return offset;
+}
+
+static int nftnl_rule_cmd_snprintf(char *buf, size_t remain,
+				   const struct nftnl_rule *r, uint32_t cmd,
+				   uint32_t type, uint32_t flags)
+{
+	uint32_t inner_flags = flags;
+	int ret, offset = 0;
+
+	inner_flags &= ~NFTNL_OF_EVENT_ANY;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = nftnl_rule_snprintf_default(buf + offset, remain, r, type,
+					inner_flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_rule_snprintf);
+int nftnl_rule_snprintf(char *buf, size_t size, const struct nftnl_rule *r,
+			uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_rule_cmd_snprintf(buf, size, r, nftnl_flag2cmd(flags), type,
+				     flags);
+}
+
+static int nftnl_rule_do_snprintf(char *buf, size_t size, const void *r,
+				  uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_rule_snprintf(buf, size, r, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_rule_fprintf);
+int nftnl_rule_fprintf(FILE *fp, const struct nftnl_rule *r, uint32_t type,
+		       uint32_t flags)
+{
+	return nftnl_fprintf(fp, r, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_rule_do_snprintf);
+}
+
+EXPORT_SYMBOL(nftnl_expr_foreach);
+int nftnl_expr_foreach(struct nftnl_rule *r,
+                          int (*cb)(struct nftnl_expr *e, void *data),
+                          void *data)
+{
+       struct nftnl_expr *cur, *tmp;
+       int ret;
+
+       list_for_each_entry_safe(cur, tmp, &r->expr_list, head) {
+               ret = cb(cur, data);
+               if (ret < 0)
+                       return ret;
+       }
+       return 0;
+}
+
+struct nftnl_expr_iter {
+	const struct nftnl_rule	*r;
+	struct nftnl_expr	*cur;
+};
+
+static void nftnl_expr_iter_init(const struct nftnl_rule *r,
+				 struct nftnl_expr_iter *iter)
+{
+	iter->r = r;
+	if (list_empty(&r->expr_list))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(r->expr_list.next, struct nftnl_expr,
+				       head);
+}
+
+EXPORT_SYMBOL(nftnl_expr_iter_create);
+struct nftnl_expr_iter *nftnl_expr_iter_create(const struct nftnl_rule *r)
+{
+	struct nftnl_expr_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_expr_iter));
+	if (iter == NULL)
+		return NULL;
+
+	nftnl_expr_iter_init(r, iter);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_expr_iter_next);
+struct nftnl_expr *nftnl_expr_iter_next(struct nftnl_expr_iter *iter)
+{
+	struct nftnl_expr *expr = iter->cur;
+
+	if (expr == NULL)
+		return NULL;
+
+	/* get next expression, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_expr, head);
+	if (&iter->cur->head == iter->r->expr_list.next)
+		return NULL;
+
+	return expr;
+}
+
+EXPORT_SYMBOL(nftnl_expr_iter_destroy);
+void nftnl_expr_iter_destroy(struct nftnl_expr_iter *iter)
+{
+	xfree(iter);
+}
+
+struct nftnl_rule_list {
+	struct list_head list;
+};
+
+EXPORT_SYMBOL(nftnl_rule_list_alloc);
+struct nftnl_rule_list *nftnl_rule_list_alloc(void)
+{
+	struct nftnl_rule_list *list;
+
+	list = calloc(1, sizeof(struct nftnl_rule_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+
+	return list;
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_free);
+void nftnl_rule_list_free(struct nftnl_rule_list *list)
+{
+	struct nftnl_rule *r, *tmp;
+
+	list_for_each_entry_safe(r, tmp, &list->list, head) {
+		list_del(&r->head);
+		nftnl_rule_free(r);
+	}
+	xfree(list);
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_is_empty);
+int nftnl_rule_list_is_empty(const struct nftnl_rule_list *list)
+{
+	return list_empty(&list->list);
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_add);
+void nftnl_rule_list_add(struct nftnl_rule *r, struct nftnl_rule_list *list)
+{
+	list_add(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_insert_at);
+void nftnl_rule_list_insert_at(struct nftnl_rule *r, struct nftnl_rule *pos)
+{
+	list_add(&r->head, &pos->head);
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_add_tail);
+void nftnl_rule_list_add_tail(struct nftnl_rule *r, struct nftnl_rule_list *list)
+{
+	list_add_tail(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_del);
+void nftnl_rule_list_del(struct nftnl_rule *r)
+{
+	list_del(&r->head);
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_foreach);
+int nftnl_rule_list_foreach(struct nftnl_rule_list *rule_list,
+			  int (*cb)(struct nftnl_rule *r, void *data),
+			  void *data)
+{
+	struct nftnl_rule *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &rule_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+struct nftnl_rule_list_iter {
+	const struct nftnl_rule_list	*list;
+	struct nftnl_rule		*cur;
+};
+
+EXPORT_SYMBOL(nftnl_rule_list_iter_create);
+struct nftnl_rule_list_iter *
+nftnl_rule_list_iter_create(const struct nftnl_rule_list *l)
+{
+	struct nftnl_rule_list_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_rule_list_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->list = l;
+	if (nftnl_rule_list_is_empty(l))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(l->list.next, struct nftnl_rule, head);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_iter_cur);
+struct nftnl_rule *nftnl_rule_list_iter_cur(struct nftnl_rule_list_iter *iter)
+{
+	return iter->cur;
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_iter_next);
+struct nftnl_rule *nftnl_rule_list_iter_next(struct nftnl_rule_list_iter *iter)
+{
+	struct nftnl_rule *r = iter->cur;
+
+	if (r == NULL)
+		return NULL;
+
+	/* get next rule, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_rule, head);
+	if (&iter->cur->head == iter->list->list.next)
+		return NULL;
+
+	return r;
+}
+
+EXPORT_SYMBOL(nftnl_rule_list_iter_destroy);
+void nftnl_rule_list_iter_destroy(const struct nftnl_rule_list_iter *iter)
+{
+	xfree(iter);
+}
diff --git a/src/ruleset.c b/src/ruleset.c
new file mode 100644
index 0000000..185aa48
--- /dev/null
+++ b/src/ruleset.c
@@ -0,0 +1,719 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2013 by Arturo Borrero Gonzalez <arturo@debian.org>
+ * (C) 2013 by Alvaro Neira Ayuso <alvaroneay@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+
+#include <errno.h>
+
+#include "internal.h"
+#include <stdlib.h>
+
+#include <libmnl/libmnl.h>
+#include <libnftnl/ruleset.h>
+#include <libnftnl/table.h>
+#include <libnftnl/chain.h>
+#include <libnftnl/set.h>
+#include <libnftnl/rule.h>
+
+struct nftnl_ruleset {
+	struct nftnl_table_list	*table_list;
+	struct nftnl_chain_list	*chain_list;
+	struct nftnl_set_list	*set_list;
+	struct nftnl_rule_list	*rule_list;
+
+	uint16_t		flags;
+};
+
+struct nftnl_parse_ctx {
+	enum nftnl_cmd_type cmd;
+	enum nftnl_ruleset_type type;
+	union {
+		struct nftnl_table	*table;
+		struct nftnl_chain	*chain;
+		struct nftnl_rule		*rule;
+		struct nftnl_set		*set;
+		struct nftnl_set_elem	*set_elem;
+	};
+	void *data;
+
+	/* These fields below are not exposed to the user */
+	uint32_t format;
+	uint32_t set_id;
+	struct nftnl_set_list *set_list;
+
+	int (*cb)(const struct nftnl_parse_ctx *ctx);
+	uint16_t flags;
+};
+
+EXPORT_SYMBOL(nftnl_ruleset_alloc);
+struct nftnl_ruleset *nftnl_ruleset_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_ruleset));
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_free);
+void nftnl_ruleset_free(const struct nftnl_ruleset *r)
+{
+	if (r->flags & (1 << NFTNL_RULESET_TABLELIST))
+		nftnl_table_list_free(r->table_list);
+	if (r->flags & (1 << NFTNL_RULESET_CHAINLIST))
+		nftnl_chain_list_free(r->chain_list);
+	if (r->flags & (1 << NFTNL_RULESET_SETLIST))
+		nftnl_set_list_free(r->set_list);
+	if (r->flags & (1 << NFTNL_RULESET_RULELIST))
+		nftnl_rule_list_free(r->rule_list);
+	xfree(r);
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_is_set);
+bool nftnl_ruleset_is_set(const struct nftnl_ruleset *r, uint16_t attr)
+{
+	return r->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_unset);
+void nftnl_ruleset_unset(struct nftnl_ruleset *r, uint16_t attr)
+{
+	if (!(r->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_RULESET_TABLELIST:
+		nftnl_table_list_free(r->table_list);
+		break;
+	case NFTNL_RULESET_CHAINLIST:
+		nftnl_chain_list_free(r->chain_list);
+		break;
+	case NFTNL_RULESET_SETLIST:
+		nftnl_set_list_free(r->set_list);
+		break;
+	case NFTNL_RULESET_RULELIST:
+		nftnl_rule_list_free(r->rule_list);
+		break;
+	}
+	r->flags &= ~(1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_set);
+void nftnl_ruleset_set(struct nftnl_ruleset *r, uint16_t attr, void *data)
+{
+	switch (attr) {
+	case NFTNL_RULESET_TABLELIST:
+		nftnl_ruleset_unset(r, NFTNL_RULESET_TABLELIST);
+		r->table_list = data;
+		break;
+	case NFTNL_RULESET_CHAINLIST:
+		nftnl_ruleset_unset(r, NFTNL_RULESET_CHAINLIST);
+		r->chain_list = data;
+		break;
+	case NFTNL_RULESET_SETLIST:
+		nftnl_ruleset_unset(r, NFTNL_RULESET_SETLIST);
+		r->set_list = data;
+		break;
+	case NFTNL_RULESET_RULELIST:
+		nftnl_ruleset_unset(r, NFTNL_RULESET_RULELIST);
+		r->rule_list = data;
+		break;
+	default:
+		return;
+	}
+	r->flags |= (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_get);
+void *nftnl_ruleset_get(const struct nftnl_ruleset *r, uint16_t attr)
+{
+	if (!(r->flags & (1 << attr)))
+		return NULL;
+
+	switch (attr) {
+	case NFTNL_RULESET_TABLELIST:
+		return r->table_list;
+	case NFTNL_RULESET_CHAINLIST:
+		return r->chain_list;
+	case NFTNL_RULESET_SETLIST:
+		return r->set_list;
+	case NFTNL_RULESET_RULELIST:
+		return r->rule_list;
+	default:
+		return NULL;
+	}
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_ctx_free);
+void nftnl_ruleset_ctx_free(const struct nftnl_parse_ctx *ctx)
+{
+	switch (ctx->type) {
+	case NFTNL_RULESET_TABLE:
+		nftnl_table_free(ctx->table);
+		break;
+	case NFTNL_RULESET_CHAIN:
+		nftnl_chain_free(ctx->chain);
+		break;
+	case NFTNL_RULESET_RULE:
+		nftnl_rule_free(ctx->rule);
+		break;
+	case NFTNL_RULESET_SET:
+	case NFTNL_RULESET_SET_ELEMS:
+		nftnl_set_free(ctx->set);
+		break;
+	case NFTNL_RULESET_RULESET:
+	case NFTNL_RULESET_UNSPEC:
+		break;
+	}
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_ctx_is_set);
+bool nftnl_ruleset_ctx_is_set(const struct nftnl_parse_ctx *ctx, uint16_t attr)
+{
+	return ctx->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_ctx_get);
+void *nftnl_ruleset_ctx_get(const struct nftnl_parse_ctx *ctx, uint16_t attr)
+{
+	if (!(ctx->flags & (1 << attr)))
+		return NULL;
+
+	switch (attr) {
+	case NFTNL_RULESET_CTX_CMD:
+		return (void *)&ctx->cmd;
+	case NFTNL_RULESET_CTX_TYPE:
+		return (void *)&ctx->type;
+	case NFTNL_RULESET_CTX_TABLE:
+		return ctx->table;
+	case NFTNL_RULESET_CTX_CHAIN:
+		return ctx->chain;
+	case NFTNL_RULESET_CTX_RULE:
+		return ctx->rule;
+	case NFTNL_RULESET_CTX_SET:
+		return ctx->set;
+	case NFTNL_RULESET_CTX_DATA:
+		return ctx->data;
+	default:
+		return NULL;
+	}
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_ctx_get_u32);
+uint32_t nftnl_ruleset_ctx_get_u32(const struct nftnl_parse_ctx *ctx, uint16_t attr)
+{
+	const void *ret = nftnl_ruleset_ctx_get(ctx, attr);
+	return ret == NULL ? 0 : *((uint32_t *)ret);
+}
+
+
+EXPORT_SYMBOL(nftnl_ruleset_parse_file_cb);
+int nftnl_ruleset_parse_file_cb(enum nftnl_parse_type type, FILE *fp,
+			      struct nftnl_parse_err *err, void *data,
+			      int (*cb)(const struct nftnl_parse_ctx *ctx))
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_parse_buffer_cb);
+int nftnl_ruleset_parse_buffer_cb(enum nftnl_parse_type type, const char *buffer,
+				struct nftnl_parse_err *err, void *data,
+				int (*cb)(const struct nftnl_parse_ctx *ctx))
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+static int nftnl_ruleset_cb(const struct nftnl_parse_ctx *ctx)
+{
+	struct nftnl_ruleset *r = ctx->data;
+
+	if (ctx->cmd != NFTNL_CMD_ADD)
+		return -1;
+
+	switch (ctx->type) {
+	case NFTNL_RULESET_TABLE:
+		if (r->table_list == NULL) {
+			r->table_list = nftnl_table_list_alloc();
+			if (r->table_list == NULL)
+				return -1;
+
+			nftnl_ruleset_set(r, NFTNL_RULESET_TABLELIST,
+					     r->table_list);
+		}
+		nftnl_table_list_add_tail(ctx->table, r->table_list);
+		break;
+	case NFTNL_RULESET_CHAIN:
+		if (r->chain_list == NULL) {
+			r->chain_list = nftnl_chain_list_alloc();
+			if (r->chain_list == NULL)
+				return -1;
+
+			nftnl_ruleset_set(r, NFTNL_RULESET_CHAINLIST,
+					     r->chain_list);
+		}
+		nftnl_chain_list_add_tail(ctx->chain, r->chain_list);
+		break;
+	case NFTNL_RULESET_SET:
+		if (r->set_list == NULL) {
+			r->set_list = nftnl_set_list_alloc();
+			if (r->set_list == NULL)
+				return -1;
+
+			nftnl_ruleset_set(r, NFTNL_RULESET_SETLIST,
+					     r->set_list);
+		}
+		nftnl_set_list_add_tail(ctx->set, r->set_list);
+		break;
+	case NFTNL_RULESET_RULE:
+		if (r->rule_list == NULL) {
+			r->rule_list = nftnl_rule_list_alloc();
+			if (r->rule_list == NULL)
+				return -1;
+
+			nftnl_ruleset_set(r, NFTNL_RULESET_RULELIST,
+					     r->rule_list);
+		}
+		nftnl_rule_list_add_tail(ctx->rule, r->rule_list);
+		break;
+	case NFTNL_RULESET_RULESET:
+		break;
+	default:
+		return -1;
+	}
+
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_parse);
+int nftnl_ruleset_parse(struct nftnl_ruleset *r, enum nftnl_parse_type type,
+		      const char *data, struct nftnl_parse_err *err)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_parse_file);
+int nftnl_ruleset_parse_file(struct nftnl_ruleset *rs, enum nftnl_parse_type type,
+			   FILE *fp, struct nftnl_parse_err *err)
+{
+	return nftnl_ruleset_parse_file_cb(type, fp, err, rs, nftnl_ruleset_cb);
+}
+
+static int
+nftnl_ruleset_snprintf_table(char *buf, size_t remain,
+			   const struct nftnl_ruleset *rs, uint32_t type,
+			   uint32_t flags)
+{
+	struct nftnl_table *t;
+	struct nftnl_table_list_iter *ti;
+	const char *sep = "";
+	int ret, offset = 0;
+
+	ti = nftnl_table_list_iter_create(rs->table_list);
+	if (ti == NULL)
+		return 0;
+
+	t = nftnl_table_list_iter_next(ti);
+	while (t != NULL) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_table_snprintf(buf + offset, remain, t, type, flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		t = nftnl_table_list_iter_next(ti);
+		sep = "\n";
+	}
+	nftnl_table_list_iter_destroy(ti);
+
+	return offset;
+}
+
+static int
+nftnl_ruleset_snprintf_chain(char *buf, size_t remain,
+			   const struct nftnl_ruleset *rs, uint32_t type,
+			   uint32_t flags)
+{
+	struct nftnl_chain *c;
+	struct nftnl_chain_list_iter *ci;
+	const char *sep = "";
+	int ret, offset = 0;
+
+	ci = nftnl_chain_list_iter_create(rs->chain_list);
+	if (ci == NULL)
+		return 0;
+
+	c = nftnl_chain_list_iter_next(ci);
+	while (c != NULL) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_chain_snprintf(buf + offset, remain, c, type, flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		c = nftnl_chain_list_iter_next(ci);
+		sep = "\n";
+	}
+	nftnl_chain_list_iter_destroy(ci);
+
+	return offset;
+}
+
+static int
+nftnl_ruleset_snprintf_set(char *buf, size_t remain,
+			 const struct nftnl_ruleset *rs, uint32_t type,
+			 uint32_t flags)
+{
+	struct nftnl_set *s;
+	struct nftnl_set_list_iter *si;
+	const char *sep = "";
+	int ret, offset = 0;
+
+	si = nftnl_set_list_iter_create(rs->set_list);
+	if (si == NULL)
+		return 0;
+
+	s = nftnl_set_list_iter_next(si);
+	while (s != NULL) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_set_snprintf(buf + offset, remain, s, type, flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		s = nftnl_set_list_iter_next(si);
+		sep = "\n";
+	}
+	nftnl_set_list_iter_destroy(si);
+
+	return offset;
+}
+
+static int
+nftnl_ruleset_snprintf_rule(char *buf, size_t remain,
+			  const struct nftnl_ruleset *rs, uint32_t type,
+			  uint32_t flags)
+{
+	struct nftnl_rule *r;
+	struct nftnl_rule_list_iter *ri;
+	const char *sep = "";
+	int ret, offset = 0;
+
+	ri = nftnl_rule_list_iter_create(rs->rule_list);
+	if (ri == NULL)
+		return 0;
+
+	r = nftnl_rule_list_iter_next(ri);
+	while (r != NULL) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_rule_snprintf(buf + offset, remain, r, type, flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		r = nftnl_rule_list_iter_next(ri);
+		sep = "\n";
+	}
+	nftnl_rule_list_iter_destroy(ri);
+
+	return offset;
+}
+
+static int
+nftnl_ruleset_do_snprintf(char *buf, size_t remain,
+			  const struct nftnl_ruleset *rs,
+			  uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	uint32_t inner_flags = flags;
+	const char *sep = "";
+	int ret, offset = 0;
+
+	/* dont pass events flags to child calls of _snprintf() */
+	inner_flags &= ~NFTNL_OF_EVENT_ANY;
+
+	if (nftnl_ruleset_is_set(rs, NFTNL_RULESET_TABLELIST) &&
+	    (!nftnl_table_list_is_empty(rs->table_list))) {
+		ret = nftnl_ruleset_snprintf_table(buf + offset, remain, rs,
+						 type, inner_flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (ret > 0)
+			sep = "\n";
+	}
+
+	if (nftnl_ruleset_is_set(rs, NFTNL_RULESET_CHAINLIST) &&
+	    (!nftnl_chain_list_is_empty(rs->chain_list))) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_ruleset_snprintf_chain(buf + offset, remain, rs,
+						 type, inner_flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (ret > 0)
+			sep = "\n";
+	}
+
+	if (nftnl_ruleset_is_set(rs, NFTNL_RULESET_SETLIST) &&
+	    (!nftnl_set_list_is_empty(rs->set_list))) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_ruleset_snprintf_set(buf + offset, remain, rs,
+					       type, inner_flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		if (ret > 0)
+			sep = "\n";
+	}
+
+	if (nftnl_ruleset_is_set(rs, NFTNL_RULESET_RULELIST) &&
+	    (!nftnl_rule_list_is_empty(rs->rule_list))) {
+		ret = snprintf(buf + offset, remain, "%s", sep);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_ruleset_snprintf_rule(buf + offset, remain, rs,
+						type, inner_flags);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_snprintf);
+int nftnl_ruleset_snprintf(char *buf, size_t size, const struct nftnl_ruleset *r,
+			 uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	if (type != NFTNL_OUTPUT_DEFAULT) {
+		errno = EOPNOTSUPP;
+		return -1;
+	}
+	return nftnl_ruleset_do_snprintf(buf, size, r, nftnl_flag2cmd(flags),
+					 type, flags);
+}
+
+static int nftnl_ruleset_fprintf_tables(FILE *fp, const struct nftnl_ruleset *rs,
+				      uint32_t type, uint32_t flags)
+{
+	int len = 0, ret = 0;
+	struct nftnl_table *t;
+	struct nftnl_table_list_iter *ti;
+	const char *sep = "";
+
+	ti = nftnl_table_list_iter_create(rs->table_list);
+	if (ti == NULL)
+		return -1;
+
+	t = nftnl_table_list_iter_next(ti);
+	while (t != NULL) {
+		ret = fprintf(fp, "%s", sep);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		ret = nftnl_table_fprintf(fp, t, type, flags);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		t = nftnl_table_list_iter_next(ti);
+		sep = "\n";
+
+	}
+	nftnl_table_list_iter_destroy(ti);
+
+	return len;
+err:
+	nftnl_table_list_iter_destroy(ti);
+	return -1;
+}
+
+static int nftnl_ruleset_fprintf_chains(FILE *fp, const struct nftnl_ruleset *rs,
+				      uint32_t type, uint32_t flags)
+{
+	int len = 0, ret = 0;
+	struct nftnl_chain *o;
+	struct nftnl_chain_list_iter *i;
+	const char *sep = "";
+
+	i = nftnl_chain_list_iter_create(rs->chain_list);
+	if (i == NULL)
+		return -1;
+
+	o = nftnl_chain_list_iter_next(i);
+	while (o != NULL) {
+		ret = fprintf(fp, "%s", sep);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		ret = nftnl_chain_fprintf(fp, o, type, flags);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		o = nftnl_chain_list_iter_next(i);
+		sep = "\n";
+	}
+	nftnl_chain_list_iter_destroy(i);
+
+	return len;
+err:
+	nftnl_chain_list_iter_destroy(i);
+	return -1;
+}
+
+static int nftnl_ruleset_fprintf_sets(FILE *fp, const struct nftnl_ruleset *rs,
+				    uint32_t type, uint32_t flags)
+{
+	int len = 0, ret = 0;
+	struct nftnl_set *o;
+	struct nftnl_set_list_iter *i;
+	const char *sep = "";
+
+	i = nftnl_set_list_iter_create(rs->set_list);
+	if (i == NULL)
+		return -1;
+
+	o = nftnl_set_list_iter_next(i);
+	while (o != NULL) {
+		ret = fprintf(fp, "%s", sep);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		ret = nftnl_set_fprintf(fp, o, type, flags);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		o = nftnl_set_list_iter_next(i);
+		sep = "\n";
+	}
+	nftnl_set_list_iter_destroy(i);
+
+	return len;
+err:
+	nftnl_set_list_iter_destroy(i);
+	return -1;
+}
+
+static int nftnl_ruleset_fprintf_rules(FILE *fp, const struct nftnl_ruleset *rs,
+				    uint32_t type, uint32_t flags)
+{
+	int len = 0, ret = 0;
+	struct nftnl_rule *o;
+	struct nftnl_rule_list_iter *i;
+	const char *sep = "";
+
+	i = nftnl_rule_list_iter_create(rs->rule_list);
+	if (i == NULL)
+		return -1;
+
+	o = nftnl_rule_list_iter_next(i);
+	while (o != NULL) {
+		ret = fprintf(fp, "%s", sep);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		ret = nftnl_rule_fprintf(fp, o, type, flags);
+		if (ret < 0)
+			goto err;
+
+		len += ret;
+
+		o = nftnl_rule_list_iter_next(i);
+		sep = "\n";
+	}
+	nftnl_rule_list_iter_destroy(i);
+
+	return len;
+err:
+	nftnl_rule_list_iter_destroy(i);
+	return -1;
+}
+
+#define NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len)	\
+	if (ret < 0)				\
+		return -1;			\
+	len += ret;
+
+static int nftnl_ruleset_cmd_fprintf(FILE *fp, const struct nftnl_ruleset *rs,
+				   uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	int len = 0, ret = 0;
+	uint32_t inner_flags = flags;
+	const char *sep = "";
+
+	/* dont pass events flags to child calls of _snprintf() */
+	inner_flags &= ~NFTNL_OF_EVENT_ANY;
+
+	if ((nftnl_ruleset_is_set(rs, NFTNL_RULESET_TABLELIST)) &&
+	    (!nftnl_table_list_is_empty(rs->table_list))) {
+		ret = nftnl_ruleset_fprintf_tables(fp, rs, type, inner_flags);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+
+		if (ret > 0)
+			sep = "\n";
+	}
+
+	if ((nftnl_ruleset_is_set(rs, NFTNL_RULESET_CHAINLIST)) &&
+	    (!nftnl_chain_list_is_empty(rs->chain_list))) {
+		ret = fprintf(fp, "%s", sep);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+
+		ret = nftnl_ruleset_fprintf_chains(fp, rs, type, inner_flags);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+
+		if (ret > 0)
+			sep = "\n";
+	}
+
+	if ((nftnl_ruleset_is_set(rs, NFTNL_RULESET_SETLIST)) &&
+	    (!nftnl_set_list_is_empty(rs->set_list))) {
+		ret = fprintf(fp, "%s", sep);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+
+		ret = nftnl_ruleset_fprintf_sets(fp, rs, type, inner_flags);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+
+		if (ret > 0)
+			sep = "\n";
+	}
+
+	if ((nftnl_ruleset_is_set(rs, NFTNL_RULESET_RULELIST)) &&
+	    (!nftnl_rule_list_is_empty(rs->rule_list))) {
+		ret = fprintf(fp, "%s", sep);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+
+		ret = nftnl_ruleset_fprintf_rules(fp, rs, type, inner_flags);
+		NFTNL_FPRINTF_RETURN_OR_FIXLEN(ret, len);
+	}
+
+	return len;
+}
+
+EXPORT_SYMBOL(nftnl_ruleset_fprintf);
+int nftnl_ruleset_fprintf(FILE *fp, const struct nftnl_ruleset *rs, uint32_t type,
+			uint32_t flags)
+{
+	return nftnl_ruleset_cmd_fprintf(fp, rs, nftnl_flag2cmd(flags), type,
+				       flags);
+}
diff --git a/src/set.c b/src/set.c
new file mode 100644
index 0000000..c46f827
--- /dev/null
+++ b/src/set.c
@@ -0,0 +1,1066 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <inttypes.h>
+#include <netinet/in.h>
+#include <limits.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/set.h>
+#include <libnftnl/expr.h>
+
+EXPORT_SYMBOL(nftnl_set_alloc);
+struct nftnl_set *nftnl_set_alloc(void)
+{
+	struct nftnl_set *s;
+
+	s = calloc(1, sizeof(struct nftnl_set));
+	if (s == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&s->element_list);
+	INIT_LIST_HEAD(&s->expr_list);
+	return s;
+}
+
+EXPORT_SYMBOL(nftnl_set_free);
+void nftnl_set_free(const struct nftnl_set *s)
+{
+	struct nftnl_set_elem *elem, *tmp;
+	struct nftnl_expr *expr, *next;
+
+	if (s->flags & (1 << NFTNL_SET_TABLE))
+		xfree(s->table);
+	if (s->flags & (1 << NFTNL_SET_NAME))
+		xfree(s->name);
+	if (s->flags & (1 << NFTNL_SET_USERDATA))
+		xfree(s->user.data);
+
+	list_for_each_entry_safe(expr, next, &s->expr_list, head)
+		nftnl_expr_free(expr);
+
+	list_for_each_entry_safe(elem, tmp, &s->element_list, head) {
+		list_del(&elem->head);
+		nftnl_set_elem_free(elem);
+	}
+	xfree(s);
+}
+
+EXPORT_SYMBOL(nftnl_set_is_set);
+bool nftnl_set_is_set(const struct nftnl_set *s, uint16_t attr)
+{
+	return s->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_set_unset);
+void nftnl_set_unset(struct nftnl_set *s, uint16_t attr)
+{
+	struct nftnl_expr *expr, *tmp;
+
+	if (!(s->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_SET_TABLE:
+		xfree(s->table);
+		break;
+	case NFTNL_SET_NAME:
+		xfree(s->name);
+		break;
+	case NFTNL_SET_HANDLE:
+	case NFTNL_SET_FLAGS:
+	case NFTNL_SET_KEY_TYPE:
+	case NFTNL_SET_KEY_LEN:
+	case NFTNL_SET_DATA_TYPE:
+	case NFTNL_SET_DATA_LEN:
+	case NFTNL_SET_OBJ_TYPE:
+	case NFTNL_SET_FAMILY:
+	case NFTNL_SET_ID:
+	case NFTNL_SET_POLICY:
+	case NFTNL_SET_DESC_SIZE:
+	case NFTNL_SET_DESC_CONCAT:
+	case NFTNL_SET_TIMEOUT:
+	case NFTNL_SET_GC_INTERVAL:
+		break;
+	case NFTNL_SET_USERDATA:
+		xfree(s->user.data);
+		break;
+	case NFTNL_SET_EXPR:
+	case NFTNL_SET_EXPRESSIONS:
+		list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+			nftnl_expr_free(expr);
+		break;
+	default:
+		return;
+	}
+
+	s->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_set_validate[NFTNL_SET_MAX + 1] = {
+	[NFTNL_SET_HANDLE]		= sizeof(uint64_t),
+	[NFTNL_SET_FLAGS]		= sizeof(uint32_t),
+	[NFTNL_SET_KEY_TYPE]		= sizeof(uint32_t),
+	[NFTNL_SET_KEY_LEN]		= sizeof(uint32_t),
+	[NFTNL_SET_DATA_TYPE]	= sizeof(uint32_t),
+	[NFTNL_SET_DATA_LEN]		= sizeof(uint32_t),
+	[NFTNL_SET_OBJ_TYPE]		= sizeof(uint32_t),
+	[NFTNL_SET_FAMILY]		= sizeof(uint32_t),
+	[NFTNL_SET_POLICY]		= sizeof(uint32_t),
+	[NFTNL_SET_DESC_SIZE]	= sizeof(uint32_t),
+	[NFTNL_SET_TIMEOUT]		= sizeof(uint64_t),
+	[NFTNL_SET_GC_INTERVAL]	= sizeof(uint32_t),
+};
+
+EXPORT_SYMBOL(nftnl_set_set_data);
+int nftnl_set_set_data(struct nftnl_set *s, uint16_t attr, const void *data,
+		       uint32_t data_len)
+{
+	struct nftnl_expr *expr, *tmp;
+
+	nftnl_assert_attr_exists(attr, NFTNL_SET_MAX);
+	nftnl_assert_validate(data, nftnl_set_validate, attr, data_len);
+
+	switch(attr) {
+	case NFTNL_SET_TABLE:
+		if (s->flags & (1 << NFTNL_SET_TABLE))
+			xfree(s->table);
+
+		s->table = strdup(data);
+		if (!s->table)
+			return -1;
+		break;
+	case NFTNL_SET_NAME:
+		if (s->flags & (1 << NFTNL_SET_NAME))
+			xfree(s->name);
+
+		s->name = strdup(data);
+		if (!s->name)
+			return -1;
+		break;
+	case NFTNL_SET_HANDLE:
+		memcpy(&s->handle, data, sizeof(s->handle));
+		break;
+	case NFTNL_SET_FLAGS:
+		memcpy(&s->set_flags, data, sizeof(s->set_flags));
+		break;
+	case NFTNL_SET_KEY_TYPE:
+		memcpy(&s->key_type, data, sizeof(s->key_type));
+		break;
+	case NFTNL_SET_KEY_LEN:
+		memcpy(&s->key_len, data, sizeof(s->key_len));
+		break;
+	case NFTNL_SET_DATA_TYPE:
+		memcpy(&s->data_type, data, sizeof(s->data_type));
+		break;
+	case NFTNL_SET_DATA_LEN:
+		memcpy(&s->data_len, data, sizeof(s->data_len));
+		break;
+	case NFTNL_SET_OBJ_TYPE:
+		memcpy(&s->obj_type, data, sizeof(s->obj_type));
+		break;
+	case NFTNL_SET_FAMILY:
+		memcpy(&s->family, data, sizeof(s->family));
+		break;
+	case NFTNL_SET_ID:
+		memcpy(&s->id, data, sizeof(s->id));
+		break;
+	case NFTNL_SET_POLICY:
+		memcpy(&s->policy, data, sizeof(s->policy));
+		break;
+	case NFTNL_SET_DESC_SIZE:
+		memcpy(&s->desc.size, data, sizeof(s->desc.size));
+		break;
+	case NFTNL_SET_DESC_CONCAT:
+		memcpy(&s->desc.field_len, data, data_len);
+		while (s->desc.field_len[++s->desc.field_count]);
+		break;
+	case NFTNL_SET_TIMEOUT:
+		memcpy(&s->timeout, data, sizeof(s->timeout));
+		break;
+	case NFTNL_SET_GC_INTERVAL:
+		memcpy(&s->gc_interval, data, sizeof(s->gc_interval));
+		break;
+	case NFTNL_SET_USERDATA:
+		if (s->flags & (1 << NFTNL_SET_USERDATA))
+			xfree(s->user.data);
+
+		s->user.data = malloc(data_len);
+		if (!s->user.data)
+			return -1;
+		memcpy(s->user.data, data, data_len);
+		s->user.len = data_len;
+		break;
+	case NFTNL_SET_EXPR:
+		list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+			nftnl_expr_free(expr);
+
+		expr = (void *)data;
+		list_add(&expr->head, &s->expr_list);
+		break;
+	}
+	s->flags |= (1 << attr);
+	return 0;
+}
+
+int nftnl_set_set(struct nftnl_set *s, uint16_t attr, const void *data) __visible;
+int nftnl_set_set(struct nftnl_set *s, uint16_t attr, const void *data)
+{
+	return nftnl_set_set_data(s, attr, data, nftnl_set_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_set_set_u32);
+void nftnl_set_set_u32(struct nftnl_set *s, uint16_t attr, uint32_t val)
+{
+	nftnl_set_set_data(s, attr, &val, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_set_set_u64);
+void nftnl_set_set_u64(struct nftnl_set *s, uint16_t attr, uint64_t val)
+{
+	nftnl_set_set_data(s, attr, &val, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_set_set_str);
+int nftnl_set_set_str(struct nftnl_set *s, uint16_t attr, const char *str)
+{
+	return nftnl_set_set_data(s, attr, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_set_get_data);
+const void *nftnl_set_get_data(const struct nftnl_set *s, uint16_t attr,
+			       uint32_t *data_len)
+{
+	struct nftnl_expr *expr;
+
+	if (!(s->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_SET_TABLE:
+		*data_len = strlen(s->table) + 1;
+		return s->table;
+	case NFTNL_SET_NAME:
+		*data_len = strlen(s->name) + 1;
+		return s->name;
+	case NFTNL_SET_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &s->handle;
+	case NFTNL_SET_FLAGS:
+		*data_len = sizeof(uint32_t);
+		return &s->set_flags;
+	case NFTNL_SET_KEY_TYPE:
+		*data_len = sizeof(uint32_t);
+		return &s->key_type;
+	case NFTNL_SET_KEY_LEN:
+		*data_len = sizeof(uint32_t);
+		return &s->key_len;
+	case NFTNL_SET_DATA_TYPE:
+		*data_len = sizeof(uint32_t);
+		return &s->data_type;
+	case NFTNL_SET_DATA_LEN:
+		*data_len = sizeof(uint32_t);
+		return &s->data_len;
+	case NFTNL_SET_OBJ_TYPE:
+		*data_len = sizeof(uint32_t);
+		return &s->obj_type;
+	case NFTNL_SET_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &s->family;
+	case NFTNL_SET_ID:
+		*data_len = sizeof(uint32_t);
+		return &s->id;
+	case NFTNL_SET_POLICY:
+		*data_len = sizeof(uint32_t);
+		return &s->policy;
+	case NFTNL_SET_DESC_SIZE:
+		*data_len = sizeof(uint32_t);
+		return &s->desc.size;
+	case NFTNL_SET_DESC_CONCAT:
+		*data_len = s->desc.field_count;
+		return s->desc.field_len;
+	case NFTNL_SET_TIMEOUT:
+		*data_len = sizeof(uint64_t);
+		return &s->timeout;
+	case NFTNL_SET_GC_INTERVAL:
+		*data_len = sizeof(uint32_t);
+		return &s->gc_interval;
+	case NFTNL_SET_USERDATA:
+		*data_len = s->user.len;
+		return s->user.data;
+	case NFTNL_SET_EXPR:
+		list_for_each_entry(expr, &s->expr_list, head)
+			break;
+		return expr;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_set_get);
+const void *nftnl_set_get(const struct nftnl_set *s, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_set_get_data(s, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_set_get_str);
+const char *nftnl_set_get_str(const struct nftnl_set *s, uint16_t attr)
+{
+	return nftnl_set_get(s, attr);
+}
+
+EXPORT_SYMBOL(nftnl_set_get_u32);
+uint32_t nftnl_set_get_u32(const struct nftnl_set *s, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint32_t *val = nftnl_set_get_data(s, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint32_t));
+
+	return val ? *val : 0;
+}
+
+EXPORT_SYMBOL(nftnl_set_get_u64);
+uint64_t nftnl_set_get_u64(const struct nftnl_set *s, uint16_t attr)
+{
+	uint32_t data_len;
+	const uint64_t *val = nftnl_set_get_data(s, attr, &data_len);
+
+	nftnl_assert(val, attr, data_len == sizeof(uint64_t));
+
+	return val ? *val : 0;
+}
+
+struct nftnl_set *nftnl_set_clone(const struct nftnl_set *set)
+{
+	struct nftnl_set *newset;
+	struct nftnl_set_elem *elem, *newelem;
+
+	newset = nftnl_set_alloc();
+	if (newset == NULL)
+		return NULL;
+
+	memcpy(newset, set, sizeof(*set));
+
+	if (set->flags & (1 << NFTNL_SET_TABLE)) {
+		newset->table = strdup(set->table);
+		if (!newset->table)
+			goto err;
+	}
+	if (set->flags & (1 << NFTNL_SET_NAME)) {
+		newset->name = strdup(set->name);
+		if (!newset->name)
+			goto err;
+	}
+
+	INIT_LIST_HEAD(&newset->element_list);
+	list_for_each_entry(elem, &set->element_list, head) {
+		newelem = nftnl_set_elem_clone(elem);
+		if (newelem == NULL)
+			goto err;
+
+		list_add_tail(&newelem->head, &newset->element_list);
+	}
+
+	return newset;
+err:
+	nftnl_set_free(newset);
+	return NULL;
+}
+
+static void nftnl_set_nlmsg_build_desc_size_payload(struct nlmsghdr *nlh,
+						    struct nftnl_set *s)
+{
+	mnl_attr_put_u32(nlh, NFTA_SET_DESC_SIZE, htonl(s->desc.size));
+}
+
+static void nftnl_set_nlmsg_build_desc_concat_payload(struct nlmsghdr *nlh,
+						      struct nftnl_set *s)
+{
+	struct nlattr *nest;
+	int i;
+
+	nest = mnl_attr_nest_start(nlh, NFTA_SET_DESC_CONCAT);
+	for (i = 0; i < NFT_REG32_COUNT && i < s->desc.field_count; i++) {
+		struct nlattr *nest_elem;
+
+		nest_elem = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
+		mnl_attr_put_u32(nlh, NFTA_SET_FIELD_LEN,
+				 htonl(s->desc.field_len[i]));
+		mnl_attr_nest_end(nlh, nest_elem);
+	}
+	mnl_attr_nest_end(nlh, nest);
+}
+
+static void
+nftnl_set_nlmsg_build_desc_payload(struct nlmsghdr *nlh, struct nftnl_set *s)
+{
+	struct nlattr *nest;
+
+	nest = mnl_attr_nest_start(nlh, NFTA_SET_DESC);
+
+	if (s->flags & (1 << NFTNL_SET_DESC_SIZE))
+		nftnl_set_nlmsg_build_desc_size_payload(nlh, s);
+	if (s->flags & (1 << NFTNL_SET_DESC_CONCAT))
+		nftnl_set_nlmsg_build_desc_concat_payload(nlh, s);
+
+	mnl_attr_nest_end(nlh, nest);
+}
+
+EXPORT_SYMBOL(nftnl_set_nlmsg_build_payload);
+void nftnl_set_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s)
+{
+	int num_exprs = 0;
+
+	if (s->flags & (1 << NFTNL_SET_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_SET_TABLE, s->table);
+	if (s->flags & (1 << NFTNL_SET_NAME))
+		mnl_attr_put_strz(nlh, NFTA_SET_NAME, s->name);
+	if (s->flags & (1 << NFTNL_SET_HANDLE))
+		mnl_attr_put_u64(nlh, NFTA_SET_HANDLE, htobe64(s->handle));
+	if (s->flags & (1 << NFTNL_SET_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_SET_FLAGS, htonl(s->set_flags));
+	if (s->flags & (1 << NFTNL_SET_KEY_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_SET_KEY_TYPE, htonl(s->key_type));
+	if (s->flags & (1 << NFTNL_SET_KEY_LEN))
+		mnl_attr_put_u32(nlh, NFTA_SET_KEY_LEN, htonl(s->key_len));
+	/* These are only used to map matching -> action (1:1) */
+	if (s->flags & (1 << NFTNL_SET_DATA_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_SET_DATA_TYPE, htonl(s->data_type));
+	if (s->flags & (1 << NFTNL_SET_DATA_LEN))
+		mnl_attr_put_u32(nlh, NFTA_SET_DATA_LEN, htonl(s->data_len));
+	if (s->flags & (1 << NFTNL_SET_OBJ_TYPE))
+		mnl_attr_put_u32(nlh, NFTA_SET_OBJ_TYPE, htonl(s->obj_type));
+	if (s->flags & (1 << NFTNL_SET_ID))
+		mnl_attr_put_u32(nlh, NFTA_SET_ID, htonl(s->id));
+	if (s->flags & (1 << NFTNL_SET_POLICY))
+		mnl_attr_put_u32(nlh, NFTA_SET_POLICY, htonl(s->policy));
+	if (s->flags & (1 << NFTNL_SET_DESC_SIZE | 1 << NFTNL_SET_DESC_CONCAT))
+		nftnl_set_nlmsg_build_desc_payload(nlh, s);
+	if (s->flags & (1 << NFTNL_SET_TIMEOUT))
+		mnl_attr_put_u64(nlh, NFTA_SET_TIMEOUT, htobe64(s->timeout));
+	if (s->flags & (1 << NFTNL_SET_GC_INTERVAL))
+		mnl_attr_put_u32(nlh, NFTA_SET_GC_INTERVAL, htonl(s->gc_interval));
+	if (s->flags & (1 << NFTNL_SET_USERDATA))
+		mnl_attr_put(nlh, NFTA_SET_USERDATA, s->user.len, s->user.data);
+	if (!list_empty(&s->expr_list)) {
+		struct nftnl_expr *expr;
+
+		list_for_each_entry(expr, &s->expr_list, head)
+			num_exprs++;
+
+		if (num_exprs == 1) {
+			struct nlattr *nest1;
+
+			nest1 = mnl_attr_nest_start(nlh, NFTA_SET_EXPR);
+			list_for_each_entry(expr, &s->expr_list, head)
+				nftnl_expr_build_payload(nlh, expr);
+
+			mnl_attr_nest_end(nlh, nest1);
+		} else if (num_exprs > 1) {
+			struct nlattr *nest1, *nest2;
+
+			nest1 = mnl_attr_nest_start(nlh, NFTA_SET_EXPRESSIONS);
+			list_for_each_entry(expr, &s->expr_list, head) {
+				nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
+				nftnl_expr_build_payload(nlh, expr);
+				mnl_attr_nest_end(nlh, nest2);
+			}
+			mnl_attr_nest_end(nlh, nest1);
+		}
+	}
+}
+
+EXPORT_SYMBOL(nftnl_set_add_expr);
+void nftnl_set_add_expr(struct nftnl_set *s, struct nftnl_expr *expr)
+{
+	list_add_tail(&expr->head, &s->expr_list);
+}
+
+EXPORT_SYMBOL(nftnl_set_expr_foreach);
+int nftnl_set_expr_foreach(const struct nftnl_set *s,
+			   int (*cb)(struct nftnl_expr *e, void *data),
+			   void *data)
+{
+	struct nftnl_expr *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &s->expr_list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+static int nftnl_set_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_SET_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_SET_TABLE:
+	case NFTA_SET_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_FLAGS:
+	case NFTA_SET_KEY_TYPE:
+	case NFTA_SET_KEY_LEN:
+	case NFTA_SET_DATA_TYPE:
+	case NFTA_SET_DATA_LEN:
+	case NFTA_SET_ID:
+	case NFTA_SET_POLICY:
+	case NFTA_SET_GC_INTERVAL:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_USERDATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_TIMEOUT:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_DESC:
+	case NFTA_SET_EXPR:
+	case NFTA_SET_EXPRESSIONS:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_set_desc_concat_field_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	struct nftnl_set *s = data;
+
+	if (type != NFTA_SET_FIELD_LEN)
+		return MNL_CB_OK;
+
+	if (mnl_attr_validate(attr, MNL_TYPE_U32))
+		return MNL_CB_ERROR;
+
+	s->desc.field_len[s->desc.field_count] = ntohl(mnl_attr_get_u32(attr));
+	s->desc.field_count++;
+
+	return MNL_CB_OK;
+}
+
+static int
+nftnl_set_desc_concat_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	struct nftnl_set *s = data;
+
+	if (type != NFTA_LIST_ELEM)
+		return MNL_CB_OK;
+
+	return mnl_attr_parse_nested(attr,
+				     nftnl_set_desc_concat_field_parse_attr_cb,
+				     s);
+}
+
+static int nftnl_set_desc_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr), err;
+	struct nftnl_set *s = data;
+
+	if (mnl_attr_type_valid(attr, NFTA_SET_DESC_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_SET_DESC_SIZE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0) {
+			abi_breakage();
+			break;
+		}
+
+		s->desc.size = ntohl(mnl_attr_get_u32(attr));
+		s->flags |= (1 << NFTNL_SET_DESC_SIZE);
+		break;
+	case NFTA_SET_DESC_CONCAT:
+		err = mnl_attr_parse_nested(attr,
+					    nftnl_set_desc_concat_parse_attr_cb,
+					    s);
+		if (err != MNL_CB_OK)
+			abi_breakage();
+
+		s->flags |= (1 << NFTNL_SET_DESC_CONCAT);
+		break;
+	default:
+		break;
+	}
+
+	return MNL_CB_OK;
+}
+
+static int nftnl_set_desc_parse(struct nftnl_set *s, const struct nlattr *attr)
+{
+	return mnl_attr_parse_nested(attr, nftnl_set_desc_parse_attr_cb, s);
+}
+
+EXPORT_SYMBOL(nftnl_set_nlmsg_parse);
+int nftnl_set_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_set *s)
+{
+	struct nlattr *tb[NFTA_SET_MAX+1] = {};
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	struct nftnl_expr *expr, *next;
+	int ret;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_set_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_SET_TABLE]) {
+		if (s->flags & (1 << NFTNL_SET_TABLE))
+			xfree(s->table);
+		s->table = strdup(mnl_attr_get_str(tb[NFTA_SET_TABLE]));
+		if (!s->table)
+			return -1;
+		s->flags |= (1 << NFTNL_SET_TABLE);
+	}
+	if (tb[NFTA_SET_NAME]) {
+		if (s->flags & (1 << NFTNL_SET_NAME))
+			xfree(s->name);
+		s->name = strdup(mnl_attr_get_str(tb[NFTA_SET_NAME]));
+		if (!s->name)
+			return -1;
+		s->flags |= (1 << NFTNL_SET_NAME);
+	}
+	if (tb[NFTA_SET_HANDLE]) {
+		s->handle = be64toh(mnl_attr_get_u64(tb[NFTA_SET_HANDLE]));
+		s->flags |= (1 << NFTNL_SET_HANDLE);
+	}
+	if (tb[NFTA_SET_FLAGS]) {
+		s->set_flags = ntohl(mnl_attr_get_u32(tb[NFTA_SET_FLAGS]));
+		s->flags |= (1 << NFTNL_SET_FLAGS);
+	}
+	if (tb[NFTA_SET_KEY_TYPE]) {
+		s->key_type = ntohl(mnl_attr_get_u32(tb[NFTA_SET_KEY_TYPE]));
+		s->flags |= (1 << NFTNL_SET_KEY_TYPE);
+	}
+	if (tb[NFTA_SET_KEY_LEN]) {
+		s->key_len = ntohl(mnl_attr_get_u32(tb[NFTA_SET_KEY_LEN]));
+		s->flags |= (1 << NFTNL_SET_KEY_LEN);
+	}
+	if (tb[NFTA_SET_DATA_TYPE]) {
+		s->data_type = ntohl(mnl_attr_get_u32(tb[NFTA_SET_DATA_TYPE]));
+		s->flags |= (1 << NFTNL_SET_DATA_TYPE);
+	}
+	if (tb[NFTA_SET_DATA_LEN]) {
+		s->data_len = ntohl(mnl_attr_get_u32(tb[NFTA_SET_DATA_LEN]));
+		s->flags |= (1 << NFTNL_SET_DATA_LEN);
+	}
+	if (tb[NFTA_SET_OBJ_TYPE]) {
+		s->obj_type = ntohl(mnl_attr_get_u32(tb[NFTA_SET_OBJ_TYPE]));
+		s->flags |= (1 << NFTNL_SET_OBJ_TYPE);
+	}
+	if (tb[NFTA_SET_ID]) {
+		s->id = ntohl(mnl_attr_get_u32(tb[NFTA_SET_ID]));
+		s->flags |= (1 << NFTNL_SET_ID);
+	}
+	if (tb[NFTA_SET_POLICY]) {
+		s->policy = ntohl(mnl_attr_get_u32(tb[NFTA_SET_POLICY]));
+		s->flags |= (1 << NFTNL_SET_POLICY);
+	}
+	if (tb[NFTA_SET_TIMEOUT]) {
+		s->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_SET_TIMEOUT]));
+		s->flags |= (1 << NFTNL_SET_TIMEOUT);
+	}
+	if (tb[NFTA_SET_GC_INTERVAL]) {
+		s->gc_interval = ntohl(mnl_attr_get_u32(tb[NFTA_SET_GC_INTERVAL]));
+		s->flags |= (1 << NFTNL_SET_GC_INTERVAL);
+	}
+	if (tb[NFTA_SET_USERDATA]) {
+		ret = nftnl_set_set_data(s, NFTNL_SET_USERDATA,
+			mnl_attr_get_payload(tb[NFTA_SET_USERDATA]),
+			mnl_attr_get_payload_len(tb[NFTA_SET_USERDATA]));
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_SET_DESC]) {
+		ret = nftnl_set_desc_parse(s, tb[NFTA_SET_DESC]);
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_SET_EXPR]) {
+		expr = nftnl_expr_parse(tb[NFTA_SET_EXPR]);
+		if (!expr)
+			goto out_set_expr;
+
+		list_add(&expr->head, &s->expr_list);
+		s->flags |= (1 << NFTNL_SET_EXPR);
+	} else if (tb[NFTA_SET_EXPRESSIONS]) {
+		struct nlattr *attr;
+
+		mnl_attr_for_each_nested(attr, tb[NFTA_SET_EXPRESSIONS]) {
+			if (mnl_attr_get_type(attr) != NFTA_LIST_ELEM)
+				goto out_set_expr;
+
+			expr = nftnl_expr_parse(attr);
+			if (expr == NULL)
+				goto out_set_expr;
+
+			list_add_tail(&expr->head, &s->expr_list);
+		}
+		s->flags |= (1 << NFTNL_SET_EXPRESSIONS);
+	}
+
+	s->family = nfg->nfgen_family;
+	s->flags |= (1 << NFTNL_SET_FAMILY);
+
+	return 0;
+out_set_expr:
+	list_for_each_entry_safe(expr, next, &s->expr_list, head)
+		nftnl_expr_free(expr);
+
+	return -1;
+}
+
+static int nftnl_set_do_parse(struct nftnl_set *s, enum nftnl_parse_type type,
+			    const void *data, struct nftnl_parse_err *err,
+			    enum nftnl_parse_input input)
+{
+	int ret;
+	struct nftnl_parse_err perr = {};
+
+	switch (type) {
+	case NFTNL_PARSE_JSON:
+	case NFTNL_PARSE_XML:
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+
+	if (err != NULL)
+		*err = perr;
+
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_set_parse);
+int nftnl_set_parse(struct nftnl_set *s, enum nftnl_parse_type type,
+		  const char *data, struct nftnl_parse_err *err)
+{
+	return nftnl_set_do_parse(s, type, data, err, NFTNL_PARSE_BUFFER);
+}
+
+EXPORT_SYMBOL(nftnl_set_parse_file);
+int nftnl_set_parse_file(struct nftnl_set *s, enum nftnl_parse_type type,
+		       FILE *fp, struct nftnl_parse_err *err)
+{
+	return nftnl_set_do_parse(s, type, fp, err, NFTNL_PARSE_FILE);
+}
+
+static int nftnl_set_snprintf_default(char *buf, size_t remain,
+				      const struct nftnl_set *s,
+				      uint32_t type, uint32_t flags)
+{
+	struct nftnl_set_elem *elem;
+	int ret, offset = 0;
+
+	ret = snprintf(buf, remain, "%s %s %x",
+			s->name, s->table, s->set_flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (s->flags & (1 << NFTNL_SET_TIMEOUT)) {
+		ret = snprintf(buf + offset, remain, " timeout %"PRIu64"ms",
+			       s->timeout);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (s->flags & (1 << NFTNL_SET_GC_INTERVAL)) {
+		ret = snprintf(buf + offset, remain, " gc_interval %ums",
+			       s->gc_interval);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (s->flags & (1 << NFTNL_SET_POLICY)) {
+		ret = snprintf(buf + offset, remain, " policy %u", s->policy);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	if (s->flags & (1 << NFTNL_SET_DESC_SIZE)) {
+		ret = snprintf(buf + offset, remain, " size %u", s->desc.size);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	/* Empty set? Skip printinf of elements */
+	if (list_empty(&s->element_list))
+		return offset;
+
+	ret = snprintf(buf + offset, remain, "\n");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	list_for_each_entry(elem, &s->element_list, head) {
+		ret = snprintf(buf + offset, remain, "\t");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_set_elem_snprintf_default(buf + offset, remain,
+						      elem);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+static int nftnl_set_cmd_snprintf(char *buf, size_t remain,
+				  const struct nftnl_set *s, uint32_t cmd,
+				  uint32_t type, uint32_t flags)
+{
+	uint32_t inner_flags = flags;
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	/* prevent set_elems to print as events */
+	inner_flags &= ~NFTNL_OF_EVENT_ANY;
+
+	ret = nftnl_set_snprintf_default(buf + offset, remain, s, type,
+					 inner_flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_set_snprintf);
+int nftnl_set_snprintf(char *buf, size_t size, const struct nftnl_set *s,
+		       uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_set_cmd_snprintf(buf, size, s, nftnl_flag2cmd(flags), type,
+				    flags);
+}
+
+static int nftnl_set_do_snprintf(char *buf, size_t size, const void *s,
+				 uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_set_snprintf(buf, size, s, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_set_fprintf);
+int nftnl_set_fprintf(FILE *fp, const struct nftnl_set *s, uint32_t type,
+		      uint32_t flags)
+{
+	return nftnl_fprintf(fp, s, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_set_do_snprintf);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_add);
+void nftnl_set_elem_add(struct nftnl_set *s, struct nftnl_set_elem *elem)
+{
+	list_add_tail(&elem->head, &s->element_list);
+}
+
+#define SET_NAME_HSIZE		512
+
+struct nftnl_set_list {
+	struct list_head list;
+	struct hlist_head name_hash[SET_NAME_HSIZE];
+};
+
+EXPORT_SYMBOL(nftnl_set_list_alloc);
+struct nftnl_set_list *nftnl_set_list_alloc(void)
+{
+	struct nftnl_set_list *list;
+	int i;
+
+	list = calloc(1, sizeof(struct nftnl_set_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+	for (i = 0; i < SET_NAME_HSIZE; i++)
+		INIT_HLIST_HEAD(&list->name_hash[i]);
+
+	return list;
+}
+
+EXPORT_SYMBOL(nftnl_set_list_free);
+void nftnl_set_list_free(struct nftnl_set_list *list)
+{
+	struct nftnl_set *s, *tmp;
+
+	list_for_each_entry_safe(s, tmp, &list->list, head) {
+		list_del(&s->head);
+		hlist_del(&s->hnode);
+		nftnl_set_free(s);
+	}
+	xfree(list);
+}
+
+EXPORT_SYMBOL(nftnl_set_list_is_empty);
+int nftnl_set_list_is_empty(const struct nftnl_set_list *list)
+{
+	return list_empty(&list->list);
+}
+
+static uint32_t djb_hash(const char *key)
+{
+	uint32_t i, hash = 5381;
+
+	for (i = 0; i < strlen(key); i++)
+		hash = ((hash << 5) + hash) + key[i];
+
+	return hash;
+}
+
+EXPORT_SYMBOL(nftnl_set_list_add);
+void nftnl_set_list_add(struct nftnl_set *s, struct nftnl_set_list *list)
+{
+	int key = djb_hash(s->name) % SET_NAME_HSIZE;
+
+	hlist_add_head(&s->hnode, &list->name_hash[key]);
+	list_add(&s->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_set_list_add_tail);
+void nftnl_set_list_add_tail(struct nftnl_set *s, struct nftnl_set_list *list)
+{
+	int key = djb_hash(s->name) % SET_NAME_HSIZE;
+
+	hlist_add_head(&s->hnode, &list->name_hash[key]);
+	list_add_tail(&s->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_set_list_del);
+void nftnl_set_list_del(struct nftnl_set *s)
+{
+	list_del(&s->head);
+	hlist_del(&s->hnode);
+}
+
+EXPORT_SYMBOL(nftnl_set_list_foreach);
+int nftnl_set_list_foreach(struct nftnl_set_list *set_list,
+			 int (*cb)(struct nftnl_set *t, void *data), void *data)
+{
+	struct nftnl_set *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &set_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+struct nftnl_set_list_iter {
+	const struct nftnl_set_list	*list;
+	struct nftnl_set		*cur;
+};
+
+EXPORT_SYMBOL(nftnl_set_list_iter_create);
+struct nftnl_set_list_iter *
+nftnl_set_list_iter_create(const struct nftnl_set_list *l)
+{
+	struct nftnl_set_list_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_set_list_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->list = l;
+	if (nftnl_set_list_is_empty(l))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(l->list.next, struct nftnl_set, head);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_set_list_iter_cur);
+struct nftnl_set *
+nftnl_set_list_iter_cur(const struct nftnl_set_list_iter *iter)
+{
+	return iter->cur;
+}
+
+EXPORT_SYMBOL(nftnl_set_list_iter_next);
+struct nftnl_set *nftnl_set_list_iter_next(struct nftnl_set_list_iter *iter)
+{
+	struct nftnl_set *s = iter->cur;
+
+	if (s == NULL)
+		return NULL;
+
+	/* get next rule, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_set, head);
+	if (&iter->cur->head == iter->list->list.next)
+		return NULL;
+
+	return s;
+}
+
+EXPORT_SYMBOL(nftnl_set_list_iter_destroy);
+void nftnl_set_list_iter_destroy(const struct nftnl_set_list_iter *iter)
+{
+	xfree(iter);
+}
+
+EXPORT_SYMBOL(nftnl_set_list_lookup_byname);
+struct nftnl_set *
+nftnl_set_list_lookup_byname(struct nftnl_set_list *set_list, const char *set)
+{
+	int key = djb_hash(set) % SET_NAME_HSIZE;
+	struct hlist_node *n;
+	struct nftnl_set *s;
+
+	hlist_for_each_entry(s, n, &set_list->name_hash[key], hnode) {
+		if (!strcmp(set, s->name))
+			return s;
+	}
+	return NULL;
+}
+
+int nftnl_set_lookup_id(struct nftnl_expr *e,
+		      struct nftnl_set_list *set_list, uint32_t *set_id)
+{
+	const char *set_name;
+	struct nftnl_set *s;
+
+	set_name = nftnl_expr_get_str(e, NFTNL_EXPR_LOOKUP_SET);
+	if (set_name == NULL)
+		return 0;
+
+	s = nftnl_set_list_lookup_byname(set_list, set_name);
+	if (s == NULL)
+		return 0;
+
+	*set_id = nftnl_set_get_u32(s, NFTNL_SET_ID);
+	return 1;
+}
diff --git a/src/set_elem.c b/src/set_elem.c
new file mode 100644
index 0000000..884faff
--- /dev/null
+++ b/src/set_elem.c
@@ -0,0 +1,918 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+#include <ctype.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/set.h>
+#include <libnftnl/rule.h>
+#include <libnftnl/expr.h>
+
+EXPORT_SYMBOL(nftnl_set_elem_alloc);
+struct nftnl_set_elem *nftnl_set_elem_alloc(void)
+{
+	struct nftnl_set_elem *s;
+
+	s = calloc(1, sizeof(struct nftnl_set_elem));
+	if (s == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&s->expr_list);
+
+	return s;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_free);
+void nftnl_set_elem_free(struct nftnl_set_elem *s)
+{
+	struct nftnl_expr *e, *tmp;
+
+	if (s->flags & (1 << NFTNL_SET_ELEM_CHAIN))
+		xfree(s->data.chain);
+
+	list_for_each_entry_safe(e, tmp, &s->expr_list, head)
+		nftnl_expr_free(e);
+
+	if (s->flags & (1 << NFTNL_SET_ELEM_USERDATA))
+		xfree(s->user.data);
+
+	if (s->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+		xfree(s->objref);
+
+	xfree(s);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_is_set);
+bool nftnl_set_elem_is_set(const struct nftnl_set_elem *s, uint16_t attr)
+{
+	return s->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_unset);
+void nftnl_set_elem_unset(struct nftnl_set_elem *s, uint16_t attr)
+{
+	struct nftnl_expr *expr, *tmp;
+
+	if (!(s->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_SET_ELEM_CHAIN:
+		xfree(s->data.chain);
+		break;
+	case NFTNL_SET_ELEM_FLAGS:
+	case NFTNL_SET_ELEM_KEY:	/* NFTA_SET_ELEM_KEY */
+	case NFTNL_SET_ELEM_KEY_END:	/* NFTA_SET_ELEM_KEY_END */
+	case NFTNL_SET_ELEM_VERDICT:	/* NFTA_SET_ELEM_DATA */
+	case NFTNL_SET_ELEM_DATA:	/* NFTA_SET_ELEM_DATA */
+	case NFTNL_SET_ELEM_TIMEOUT:	/* NFTA_SET_ELEM_TIMEOUT */
+	case NFTNL_SET_ELEM_EXPIRATION:	/* NFTA_SET_ELEM_EXPIRATION */
+		break;
+	case NFTNL_SET_ELEM_USERDATA:	/* NFTA_SET_ELEM_USERDATA */
+		xfree(s->user.data);
+		break;
+	case NFTNL_SET_ELEM_EXPR:
+	case NFTNL_SET_ELEM_EXPRESSIONS:
+		list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+			nftnl_expr_free(expr);
+		break;
+	case NFTNL_SET_ELEM_OBJREF:
+		xfree(s->objref);
+		break;
+	default:
+		return;
+	}
+
+	s->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_set_elem_validate[NFTNL_SET_ELEM_MAX + 1] = {
+	[NFTNL_SET_ELEM_FLAGS]		= sizeof(uint32_t),
+	[NFTNL_SET_ELEM_VERDICT]	= sizeof(uint32_t),
+	[NFTNL_SET_ELEM_TIMEOUT]	= sizeof(uint64_t),
+	[NFTNL_SET_ELEM_EXPIRATION]	= sizeof(uint64_t),
+};
+
+EXPORT_SYMBOL(nftnl_set_elem_set);
+int nftnl_set_elem_set(struct nftnl_set_elem *s, uint16_t attr,
+		       const void *data, uint32_t data_len)
+{
+	struct nftnl_expr *expr, *tmp;
+
+	nftnl_assert_attr_exists(attr, NFTNL_SET_ELEM_MAX);
+	nftnl_assert_validate(data, nftnl_set_elem_validate, attr, data_len);
+
+	switch(attr) {
+	case NFTNL_SET_ELEM_FLAGS:
+		memcpy(&s->set_elem_flags, data, sizeof(s->set_elem_flags));
+		break;
+	case NFTNL_SET_ELEM_KEY:	/* NFTA_SET_ELEM_KEY */
+		memcpy(&s->key.val, data, data_len);
+		s->key.len = data_len;
+		break;
+	case NFTNL_SET_ELEM_KEY_END:	/* NFTA_SET_ELEM_KEY_END */
+		memcpy(&s->key_end.val, data, data_len);
+		s->key_end.len = data_len;
+		break;
+	case NFTNL_SET_ELEM_VERDICT:	/* NFTA_SET_ELEM_DATA */
+		memcpy(&s->data.verdict, data, sizeof(s->data.verdict));
+		break;
+	case NFTNL_SET_ELEM_CHAIN:	/* NFTA_SET_ELEM_DATA */
+		if (s->flags & (1 << NFTNL_SET_ELEM_CHAIN))
+			xfree(s->data.chain);
+
+		s->data.chain = strdup(data);
+		if (!s->data.chain)
+			return -1;
+		break;
+	case NFTNL_SET_ELEM_DATA:	/* NFTA_SET_ELEM_DATA */
+		memcpy(s->data.val, data, data_len);
+		s->data.len = data_len;
+		break;
+	case NFTNL_SET_ELEM_TIMEOUT:	/* NFTA_SET_ELEM_TIMEOUT */
+		memcpy(&s->timeout, data, sizeof(s->timeout));
+		break;
+	case NFTNL_SET_ELEM_EXPIRATION:	/* NFTA_SET_ELEM_EXPIRATION */
+		memcpy(&s->expiration, data, sizeof(s->expiration));
+		break;
+	case NFTNL_SET_ELEM_USERDATA: /* NFTA_SET_ELEM_USERDATA */
+		if (s->flags & (1 << NFTNL_SET_ELEM_USERDATA))
+			xfree(s->user.data);
+
+		s->user.data = malloc(data_len);
+		if (!s->user.data)
+			return -1;
+		memcpy(s->user.data, data, data_len);
+		s->user.len = data_len;
+		break;
+	case NFTNL_SET_ELEM_OBJREF:
+		if (s->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+			xfree(s->objref);
+
+		s->objref = strdup(data);
+		if (!s->objref)
+			return -1;
+		break;
+	case NFTNL_SET_ELEM_EXPR:
+		list_for_each_entry_safe(expr, tmp, &s->expr_list, head)
+			nftnl_expr_free(expr);
+
+		expr = (void *)data;
+		list_add(&expr->head, &s->expr_list);
+		break;
+	}
+	s->flags |= (1 << attr);
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_set_u32);
+void nftnl_set_elem_set_u32(struct nftnl_set_elem *s, uint16_t attr, uint32_t val)
+{
+	nftnl_set_elem_set(s, attr, &val, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_set_u64);
+void nftnl_set_elem_set_u64(struct nftnl_set_elem *s, uint16_t attr, uint64_t val)
+{
+	nftnl_set_elem_set(s, attr, &val, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_set_str);
+int nftnl_set_elem_set_str(struct nftnl_set_elem *s, uint16_t attr, const char *str)
+{
+	return nftnl_set_elem_set(s, attr, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_get);
+const void *nftnl_set_elem_get(struct nftnl_set_elem *s, uint16_t attr, uint32_t *data_len)
+{
+	struct nftnl_expr *expr;
+
+	if (!(s->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_SET_ELEM_FLAGS:
+		*data_len = sizeof(s->set_elem_flags);
+		return &s->set_elem_flags;
+	case NFTNL_SET_ELEM_KEY:	/* NFTA_SET_ELEM_KEY */
+		*data_len = s->key.len;
+		return &s->key.val;
+	case NFTNL_SET_ELEM_KEY_END:	/* NFTA_SET_ELEM_KEY_END */
+		*data_len = s->key_end.len;
+		return &s->key_end.val;
+	case NFTNL_SET_ELEM_VERDICT:	/* NFTA_SET_ELEM_DATA */
+		*data_len = sizeof(s->data.verdict);
+		return &s->data.verdict;
+	case NFTNL_SET_ELEM_CHAIN:	/* NFTA_SET_ELEM_DATA */
+		*data_len = strlen(s->data.chain) + 1;
+		return s->data.chain;
+	case NFTNL_SET_ELEM_DATA:	/* NFTA_SET_ELEM_DATA */
+		*data_len = s->data.len;
+		return &s->data.val;
+	case NFTNL_SET_ELEM_TIMEOUT:	/* NFTA_SET_ELEM_TIMEOUT */
+		*data_len = sizeof(s->timeout);
+		return &s->timeout;
+	case NFTNL_SET_ELEM_EXPIRATION:	/* NFTA_SET_ELEM_EXPIRATION */
+		*data_len = sizeof(s->expiration);
+		return &s->expiration;
+	case NFTNL_SET_ELEM_USERDATA:
+		*data_len = s->user.len;
+		return s->user.data;
+	case NFTNL_SET_ELEM_EXPR:
+		list_for_each_entry(expr, &s->expr_list, head)
+			break;
+		return expr;
+	case NFTNL_SET_ELEM_OBJREF:
+		*data_len = strlen(s->objref) + 1;
+		return s->objref;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_get_str);
+const char *nftnl_set_elem_get_str(struct nftnl_set_elem *s, uint16_t attr)
+{
+	uint32_t size;
+
+	return nftnl_set_elem_get(s, attr, &size);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_get_u32);
+uint32_t nftnl_set_elem_get_u32(struct nftnl_set_elem *s, uint16_t attr)
+{
+	uint32_t size, val;
+
+	memcpy(&val, nftnl_set_elem_get(s, attr, &size), sizeof(val));
+
+	return val;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_get_u64);
+uint64_t nftnl_set_elem_get_u64(struct nftnl_set_elem *s, uint16_t attr)
+{
+	uint32_t size;
+	uint64_t val;
+
+	memcpy(&val, nftnl_set_elem_get(s, attr, &size), sizeof(val));
+
+	return val;
+}
+
+struct nftnl_set_elem *nftnl_set_elem_clone(struct nftnl_set_elem *elem)
+{
+	struct nftnl_set_elem *newelem;
+
+	newelem = nftnl_set_elem_alloc();
+	if (newelem == NULL)
+		return NULL;
+
+	memcpy(newelem, elem, sizeof(*elem));
+
+	if (elem->flags & (1 << NFTNL_SET_ELEM_CHAIN)) {
+		newelem->data.chain = strdup(elem->data.chain);
+		if (!newelem->data.chain)
+			goto err;
+	}
+
+	return newelem;
+err:
+	nftnl_set_elem_free(newelem);
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_nlmsg_build_payload);
+void nftnl_set_elem_nlmsg_build_payload(struct nlmsghdr *nlh,
+				      struct nftnl_set_elem *e)
+{
+	struct nftnl_expr *expr;
+	int num_exprs = 0;
+
+	if (e->flags & (1 << NFTNL_SET_ELEM_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_SET_ELEM_FLAGS, htonl(e->set_elem_flags));
+	if (e->flags & (1 << NFTNL_SET_ELEM_TIMEOUT))
+		mnl_attr_put_u64(nlh, NFTA_SET_ELEM_TIMEOUT, htobe64(e->timeout));
+	if (e->flags & (1 << NFTNL_SET_ELEM_EXPIRATION))
+		mnl_attr_put_u64(nlh, NFTA_SET_ELEM_EXPIRATION, htobe64(e->expiration));
+	if (e->flags & (1 << NFTNL_SET_ELEM_KEY)) {
+		struct nlattr *nest1;
+
+		nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_KEY);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, e->key.len, e->key.val);
+		mnl_attr_nest_end(nlh, nest1);
+	}
+	if (e->flags & (1 << NFTNL_SET_ELEM_KEY_END)) {
+		struct nlattr *nest1;
+
+		nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_KEY_END);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, e->key_end.len,
+			     e->key_end.val);
+		mnl_attr_nest_end(nlh, nest1);
+	}
+	if (e->flags & (1 << NFTNL_SET_ELEM_VERDICT)) {
+		struct nlattr *nest1, *nest2;
+
+		nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_DATA);
+		nest2 = mnl_attr_nest_start(nlh, NFTA_DATA_VERDICT);
+		mnl_attr_put_u32(nlh, NFTA_VERDICT_CODE, htonl(e->data.verdict));
+		if (e->flags & (1 << NFTNL_SET_ELEM_CHAIN))
+			mnl_attr_put_strz(nlh, NFTA_VERDICT_CHAIN, e->data.chain);
+
+		mnl_attr_nest_end(nlh, nest1);
+		mnl_attr_nest_end(nlh, nest2);
+	}
+	if (e->flags & (1 << NFTNL_SET_ELEM_DATA)) {
+		struct nlattr *nest1;
+
+		nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_DATA);
+		mnl_attr_put(nlh, NFTA_DATA_VALUE, e->data.len, e->data.val);
+		mnl_attr_nest_end(nlh, nest1);
+	}
+	if (e->flags & (1 << NFTNL_SET_ELEM_USERDATA))
+		mnl_attr_put(nlh, NFTA_SET_ELEM_USERDATA, e->user.len, e->user.data);
+	if (e->flags & (1 << NFTNL_SET_ELEM_OBJREF))
+		mnl_attr_put_strz(nlh, NFTA_SET_ELEM_OBJREF, e->objref);
+
+	if (!list_empty(&e->expr_list)) {
+		list_for_each_entry(expr, &e->expr_list, head)
+			num_exprs++;
+
+		if (num_exprs == 1) {
+			struct nlattr *nest1;
+
+			nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_EXPR);
+			list_for_each_entry(expr, &e->expr_list, head)
+				nftnl_expr_build_payload(nlh, expr);
+
+			mnl_attr_nest_end(nlh, nest1);
+		} else if (num_exprs > 1) {
+			struct nlattr *nest1, *nest2;
+
+			nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_EXPRESSIONS);
+			list_for_each_entry(expr, &e->expr_list, head) {
+				nest2 = mnl_attr_nest_start(nlh, NFTA_LIST_ELEM);
+				nftnl_expr_build_payload(nlh, expr);
+				mnl_attr_nest_end(nlh, nest2);
+			}
+			mnl_attr_nest_end(nlh, nest1);
+		}
+	}
+}
+
+static void nftnl_set_elem_nlmsg_build_def(struct nlmsghdr *nlh,
+					   const struct nftnl_set *s)
+{
+	if (s->flags & (1 << NFTNL_SET_NAME))
+		mnl_attr_put_strz(nlh, NFTA_SET_ELEM_LIST_SET, s->name);
+	if (s->flags & (1 << NFTNL_SET_ID))
+		mnl_attr_put_u32(nlh, NFTA_SET_ELEM_LIST_SET_ID, htonl(s->id));
+	if (s->flags & (1 << NFTNL_SET_TABLE))
+		mnl_attr_put_strz(nlh, NFTA_SET_ELEM_LIST_TABLE, s->table);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_nlmsg_build);
+struct nlattr *nftnl_set_elem_nlmsg_build(struct nlmsghdr *nlh,
+					  struct nftnl_set_elem *elem, int i)
+{
+	struct nlattr *nest2;
+
+	nest2 = mnl_attr_nest_start(nlh, i);
+	nftnl_set_elem_nlmsg_build_payload(nlh, elem);
+	mnl_attr_nest_end(nlh, nest2);
+
+	return nest2;
+}
+
+EXPORT_SYMBOL(nftnl_set_elems_nlmsg_build_payload);
+void nftnl_set_elems_nlmsg_build_payload(struct nlmsghdr *nlh, struct nftnl_set *s)
+{
+	struct nftnl_set_elem *elem;
+	struct nlattr *nest1;
+	int i = 0;
+
+	nftnl_set_elem_nlmsg_build_def(nlh, s);
+
+	if (list_empty(&s->element_list))
+		return;
+
+	nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_LIST_ELEMENTS);
+	list_for_each_entry(elem, &s->element_list, head)
+		nftnl_set_elem_nlmsg_build(nlh, elem, ++i);
+
+	mnl_attr_nest_end(nlh, nest1);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_add_expr);
+void nftnl_set_elem_add_expr(struct nftnl_set_elem *e, struct nftnl_expr *expr)
+{
+	list_add_tail(&expr->head, &e->expr_list);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_expr_foreach);
+int nftnl_set_elem_expr_foreach(struct nftnl_set_elem *e,
+				int (*cb)(struct nftnl_expr *e, void *data),
+				void *data)
+{
+       struct nftnl_expr *cur, *tmp;
+       int ret;
+
+	list_for_each_entry_safe(cur, tmp, &e->expr_list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+static int nftnl_set_elem_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_SET_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_SET_ELEM_FLAGS:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_ELEM_TIMEOUT:
+	case NFTA_SET_ELEM_EXPIRATION:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_ELEM_KEY:
+	case NFTA_SET_ELEM_KEY_END:
+	case NFTA_SET_ELEM_DATA:
+	case NFTA_SET_ELEM_EXPR:
+	case NFTA_SET_ELEM_EXPRESSIONS:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_ELEM_USERDATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_set_elems_parse2(struct nftnl_set *s, const struct nlattr *nest)
+{
+	struct nlattr *tb[NFTA_SET_ELEM_MAX+1] = {};
+	struct nftnl_set_elem *e;
+	int ret, type;
+
+	e = nftnl_set_elem_alloc();
+	if (e == NULL)
+		return -1;
+
+	ret = mnl_attr_parse_nested(nest, nftnl_set_elem_parse_attr_cb, tb);
+	if (ret < 0)
+		goto out_set_elem;
+
+	if (tb[NFTA_SET_ELEM_FLAGS]) {
+		e->set_elem_flags =
+			ntohl(mnl_attr_get_u32(tb[NFTA_SET_ELEM_FLAGS]));
+		e->flags |= (1 << NFTNL_SET_ELEM_FLAGS);
+	}
+	if (tb[NFTA_SET_ELEM_TIMEOUT]) {
+		e->timeout = be64toh(mnl_attr_get_u64(tb[NFTA_SET_ELEM_TIMEOUT]));
+		e->flags |= (1 << NFTNL_SET_ELEM_TIMEOUT);
+	}
+	if (tb[NFTA_SET_ELEM_EXPIRATION]) {
+		e->expiration = be64toh(mnl_attr_get_u64(tb[NFTA_SET_ELEM_EXPIRATION]));
+		e->flags |= (1 << NFTNL_SET_ELEM_EXPIRATION);
+	}
+        if (tb[NFTA_SET_ELEM_KEY]) {
+		ret = nftnl_parse_data(&e->key, tb[NFTA_SET_ELEM_KEY], &type);
+		if (ret < 0)
+			goto out_set_elem;
+		e->flags |= (1 << NFTNL_SET_ELEM_KEY);
+        }
+	if (tb[NFTA_SET_ELEM_KEY_END]) {
+		ret = nftnl_parse_data(&e->key_end, tb[NFTA_SET_ELEM_KEY_END],
+				       &type);
+		if (ret < 0)
+			goto out_set_elem;
+		e->flags |= (1 << NFTNL_SET_ELEM_KEY_END);
+	}
+        if (tb[NFTA_SET_ELEM_DATA]) {
+		ret = nftnl_parse_data(&e->data, tb[NFTA_SET_ELEM_DATA], &type);
+		if (ret < 0)
+			goto out_set_elem;
+		switch(type) {
+		case DATA_VERDICT:
+			e->flags |= (1 << NFTNL_SET_ELEM_VERDICT);
+			break;
+		case DATA_CHAIN:
+			e->flags |= (1 << NFTNL_SET_ELEM_VERDICT) |
+				    (1 << NFTNL_SET_ELEM_CHAIN);
+			break;
+		case DATA_VALUE:
+			e->flags |= (1 << NFTNL_SET_ELEM_DATA);
+			break;
+		}
+        }
+	if (tb[NFTA_SET_ELEM_EXPR]) {
+		struct nftnl_expr *expr;
+
+		expr = nftnl_expr_parse(tb[NFTA_SET_ELEM_EXPR]);
+		if (expr == NULL) {
+			ret = -1;
+			goto out_set_elem;
+		}
+		list_add_tail(&expr->head, &e->expr_list);
+		e->flags |= (1 << NFTNL_SET_ELEM_EXPR);
+	} else if (tb[NFTA_SET_ELEM_EXPRESSIONS]) {
+		struct nftnl_expr *expr;
+		struct nlattr *attr;
+
+		mnl_attr_for_each_nested(attr, tb[NFTA_SET_ELEM_EXPRESSIONS]) {
+			if (mnl_attr_get_type(attr) != NFTA_LIST_ELEM) {
+				ret = -1;
+				goto out_set_elem;
+			}
+			expr = nftnl_expr_parse(attr);
+			if (expr == NULL) {
+				ret = -1;
+				goto out_set_elem;
+			}
+			list_add_tail(&expr->head, &e->expr_list);
+		}
+		e->flags |= (1 << NFTNL_SET_ELEM_EXPRESSIONS);
+	}
+	if (tb[NFTA_SET_ELEM_USERDATA]) {
+		const void *udata =
+			mnl_attr_get_payload(tb[NFTA_SET_ELEM_USERDATA]);
+
+		if (e->flags & (1 << NFTNL_RULE_USERDATA))
+			xfree(e->user.data);
+
+		e->user.len  = mnl_attr_get_payload_len(tb[NFTA_SET_ELEM_USERDATA]);
+		e->user.data = malloc(e->user.len);
+		if (e->user.data == NULL) {
+			ret = -1;
+			goto out_set_elem;
+		}
+		memcpy(e->user.data, udata, e->user.len);
+		e->flags |= (1 << NFTNL_RULE_USERDATA);
+	}
+	if (tb[NFTA_SET_ELEM_OBJREF]) {
+		e->objref = strdup(mnl_attr_get_str(tb[NFTA_SET_ELEM_OBJREF]));
+		if (e->objref == NULL) {
+			ret = -1;
+			goto out_set_elem;
+		}
+		e->flags |= (1 << NFTNL_SET_ELEM_OBJREF);
+	}
+
+	/* Add this new element to this set */
+	list_add_tail(&e->head, &s->element_list);
+
+	return 0;
+out_set_elem:
+	nftnl_set_elem_free(e);
+	return ret;
+}
+
+static int
+nftnl_set_elem_list_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_SET_ELEM_LIST_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_SET_ELEM_LIST_TABLE:
+	case NFTA_SET_ELEM_LIST_SET:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_SET_ELEM_LIST_ELEMENTS:
+		if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+static int nftnl_set_elems_parse(struct nftnl_set *s, const struct nlattr *nest)
+{
+	struct nlattr *attr;
+	int ret = 0;
+
+	mnl_attr_for_each_nested(attr, nest) {
+		if (mnl_attr_get_type(attr) != NFTA_LIST_ELEM)
+			return -1;
+
+		ret = nftnl_set_elems_parse2(s, attr);
+		if (ret < 0)
+			return ret;
+	}
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_set_elems_nlmsg_parse);
+int nftnl_set_elems_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_set *s)
+{
+	struct nlattr *tb[NFTA_SET_ELEM_LIST_MAX+1] = {};
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	int ret;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg),
+			   nftnl_set_elem_list_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_SET_ELEM_LIST_TABLE]) {
+		if (s->flags & (1 << NFTNL_SET_TABLE))
+			xfree(s->table);
+		s->table =
+			strdup(mnl_attr_get_str(tb[NFTA_SET_ELEM_LIST_TABLE]));
+		if (!s->table)
+			return -1;
+		s->flags |= (1 << NFTNL_SET_TABLE);
+	}
+	if (tb[NFTA_SET_ELEM_LIST_SET]) {
+		if (s->flags & (1 << NFTNL_SET_NAME))
+			xfree(s->name);
+		s->name =
+			strdup(mnl_attr_get_str(tb[NFTA_SET_ELEM_LIST_SET]));
+		if (!s->name)
+			return -1;
+		s->flags |= (1 << NFTNL_SET_NAME);
+	}
+	if (tb[NFTA_SET_ELEM_LIST_SET_ID]) {
+		s->id = ntohl(mnl_attr_get_u32(tb[NFTA_SET_ELEM_LIST_SET_ID]));
+		s->flags |= (1 << NFTNL_SET_ID);
+	}
+        if (tb[NFTA_SET_ELEM_LIST_ELEMENTS]) {
+	 	ret = nftnl_set_elems_parse(s, tb[NFTA_SET_ELEM_LIST_ELEMENTS]);
+		if (ret < 0)
+			return ret;
+	}
+
+	s->family = nfg->nfgen_family;
+	s->flags |= (1 << NFTNL_SET_FAMILY);
+
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_parse);
+int nftnl_set_elem_parse(struct nftnl_set_elem *e, enum nftnl_parse_type type,
+		       const char *data, struct nftnl_parse_err *err)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_parse_file);
+int nftnl_set_elem_parse_file(struct nftnl_set_elem *e, enum nftnl_parse_type type,
+			    FILE *fp, struct nftnl_parse_err *err)
+{
+	errno = EOPNOTSUPP;
+	return -1;
+}
+
+int nftnl_set_elem_snprintf_default(char *buf, size_t remain,
+				    const struct nftnl_set_elem *e)
+{
+	int ret, dregtype = DATA_VALUE, offset = 0, i;
+
+	ret = snprintf(buf, remain, "element ");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &e->key,
+				      DATA_F_NOPFX, DATA_VALUE);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->flags & (1 << NFTNL_SET_ELEM_KEY_END)) {
+		ret = snprintf(buf + offset, remain, " - ");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		ret = nftnl_data_reg_snprintf(buf + offset, remain, &e->key_end,
+					      DATA_F_NOPFX, DATA_VALUE);
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	ret = snprintf(buf + offset, remain, " : ");
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->flags & (1 << NFTNL_SET_ELEM_VERDICT))
+		dregtype = DATA_VERDICT;
+
+	ret = nftnl_data_reg_snprintf(buf + offset, remain, &e->data,
+				      DATA_F_NOPFX, dregtype);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	ret = snprintf(buf + offset, remain, "%u [end]", e->set_elem_flags);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	if (e->user.len) {
+		ret = snprintf(buf + offset, remain, "  userdata = { ");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+		for (i = 0; i < e->user.len; i++) {
+			char *c = e->user.data;
+
+			ret = snprintf(buf + offset, remain,
+				       isprint(c[i]) ? "%c" : "\\x%02hhx",
+				       c[i]);
+			SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+		}
+
+		ret = snprintf(buf + offset, remain, " }");
+		SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	}
+
+	return offset;
+}
+
+static int nftnl_set_elem_cmd_snprintf(char *buf, size_t remain,
+				       const struct nftnl_set_elem *e,
+				       uint32_t cmd, uint32_t type,
+				       uint32_t flags)
+{
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = nftnl_set_elem_snprintf_default(buf + offset, remain, e);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_snprintf);
+int nftnl_set_elem_snprintf(char *buf, size_t size,
+			    const struct nftnl_set_elem *e,
+			    uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_set_elem_cmd_snprintf(buf, size, e, nftnl_flag2cmd(flags),
+					 type, flags);
+}
+
+static int nftnl_set_elem_do_snprintf(char *buf, size_t size, const void *e,
+				      uint32_t cmd, uint32_t type,
+				      uint32_t flags)
+{
+	return nftnl_set_elem_snprintf(buf, size, e, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_fprintf);
+int nftnl_set_elem_fprintf(FILE *fp, const struct nftnl_set_elem *se, uint32_t type,
+			 uint32_t flags)
+{
+	return nftnl_fprintf(fp, se, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_set_elem_do_snprintf);
+}
+
+EXPORT_SYMBOL(nftnl_set_elem_foreach);
+int nftnl_set_elem_foreach(struct nftnl_set *s,
+			 int (*cb)(struct nftnl_set_elem *e, void *data),
+			 void *data)
+{
+	struct nftnl_set_elem *elem;
+	int ret;
+
+	list_for_each_entry(elem, &s->element_list, head) {
+		ret = cb(elem, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+struct nftnl_set_elems_iter {
+	const struct nftnl_set		*set;
+	const struct list_head		*list;
+	struct nftnl_set_elem		*cur;
+};
+
+EXPORT_SYMBOL(nftnl_set_elems_iter_create);
+struct nftnl_set_elems_iter *
+nftnl_set_elems_iter_create(const struct nftnl_set *s)
+{
+	struct nftnl_set_elems_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_set_elems_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->set = s;
+	iter->list = &s->element_list;
+	if (list_empty(&s->element_list))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(s->element_list.next,
+				       struct nftnl_set_elem, head);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_set_elems_iter_cur);
+struct nftnl_set_elem *
+nftnl_set_elems_iter_cur(const struct nftnl_set_elems_iter *iter)
+{
+	return iter->cur;
+}
+
+EXPORT_SYMBOL(nftnl_set_elems_iter_next);
+struct nftnl_set_elem *nftnl_set_elems_iter_next(struct nftnl_set_elems_iter *iter)
+{
+	struct nftnl_set_elem *s = iter->cur;
+
+	if (s == NULL)
+		return NULL;
+
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_set_elem, head);
+	if (&iter->cur->head == iter->list->next)
+		return NULL;
+
+	return s;
+}
+
+EXPORT_SYMBOL(nftnl_set_elems_iter_destroy);
+void nftnl_set_elems_iter_destroy(struct nftnl_set_elems_iter *iter)
+{
+	xfree(iter);
+}
+
+static bool nftnl_attr_nest_overflow(struct nlmsghdr *nlh,
+				   const struct nlattr *from,
+				   const struct nlattr *to)
+{
+	int len = (void *)to + to->nla_len - (void *)from;
+
+	/* The attribute length field is 16 bits long, thus the maximum payload
+	 * that an attribute can convey is UINT16_MAX. In case of overflow,
+	 * discard the last that did not fit into the attribute.
+	 */
+	if (len > UINT16_MAX) {
+		nlh->nlmsg_len -= to->nla_len;
+		return true;
+	}
+	return false;
+}
+
+EXPORT_SYMBOL(nftnl_set_elems_nlmsg_build_payload_iter);
+int nftnl_set_elems_nlmsg_build_payload_iter(struct nlmsghdr *nlh,
+					   struct nftnl_set_elems_iter *iter)
+{
+	struct nftnl_set_elem *elem;
+	struct nlattr *nest1, *nest2;
+	int i = 0, ret = 0;
+
+	nftnl_set_elem_nlmsg_build_def(nlh, iter->set);
+
+	/* This set is empty, don't add an empty list element nest. */
+	if (list_empty(&iter->set->element_list))
+		return ret;
+
+	nest1 = mnl_attr_nest_start(nlh, NFTA_SET_ELEM_LIST_ELEMENTS);
+	elem = nftnl_set_elems_iter_next(iter);
+	while (elem != NULL) {
+		nest2 = nftnl_set_elem_nlmsg_build(nlh, elem, ++i);
+		if (nftnl_attr_nest_overflow(nlh, nest1, nest2)) {
+			/* Go back to previous not to miss this element */
+			iter->cur = list_entry(iter->cur->head.prev,
+					       struct nftnl_set_elem, head);
+			ret = 1;
+			break;
+		}
+		elem = nftnl_set_elems_iter_next(iter);
+	}
+	mnl_attr_nest_end(nlh, nest1);
+
+	return ret;
+}
diff --git a/src/table.c b/src/table.c
new file mode 100644
index 0000000..59e7053
--- /dev/null
+++ b/src/table.c
@@ -0,0 +1,523 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <limits.h>
+#include <stdlib.h>
+#include <string.h>
+#include <netinet/in.h>
+#include <errno.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/table.h>
+
+struct nftnl_table {
+	struct list_head head;
+
+	const char	*name;
+	uint32_t	family;
+	uint32_t	table_flags;
+	uint64_t 	handle;
+	uint32_t	use;
+	uint32_t	flags;
+	uint32_t	owner;
+	struct {
+		void		*data;
+		uint32_t	len;
+	} user;
+};
+
+EXPORT_SYMBOL(nftnl_table_alloc);
+struct nftnl_table *nftnl_table_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_table));
+}
+
+EXPORT_SYMBOL(nftnl_table_free);
+void nftnl_table_free(const struct nftnl_table *t)
+{
+	if (t->flags & (1 << NFTNL_TABLE_NAME))
+		xfree(t->name);
+	if (t->flags & (1 << NFTNL_TABLE_USERDATA))
+		xfree(t->user.data);
+
+	xfree(t);
+}
+
+EXPORT_SYMBOL(nftnl_table_is_set);
+bool nftnl_table_is_set(const struct nftnl_table *t, uint16_t attr)
+{
+	return t->flags & (1 << attr);
+}
+
+EXPORT_SYMBOL(nftnl_table_unset);
+void nftnl_table_unset(struct nftnl_table *t, uint16_t attr)
+{
+	if (!(t->flags & (1 << attr)))
+		return;
+
+	switch (attr) {
+	case NFTNL_TABLE_NAME:
+		xfree(t->name);
+		break;
+	case NFTNL_TABLE_FLAGS:
+	case NFTNL_TABLE_HANDLE:
+	case NFTNL_TABLE_FAMILY:
+	case NFTNL_TABLE_USE:
+	case NFTNL_TABLE_OWNER:
+		break;
+	}
+	t->flags &= ~(1 << attr);
+}
+
+static uint32_t nftnl_table_validate[NFTNL_TABLE_MAX + 1] = {
+	[NFTNL_TABLE_FLAGS]	= sizeof(uint32_t),
+	[NFTNL_TABLE_FAMILY]	= sizeof(uint32_t),
+	[NFTNL_TABLE_HANDLE]	= sizeof(uint64_t),
+};
+
+EXPORT_SYMBOL(nftnl_table_set_data);
+int nftnl_table_set_data(struct nftnl_table *t, uint16_t attr,
+			 const void *data, uint32_t data_len)
+{
+	nftnl_assert_attr_exists(attr, NFTNL_TABLE_MAX);
+	nftnl_assert_validate(data, nftnl_table_validate, attr, data_len);
+
+	switch (attr) {
+	case NFTNL_TABLE_NAME:
+		if (t->flags & (1 << NFTNL_TABLE_NAME))
+			xfree(t->name);
+
+		t->name = strdup(data);
+		if (!t->name)
+			return -1;
+		break;
+	case NFTNL_TABLE_HANDLE:
+		memcpy(&t->handle, data, sizeof(t->handle));
+		break;
+	case NFTNL_TABLE_FLAGS:
+		memcpy(&t->table_flags, data, sizeof(t->table_flags));
+		break;
+	case NFTNL_TABLE_FAMILY:
+		memcpy(&t->family, data, sizeof(t->family));
+		break;
+	case NFTNL_TABLE_USE:
+		memcpy(&t->use, data, sizeof(t->use));
+		break;
+	case NFTNL_TABLE_USERDATA:
+		if (t->flags & (1 << NFTNL_TABLE_USERDATA))
+			xfree(t->user.data);
+
+		t->user.data = malloc(data_len);
+		if (!t->user.data)
+			return -1;
+		memcpy(t->user.data, data, data_len);
+		t->user.len = data_len;
+		break;
+	case NFTNL_TABLE_OWNER:
+		memcpy(&t->owner, data, sizeof(t->owner));
+		break;
+	}
+	t->flags |= (1 << attr);
+	return 0;
+}
+
+void nftnl_table_set(struct nftnl_table *t, uint16_t attr, const void *data) __visible;
+void nftnl_table_set(struct nftnl_table *t, uint16_t attr, const void *data)
+{
+	nftnl_table_set_data(t, attr, data, nftnl_table_validate[attr]);
+}
+
+EXPORT_SYMBOL(nftnl_table_set_u32);
+void nftnl_table_set_u32(struct nftnl_table *t, uint16_t attr, uint32_t val)
+{
+	nftnl_table_set_data(t, attr, &val, sizeof(uint32_t));
+}
+
+EXPORT_SYMBOL(nftnl_table_set_u64);
+void nftnl_table_set_u64(struct nftnl_table *t, uint16_t attr, uint64_t val)
+{
+	nftnl_table_set_data(t, attr, &val, sizeof(uint64_t));
+}
+
+EXPORT_SYMBOL(nftnl_table_set_u8);
+void nftnl_table_set_u8(struct nftnl_table *t, uint16_t attr, uint8_t val)
+{
+	nftnl_table_set_data(t, attr, &val, sizeof(uint8_t));
+}
+
+EXPORT_SYMBOL(nftnl_table_set_str);
+int nftnl_table_set_str(struct nftnl_table *t, uint16_t attr, const char *str)
+{
+	return nftnl_table_set_data(t, attr, str, strlen(str) + 1);
+}
+
+EXPORT_SYMBOL(nftnl_table_get_data);
+const void *nftnl_table_get_data(const struct nftnl_table *t, uint16_t attr,
+				 uint32_t *data_len)
+{
+	if (!(t->flags & (1 << attr)))
+		return NULL;
+
+	switch(attr) {
+	case NFTNL_TABLE_NAME:
+		*data_len = strlen(t->name) + 1;
+		return t->name;
+	case NFTNL_TABLE_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &t->handle;
+	case NFTNL_TABLE_FLAGS:
+		*data_len = sizeof(uint32_t);
+		return &t->table_flags;
+	case NFTNL_TABLE_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &t->family;
+	case NFTNL_TABLE_USE:
+		*data_len = sizeof(uint32_t);
+		return &t->use;
+	case NFTNL_TABLE_USERDATA:
+		*data_len = t->user.len;
+		return t->user.data;
+	case NFTNL_TABLE_OWNER:
+		*data_len = sizeof(uint32_t);
+		return &t->owner;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_table_get);
+const void *nftnl_table_get(const struct nftnl_table *t, uint16_t attr)
+{
+	uint32_t data_len;
+	return nftnl_table_get_data(t, attr, &data_len);
+}
+
+EXPORT_SYMBOL(nftnl_table_get_u32);
+uint32_t nftnl_table_get_u32(const struct nftnl_table *t, uint16_t attr)
+{
+	const void *ret = nftnl_table_get(t, attr);
+	return ret == NULL ? 0 : *((uint32_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_table_get_u64);
+uint64_t nftnl_table_get_u64(const struct nftnl_table *t, uint16_t attr)
+{
+	const void *ret = nftnl_table_get(t, attr);
+	return ret == NULL ? 0 : *((uint64_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_table_get_u8);
+uint8_t nftnl_table_get_u8(const struct nftnl_table *t, uint16_t attr)
+{
+	const void *ret = nftnl_table_get(t, attr);
+	return ret == NULL ? 0 : *((uint8_t *)ret);
+}
+
+EXPORT_SYMBOL(nftnl_table_get_str);
+const char *nftnl_table_get_str(const struct nftnl_table *t, uint16_t attr)
+{
+	return nftnl_table_get(t, attr);
+}
+
+EXPORT_SYMBOL(nftnl_table_nlmsg_build_payload);
+void nftnl_table_nlmsg_build_payload(struct nlmsghdr *nlh, const struct nftnl_table *t)
+{
+	if (t->flags & (1 << NFTNL_TABLE_NAME))
+		mnl_attr_put_strz(nlh, NFTA_TABLE_NAME, t->name);
+	if (t->flags & (1 << NFTNL_TABLE_HANDLE))
+		mnl_attr_put_u64(nlh, NFTA_TABLE_HANDLE, htobe64(t->handle));
+	if (t->flags & (1 << NFTNL_TABLE_FLAGS))
+		mnl_attr_put_u32(nlh, NFTA_TABLE_FLAGS, htonl(t->table_flags));
+	if (t->flags & (1 << NFTNL_TABLE_USERDATA))
+		mnl_attr_put(nlh, NFTA_TABLE_USERDATA, t->user.len, t->user.data);
+}
+
+static int nftnl_table_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TABLE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFTA_TABLE_NAME:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TABLE_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TABLE_FLAGS:
+	case NFTA_TABLE_USE:
+	case NFTA_TABLE_OWNER:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TABLE_USERDATA:
+		if (mnl_attr_validate(attr, MNL_TYPE_BINARY) < 0)
+			abi_breakage();
+		break;
+	}
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+EXPORT_SYMBOL(nftnl_table_nlmsg_parse);
+int nftnl_table_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_table *t)
+{
+	struct nlattr *tb[NFTA_TABLE_MAX+1] = {};
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	int ret;
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_table_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (tb[NFTA_TABLE_NAME]) {
+		if (t->flags & (1 << NFTNL_TABLE_NAME))
+			xfree(t->name);
+		t->name = strdup(mnl_attr_get_str(tb[NFTA_TABLE_NAME]));
+		if (!t->name)
+			return -1;
+		t->flags |= (1 << NFTNL_TABLE_NAME);
+	}
+	if (tb[NFTA_TABLE_FLAGS]) {
+		t->table_flags = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_FLAGS]));
+		t->flags |= (1 << NFTNL_TABLE_FLAGS);
+	}
+	if (tb[NFTA_TABLE_USE]) {
+		t->use = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_USE]));
+		t->flags |= (1 << NFTNL_TABLE_USE);
+	}
+	if (tb[NFTA_TABLE_HANDLE]) {
+		t->handle = be64toh(mnl_attr_get_u64(tb[NFTA_TABLE_HANDLE]));
+		t->flags |= (1 << NFTNL_TABLE_HANDLE);
+	}
+	if (tb[NFTA_TABLE_USERDATA]) {
+		ret = nftnl_table_set_data(t, NFTNL_TABLE_USERDATA,
+			mnl_attr_get_payload(tb[NFTA_TABLE_USERDATA]),
+			mnl_attr_get_payload_len(tb[NFTA_TABLE_USERDATA]));
+		if (ret < 0)
+			return ret;
+	}
+	if (tb[NFTA_TABLE_OWNER]) {
+		t->owner = ntohl(mnl_attr_get_u32(tb[NFTA_TABLE_OWNER]));
+		t->flags |= (1 << NFTNL_TABLE_OWNER);
+	}
+
+	t->family = nfg->nfgen_family;
+	t->flags |= (1 << NFTNL_TABLE_FAMILY);
+
+	return 0;
+}
+
+static int nftnl_table_do_parse(struct nftnl_table *t, enum nftnl_parse_type type,
+			      const void *data, struct nftnl_parse_err *err,
+			      enum nftnl_parse_input input)
+{
+	int ret;
+
+	switch (type) {
+	case NFTNL_PARSE_JSON:
+	case NFTNL_PARSE_XML:
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_table_parse);
+int nftnl_table_parse(struct nftnl_table *t, enum nftnl_parse_type type,
+		    const char *data, struct nftnl_parse_err *err)
+{
+	return nftnl_table_do_parse(t, type, data, err, NFTNL_PARSE_BUFFER);
+}
+
+EXPORT_SYMBOL(nftnl_table_parse_file);
+int nftnl_table_parse_file(struct nftnl_table *t, enum nftnl_parse_type type,
+			 FILE *fp, struct nftnl_parse_err *err)
+{
+	return nftnl_table_do_parse(t, type, fp, err, NFTNL_PARSE_FILE);
+}
+
+static int nftnl_table_snprintf_default(char *buf, size_t size,
+					const struct nftnl_table *t)
+{
+	return snprintf(buf, size, "table %s %s flags %x use %d handle %llu",
+			t->name, nftnl_family2str(t->family),
+			t->table_flags, t->use, (unsigned long long)t->handle);
+}
+
+static int nftnl_table_cmd_snprintf(char *buf, size_t remain,
+				    const struct nftnl_table *t, uint32_t cmd,
+				    uint32_t type, uint32_t flags)
+{
+	int ret, offset = 0;
+
+	if (type != NFTNL_OUTPUT_DEFAULT)
+		return -1;
+
+	ret = nftnl_table_snprintf_default(buf + offset, remain, t);
+	SNPRINTF_BUFFER_SIZE(ret, remain, offset);
+	return offset;
+}
+
+EXPORT_SYMBOL(nftnl_table_snprintf);
+int nftnl_table_snprintf(char *buf, size_t size, const struct nftnl_table *t,
+			 uint32_t type, uint32_t flags)
+{
+	if (size)
+		buf[0] = '\0';
+
+	return nftnl_table_cmd_snprintf(buf, size, t, nftnl_flag2cmd(flags), type,
+				      flags);
+}
+
+static int nftnl_table_do_snprintf(char *buf, size_t size, const void *t,
+				   uint32_t cmd, uint32_t type, uint32_t flags)
+{
+	return nftnl_table_snprintf(buf, size, t, type, flags);
+}
+
+EXPORT_SYMBOL(nftnl_table_fprintf);
+int nftnl_table_fprintf(FILE *fp, const struct nftnl_table *t, uint32_t type,
+			uint32_t flags)
+{
+	return nftnl_fprintf(fp, t, NFTNL_CMD_UNSPEC, type, flags,
+			   nftnl_table_do_snprintf);
+}
+
+struct nftnl_table_list {
+	struct list_head list;
+};
+
+EXPORT_SYMBOL(nftnl_table_list_alloc);
+struct nftnl_table_list *nftnl_table_list_alloc(void)
+{
+	struct nftnl_table_list *list;
+
+	list = calloc(1, sizeof(struct nftnl_table_list));
+	if (list == NULL)
+		return NULL;
+
+	INIT_LIST_HEAD(&list->list);
+
+	return list;
+}
+
+EXPORT_SYMBOL(nftnl_table_list_free);
+void nftnl_table_list_free(struct nftnl_table_list *list)
+{
+	struct nftnl_table *r, *tmp;
+
+	list_for_each_entry_safe(r, tmp, &list->list, head) {
+		list_del(&r->head);
+		nftnl_table_free(r);
+	}
+	xfree(list);
+}
+
+EXPORT_SYMBOL(nftnl_table_list_is_empty);
+int nftnl_table_list_is_empty(const struct nftnl_table_list *list)
+{
+	return list_empty(&list->list);
+}
+
+EXPORT_SYMBOL(nftnl_table_list_add);
+void nftnl_table_list_add(struct nftnl_table *r, struct nftnl_table_list *list)
+{
+	list_add(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_table_list_add_tail);
+void nftnl_table_list_add_tail(struct nftnl_table *r, struct nftnl_table_list *list)
+{
+	list_add_tail(&r->head, &list->list);
+}
+
+EXPORT_SYMBOL(nftnl_table_list_del);
+void nftnl_table_list_del(struct nftnl_table *t)
+{
+	list_del(&t->head);
+}
+
+EXPORT_SYMBOL(nftnl_table_list_foreach);
+int nftnl_table_list_foreach(struct nftnl_table_list *table_list,
+			   int (*cb)(struct nftnl_table *t, void *data),
+			   void *data)
+{
+	struct nftnl_table *cur, *tmp;
+	int ret;
+
+	list_for_each_entry_safe(cur, tmp, &table_list->list, head) {
+		ret = cb(cur, data);
+		if (ret < 0)
+			return ret;
+	}
+	return 0;
+}
+
+struct nftnl_table_list_iter {
+	const struct nftnl_table_list	*list;
+	struct nftnl_table		*cur;
+};
+
+EXPORT_SYMBOL(nftnl_table_list_iter_create);
+struct nftnl_table_list_iter *
+nftnl_table_list_iter_create(const struct nftnl_table_list *l)
+{
+	struct nftnl_table_list_iter *iter;
+
+	iter = calloc(1, sizeof(struct nftnl_table_list_iter));
+	if (iter == NULL)
+		return NULL;
+
+	iter->list = l;
+	if (nftnl_table_list_is_empty(l))
+		iter->cur = NULL;
+	else
+		iter->cur = list_entry(l->list.next, struct nftnl_table, head);
+
+	return iter;
+}
+
+EXPORT_SYMBOL(nftnl_table_list_iter_next);
+struct nftnl_table *nftnl_table_list_iter_next(struct nftnl_table_list_iter *iter)
+{
+	struct nftnl_table *r = iter->cur;
+
+	if (r == NULL)
+		return NULL;
+
+	/* get next table, if any */
+	iter->cur = list_entry(iter->cur->head.next, struct nftnl_table, head);
+	if (&iter->cur->head == iter->list->list.next)
+		return NULL;
+
+	return r;
+}
+
+EXPORT_SYMBOL(nftnl_table_list_iter_destroy);
+void nftnl_table_list_iter_destroy(const struct nftnl_table_list_iter *iter)
+{
+	xfree(iter);
+}
diff --git a/src/trace.c b/src/trace.c
new file mode 100644
index 0000000..f426437
--- /dev/null
+++ b/src/trace.c
@@ -0,0 +1,427 @@
+/*
+ * (C) 2015 Red Hat GmbH
+ * Author: Florian Westphal <fw@strlen.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include "internal.h"
+
+#include <time.h>
+#include <endian.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <netinet/in.h>
+
+#include <libmnl/libmnl.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nf_tables.h>
+
+#include <libnftnl/trace.h>
+
+struct nftnl_header_data {
+	char *data;
+	unsigned int len;
+};
+
+struct nftnl_trace {
+	char *table;
+	char *chain;
+	char *jump_target;
+	uint64_t rule_handle;
+	struct nftnl_header_data ll;
+	struct nftnl_header_data nh;
+	struct nftnl_header_data th;
+	uint32_t family;
+	uint32_t type;
+	uint32_t id;
+	uint32_t iif;
+	uint32_t oif;
+	uint32_t mark;
+	uint32_t verdict;
+	uint32_t nfproto;
+	uint32_t policy;
+	uint16_t iiftype;
+	uint16_t oiftype;
+
+	uint32_t flags;
+};
+
+EXPORT_SYMBOL(nftnl_trace_alloc);
+struct nftnl_trace *nftnl_trace_alloc(void)
+{
+	return calloc(1, sizeof(struct nftnl_trace));
+}
+
+EXPORT_SYMBOL(nftnl_trace_free);
+void nftnl_trace_free(const struct nftnl_trace *t)
+{
+	xfree(t->chain);
+	xfree(t->table);
+	xfree(t->jump_target);
+	xfree(t->ll.data);
+	xfree(t->nh.data);
+	xfree(t->th.data);
+	xfree(t);
+}
+
+EXPORT_SYMBOL(nftnl_trace_is_set);
+bool nftnl_trace_is_set(const struct nftnl_trace *t, uint16_t attr)
+{
+	return t->flags & (1 << attr);
+}
+
+static int nftnl_trace_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	enum nft_trace_attributes type = mnl_attr_get_type(attr);
+
+	if (mnl_attr_type_valid(attr, NFTA_TRACE_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch (type) {
+	case NFTA_TRACE_UNSPEC:
+	case __NFTA_TRACE_MAX:
+		break;
+	case NFTA_TRACE_VERDICT:
+                if (mnl_attr_validate(attr, MNL_TYPE_NESTED) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TRACE_IIFTYPE:
+	case NFTA_TRACE_OIFTYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TRACE_ID:
+	case NFTA_TRACE_IIF:
+	case NFTA_TRACE_MARK:
+	case NFTA_TRACE_OIF:
+	case NFTA_TRACE_POLICY:
+	case NFTA_TRACE_NFPROTO:
+	case NFTA_TRACE_TYPE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TRACE_CHAIN:
+	case NFTA_TRACE_TABLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TRACE_RULE_HANDLE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U64) < 0)
+			abi_breakage();
+		break;
+	case NFTA_TRACE_LL_HEADER:	/* fallthrough */
+	case NFTA_TRACE_NETWORK_HEADER:
+	case NFTA_TRACE_TRANSPORT_HEADER:
+		if (mnl_attr_get_payload_len(attr) == 0)
+			abi_breakage();
+		break;
+	default:
+		return MNL_CB_OK;
+	};
+
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+EXPORT_SYMBOL(nftnl_trace_get_data);
+const void *nftnl_trace_get_data(const struct nftnl_trace *trace,
+				 uint16_t type, uint32_t *data_len)
+{
+	enum nftnl_trace_attr attr = type;
+
+	if (!(trace->flags & (1 << type)))
+		return NULL;
+
+	switch (attr) {
+	case NFTNL_TRACE_FAMILY:
+		*data_len = sizeof(uint32_t);
+		return &trace->family;
+	case NFTNL_TRACE_ID:
+		*data_len = sizeof(uint32_t);
+		return &trace->id;
+	case NFTNL_TRACE_IIF:
+		*data_len = sizeof(uint32_t);
+		return &trace->iif;
+	case NFTNL_TRACE_OIF:
+		*data_len = sizeof(uint32_t);
+		return &trace->oif;
+	case NFTNL_TRACE_LL_HEADER:
+		*data_len = trace->ll.len;
+		return trace->ll.data;
+	case NFTNL_TRACE_MARK:
+		*data_len = sizeof(uint32_t);
+		return &trace->mark;
+	case NFTNL_TRACE_NETWORK_HEADER:
+		*data_len = trace->nh.len;
+		return trace->nh.data;
+	case NFTNL_TRACE_TYPE:
+		*data_len = sizeof(uint32_t);
+		return &trace->type;
+	case NFTNL_TRACE_CHAIN:
+		*data_len = strlen(trace->chain) + 1;
+		return trace->chain;
+	case NFTNL_TRACE_TABLE:
+		*data_len = strlen(trace->table) + 1;
+		return trace->table;
+	case NFTNL_TRACE_JUMP_TARGET:
+		*data_len = strlen(trace->jump_target) + 1;
+		return trace->jump_target;
+	case NFTNL_TRACE_TRANSPORT_HEADER:
+		*data_len = trace->th.len;
+		return trace->th.data;
+	case NFTNL_TRACE_RULE_HANDLE:
+		*data_len = sizeof(uint64_t);
+		return &trace->rule_handle;
+	case NFTNL_TRACE_VERDICT:
+		*data_len = sizeof(uint32_t);
+		return &trace->verdict;
+	case NFTNL_TRACE_IIFTYPE:
+		*data_len = sizeof(uint16_t);
+		return &trace->iiftype;
+	case NFTNL_TRACE_OIFTYPE:
+		*data_len = sizeof(uint16_t);
+		return &trace->oiftype;
+	case NFTNL_TRACE_NFPROTO:
+		*data_len = sizeof(uint32_t);
+		return &trace->nfproto;
+	case NFTNL_TRACE_POLICY:
+		*data_len = sizeof(uint32_t);
+		return &trace->policy;
+	case __NFTNL_TRACE_MAX:
+		break;
+	}
+
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_trace_get_str);
+const char *nftnl_trace_get_str(const struct nftnl_trace *trace, uint16_t type)
+{
+	if (!nftnl_trace_is_set(trace, type))
+		return NULL;
+
+	switch (type) {
+	case NFTNL_TRACE_CHAIN: return trace->chain;
+	case NFTNL_TRACE_TABLE: return trace->table;
+	case NFTNL_TRACE_JUMP_TARGET: return trace->jump_target;
+	default: break;
+	}
+	return NULL;
+}
+
+EXPORT_SYMBOL(nftnl_trace_get_u16);
+uint16_t nftnl_trace_get_u16(const struct nftnl_trace *trace, uint16_t type)
+{
+	const uint16_t *d;
+	uint32_t dlen;
+
+	d = nftnl_trace_get_data(trace, type, &dlen);
+	if (d && dlen == sizeof(*d))
+		return *d;
+
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_trace_get_u32);
+uint32_t nftnl_trace_get_u32(const struct nftnl_trace *trace, uint16_t type)
+{
+	const uint32_t *d;
+	uint32_t dlen;
+
+	d = nftnl_trace_get_data(trace, type, &dlen);
+	if (d && dlen == sizeof(*d))
+		return *d;
+
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_trace_get_u64);
+uint64_t nftnl_trace_get_u64(const struct nftnl_trace *trace, uint16_t type)
+{
+	const uint64_t *d;
+	uint32_t dlen;
+
+	d = nftnl_trace_get_data(trace, type, &dlen);
+	if (d && dlen == sizeof(*d))
+		return *d;
+
+	return 0;
+}
+
+static bool nftnl_trace_nlmsg_parse_hdrdata(struct nlattr *attr,
+					    struct nftnl_header_data *header)
+{
+	uint32_t len;
+
+	if (!attr)
+		return false;
+
+	len = mnl_attr_get_payload_len(attr);
+
+	header->data = malloc(len);
+	if (header->data) {
+		memcpy(header->data, mnl_attr_get_payload(attr), len);
+		header->len = len;
+		return true;
+	}
+
+	return false;
+}
+
+static int nftnl_trace_parse_verdict_cb(const struct nlattr *attr, void *data)
+{
+	int type = mnl_attr_get_type(attr);
+	const struct nlattr **tb = data;
+
+	switch (type) {
+	case NFTA_VERDICT_CODE:
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			abi_breakage();
+		tb[type] = attr;
+		break;
+	case NFTA_VERDICT_CHAIN:
+		if (mnl_attr_validate(attr, MNL_TYPE_STRING) < 0)
+			abi_breakage();
+		tb[type] = attr;
+		break;
+	}
+
+	return MNL_CB_OK;
+}
+
+static int nftnl_trace_parse_verdict(const struct nlattr *attr,
+				     struct nftnl_trace *t)
+{
+	struct nlattr *tb[NFTA_VERDICT_MAX+1];
+
+	if (mnl_attr_parse_nested(attr, nftnl_trace_parse_verdict_cb, tb) < 0)
+		return -1;
+
+	if (!tb[NFTA_VERDICT_CODE])
+		abi_breakage();
+
+	t->verdict = ntohl(mnl_attr_get_u32(tb[NFTA_VERDICT_CODE]));
+	t->flags |= (1 << NFTNL_TRACE_VERDICT);
+
+	switch (t->verdict) {
+	case NFT_GOTO: /* fallthough */
+	case NFT_JUMP:
+		if (!tb[NFTA_VERDICT_CHAIN])
+			abi_breakage();
+		t->jump_target = strdup(mnl_attr_get_str(tb[NFTA_VERDICT_CHAIN]));
+		if (!t->jump_target)
+			return -1;
+
+		t->flags |= (1 << NFTNL_TRACE_JUMP_TARGET);
+		break;
+	}
+	return 0;
+}
+
+EXPORT_SYMBOL(nftnl_trace_nlmsg_parse);
+int nftnl_trace_nlmsg_parse(const struct nlmsghdr *nlh, struct nftnl_trace *t)
+{
+	struct nfgenmsg *nfg = mnl_nlmsg_get_payload(nlh);
+	struct nlattr *tb[NFTA_TRACE_MAX+1] = {};
+
+	if (mnl_attr_parse(nlh, sizeof(*nfg), nftnl_trace_parse_attr_cb, tb) < 0)
+		return -1;
+
+	if (!tb[NFTA_TRACE_ID])
+		abi_breakage();
+
+	if (!tb[NFTA_TRACE_TYPE])
+		abi_breakage();
+
+	t->family = nfg->nfgen_family;
+	t->flags |= (1 << NFTNL_TRACE_FAMILY);
+
+	t->type = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_TYPE]));
+	t->flags |= (1 << NFTNL_TRACE_TYPE);
+
+	t->id = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_ID]));
+	t->flags |= (1 << NFTNL_TRACE_ID);
+
+	if (tb[NFTA_TRACE_TABLE]) {
+		t->table = strdup(mnl_attr_get_str(tb[NFTA_TRACE_TABLE]));
+		if (!t->table)
+			return -1;
+
+		t->flags |= (1 << NFTNL_TRACE_TABLE);
+	}
+
+	if (tb[NFTA_TRACE_CHAIN]) {
+		t->chain = strdup(mnl_attr_get_str(tb[NFTA_TRACE_CHAIN]));
+		if (!t->chain)
+			return -1;
+
+		t->flags |= (1 << NFTNL_TRACE_CHAIN);
+	}
+
+	if (tb[NFTA_TRACE_IIFTYPE]) {
+		t->iiftype = ntohs(mnl_attr_get_u16(tb[NFTA_TRACE_IIFTYPE]));
+		t->flags |= (1 << NFTNL_TRACE_IIFTYPE);
+	}
+
+	if (tb[NFTA_TRACE_IIF]) {
+		t->iif = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_IIF]));
+		t->flags |= (1 << NFTNL_TRACE_IIF);
+	}
+
+	if (tb[NFTA_TRACE_OIFTYPE]) {
+		t->oiftype = ntohs(mnl_attr_get_u16(tb[NFTA_TRACE_OIFTYPE]));
+		t->flags |= (1 << NFTNL_TRACE_OIFTYPE);
+	}
+
+	if (tb[NFTA_TRACE_OIF]) {
+		t->oif = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_OIF]));
+		t->flags |= (1 << NFTNL_TRACE_OIF);
+	}
+
+	if (tb[NFTA_TRACE_MARK]) {
+		t->mark = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_MARK]));
+		t->flags |= (1 << NFTNL_TRACE_MARK);
+	}
+
+	if (tb[NFTA_TRACE_RULE_HANDLE]) {
+		t->rule_handle = be64toh(mnl_attr_get_u64(tb[NFTA_TRACE_RULE_HANDLE]));
+		t->flags |= (1 << NFTNL_TRACE_RULE_HANDLE);
+	}
+
+	if (tb[NFTA_TRACE_VERDICT] &&
+	    nftnl_trace_parse_verdict(tb[NFTA_TRACE_VERDICT], t) < 0)
+		return -1;
+
+	if (nftnl_trace_nlmsg_parse_hdrdata(tb[NFTA_TRACE_LL_HEADER], &t->ll))
+		t->flags |= (1 << NFTNL_TRACE_LL_HEADER);
+
+	if (nftnl_trace_nlmsg_parse_hdrdata(tb[NFTA_TRACE_NETWORK_HEADER], &t->nh))
+		t->flags |= (1 << NFTNL_TRACE_NETWORK_HEADER);
+
+	if (nftnl_trace_nlmsg_parse_hdrdata(tb[NFTA_TRACE_TRANSPORT_HEADER], &t->th))
+		t->flags |= (1 << NFTNL_TRACE_TRANSPORT_HEADER);
+
+	if (tb[NFTA_TRACE_NFPROTO]) {
+		t->nfproto = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_NFPROTO]));
+		t->flags |= (1 << NFTNL_TRACE_NFPROTO);
+	}
+
+	if (tb[NFTA_TRACE_POLICY]) {
+		t->policy = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_POLICY]));
+		t->flags |= (1 << NFTNL_TRACE_POLICY);
+	}
+
+	if (tb[NFTA_TRACE_MARK]) {
+		t->mark = ntohl(mnl_attr_get_u32(tb[NFTA_TRACE_MARK]));
+		t->flags |= (1 << NFTNL_TRACE_MARK);
+	}
+
+	return 0;
+}
diff --git a/src/udata.c b/src/udata.c
new file mode 100644
index 0000000..0cc3520
--- /dev/null
+++ b/src/udata.c
@@ -0,0 +1,169 @@
+/*
+ * (C) 2012-2016 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2016 by Carlos Falgueras García <carlosfg@riseup.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <libnftnl/udata.h>
+#include <udata.h>
+#include <utils.h>
+
+#include <stdlib.h>
+#include <stdint.h>
+#include <string.h>
+
+EXPORT_SYMBOL(nftnl_udata_buf_alloc);
+struct nftnl_udata_buf *nftnl_udata_buf_alloc(uint32_t data_size)
+{
+	struct nftnl_udata_buf *buf;
+
+	buf = malloc(sizeof(struct nftnl_udata_buf) + data_size);
+	if (!buf)
+		return NULL;
+	buf->size = data_size;
+	buf->end = buf->data;
+
+	return buf;
+}
+
+EXPORT_SYMBOL(nftnl_udata_buf_free);
+void nftnl_udata_buf_free(const struct nftnl_udata_buf *buf)
+{
+	xfree(buf);
+}
+
+EXPORT_SYMBOL(nftnl_udata_buf_len);
+uint32_t nftnl_udata_buf_len(const struct nftnl_udata_buf *buf)
+{
+	return (uint32_t)(buf->end - buf->data);
+}
+
+EXPORT_SYMBOL(nftnl_udata_buf_data);
+void *nftnl_udata_buf_data(const struct nftnl_udata_buf *buf)
+{
+	return (void *)buf->data;
+}
+
+EXPORT_SYMBOL(nftnl_udata_buf_put);
+void nftnl_udata_buf_put(struct nftnl_udata_buf *buf, const void *data,
+			 uint32_t len)
+{
+	memcpy(buf->data, data, len <= buf->size ? len : buf->size);
+	buf->end = buf->data + len;
+}
+
+EXPORT_SYMBOL(nftnl_udata_start);
+struct nftnl_udata *nftnl_udata_start(const struct nftnl_udata_buf *buf)
+{
+	return (struct nftnl_udata *)buf->data;
+}
+
+EXPORT_SYMBOL(nftnl_udata_end);
+struct nftnl_udata *nftnl_udata_end(const struct nftnl_udata_buf *buf)
+{
+	return (struct nftnl_udata *)buf->end;
+}
+
+EXPORT_SYMBOL(nftnl_udata_put);
+bool nftnl_udata_put(struct nftnl_udata_buf *buf, uint8_t type, uint32_t len,
+		     const void *value)
+{
+	struct nftnl_udata *attr;
+
+	if (len > UINT8_MAX || buf->size < len + sizeof(struct nftnl_udata))
+		return false;
+
+	attr = (struct nftnl_udata *)buf->end;
+	attr->len  = len;
+	attr->type = type;
+	memcpy(attr->value, value, len);
+
+	buf->end = (char *)nftnl_udata_next(attr);
+
+	return true;
+}
+
+EXPORT_SYMBOL(nftnl_udata_put_strz);
+bool nftnl_udata_put_strz(struct nftnl_udata_buf *buf, uint8_t type,
+			  const char *strz)
+{
+	return nftnl_udata_put(buf, type, strlen(strz) + 1, strz);
+}
+
+EXPORT_SYMBOL(nftnl_udata_put_u32);
+bool nftnl_udata_put_u32(struct nftnl_udata_buf *buf, uint8_t type,
+			 uint32_t data)
+{
+	return nftnl_udata_put(buf, type, sizeof(data), &data);
+}
+
+EXPORT_SYMBOL(nftnl_udata_type);
+uint8_t nftnl_udata_type(const struct nftnl_udata *attr)
+{
+	return attr->type;
+}
+
+EXPORT_SYMBOL(nftnl_udata_len);
+uint8_t nftnl_udata_len(const struct nftnl_udata *attr)
+{
+	return attr->len;
+}
+
+EXPORT_SYMBOL(nftnl_udata_get);
+void *nftnl_udata_get(const struct nftnl_udata *attr)
+{
+	return (void *)attr->value;
+}
+
+EXPORT_SYMBOL(nftnl_udata_get_u32);
+uint32_t nftnl_udata_get_u32(const struct nftnl_udata *attr)
+{
+	uint32_t data;
+
+	memcpy(&data, attr->value, sizeof(data));
+
+	return data;
+}
+
+EXPORT_SYMBOL(nftnl_udata_next);
+struct nftnl_udata *nftnl_udata_next(const struct nftnl_udata *attr)
+{
+	return (struct nftnl_udata *)&attr->value[attr->len];
+}
+
+EXPORT_SYMBOL(nftnl_udata_parse);
+int nftnl_udata_parse(const void *data, uint32_t data_len, nftnl_udata_cb_t cb,
+		      void *cb_data)
+{
+	int ret = 0;
+	const struct nftnl_udata *attr;
+
+	nftnl_udata_for_each_data(data, data_len, attr) {
+		ret = cb(attr, cb_data);
+		if (ret < 0)
+			return ret;
+	}
+
+	return ret;
+}
+
+EXPORT_SYMBOL(nftnl_udata_nest_start);
+struct nftnl_udata *nftnl_udata_nest_start(struct nftnl_udata_buf *buf,
+                                           uint8_t type)
+{
+	struct nftnl_udata *ud = nftnl_udata_end(buf);
+
+	nftnl_udata_put(buf, type, 0, NULL);
+
+	return ud;
+}
+
+EXPORT_SYMBOL(nftnl_udata_nest_end);
+void nftnl_udata_nest_end(struct nftnl_udata_buf *buf, struct nftnl_udata *ud)
+{
+	ud->len = buf->end - (char *)ud->value;
+}
diff --git a/src/utils.c b/src/utils.c
new file mode 100644
index 0000000..3617837
--- /dev/null
+++ b/src/utils.c
@@ -0,0 +1,332 @@
+/*
+ * (C) 2012-2013 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * (C) 2013 by Arturo Borrero Gonzalez <arturo@debian.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <internal.h>
+#include <stdlib.h>
+#include <string.h>
+#include <limits.h>
+#include <stdint.h>
+#include <arpa/inet.h>
+#include <errno.h>
+#include <inttypes.h>
+
+#include <libnftnl/common.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/nf_tables.h>
+
+static const char *const nftnl_family_str[NFPROTO_NUMPROTO] = {
+	[NFPROTO_INET]		= "inet",
+	[NFPROTO_IPV4]		= "ip",
+	[NFPROTO_ARP]		= "arp",
+	[NFPROTO_NETDEV]	= "netdev",
+	[NFPROTO_BRIDGE]	= "bridge",
+	[NFPROTO_IPV6]		= "ip6",
+};
+
+const char *nftnl_family2str(uint32_t family)
+{
+	if (family >= NFPROTO_NUMPROTO || !nftnl_family_str[family])
+		return "unknown";
+
+	return nftnl_family_str[family];
+}
+
+int nftnl_str2family(const char *family)
+{
+	int i;
+
+	for (i = 0; i < NFPROTO_NUMPROTO; i++) {
+		if (nftnl_family_str[i] == NULL)
+			continue;
+
+		if (strcmp(nftnl_family_str[i], family) == 0)
+			return i;
+	}
+
+	errno = EAFNOSUPPORT;
+	return -1;
+}
+
+static struct {
+	int len;
+	int64_t min;
+	uint64_t max;
+} basetype[] = {
+	[NFTNL_TYPE_U8]	 = { .len = sizeof(uint8_t), .max = UINT8_MAX },
+	[NFTNL_TYPE_U16] = { .len = sizeof(uint16_t), .max = UINT16_MAX },
+	[NFTNL_TYPE_U32] = { .len = sizeof(uint32_t), .max = UINT32_MAX },
+	[NFTNL_TYPE_U64] = { .len = sizeof(uint64_t), .max = UINT64_MAX },
+	[NFTNL_TYPE_S8]  = { .len = sizeof(int8_t), .min = INT8_MIN, .max = INT8_MAX },
+	[NFTNL_TYPE_S16] = { .len = sizeof(int16_t), .min = INT16_MIN, .max = INT16_MAX },
+	[NFTNL_TYPE_S32] = { .len = sizeof(int32_t), .min = INT32_MIN, .max = INT32_MAX },
+	[NFTNL_TYPE_S64] = { .len = sizeof(int64_t), .min = INT64_MIN, .max = INT64_MAX },
+};
+
+int nftnl_get_value(enum nftnl_type type, void *val, void *out)
+{
+	union {
+		uint8_t u8;
+		uint16_t u16;
+		uint32_t u32;
+		int8_t s8;
+		int16_t s16;
+		int32_t s32;
+	} values;
+	void *valuep = NULL;
+	int64_t sval;
+	uint64_t uval;
+
+	switch (type) {
+	case NFTNL_TYPE_U8:
+	case NFTNL_TYPE_U16:
+	case NFTNL_TYPE_U32:
+	case NFTNL_TYPE_U64:
+		memcpy(&uval, val, sizeof(uval));
+		if (uval > basetype[type].max) {
+			errno = ERANGE;
+			return -1;
+		}
+		break;
+	case NFTNL_TYPE_S8:
+	case NFTNL_TYPE_S16:
+	case NFTNL_TYPE_S32:
+	case NFTNL_TYPE_S64:
+		memcpy(&sval, val, sizeof(sval));
+		if (sval < basetype[type].min ||
+		    sval > (int64_t)basetype[type].max) {
+			errno = ERANGE;
+			return -1;
+		}
+		break;
+	}
+
+	switch (type) {
+	case NFTNL_TYPE_U8:
+		values.u8 = uval;
+		valuep = &values.u8;
+		break;
+	case NFTNL_TYPE_U16:
+		values.u16 = uval;
+		valuep = &values.u16;
+		break;
+	case NFTNL_TYPE_U32:
+		values.u32 = uval;
+		valuep = &values.u32;
+		break;
+	case NFTNL_TYPE_U64:
+		valuep = &uval;
+		break;
+	case NFTNL_TYPE_S8:
+		values.s8 = sval;
+		valuep = &values.s8;
+		break;
+	case NFTNL_TYPE_S16:
+		values.s16 = sval;
+		valuep = &values.s16;
+		break;
+	case NFTNL_TYPE_S32:
+		values.s32 = sval;
+		valuep = &values.s32;
+		break;
+	case NFTNL_TYPE_S64:
+		valuep = &sval;
+		break;
+	}
+	memcpy(out, valuep, basetype[type].len);
+	return 0;
+}
+
+int nftnl_strtoi(const char *string, int base, void *out, enum nftnl_type type)
+{
+	int ret;
+	int64_t sval = 0;
+	uint64_t uval = -1;
+	char *endptr;
+
+	switch (type) {
+	case NFTNL_TYPE_U8:
+	case NFTNL_TYPE_U16:
+	case NFTNL_TYPE_U32:
+	case NFTNL_TYPE_U64:
+		uval = strtoll(string, &endptr, base);
+		ret = nftnl_get_value(type, &uval, out);
+		break;
+	case NFTNL_TYPE_S8:
+	case NFTNL_TYPE_S16:
+	case NFTNL_TYPE_S32:
+	case NFTNL_TYPE_S64:
+		sval = strtoull(string, &endptr, base);
+		ret = nftnl_get_value(type, &sval, out);
+		break;
+	default:
+		errno = EINVAL;
+		return -1;
+	}
+
+	if (*endptr) {
+		errno = EINVAL;
+		return -1;
+	}
+
+	return ret;
+}
+
+const char *nftnl_verdict2str(uint32_t verdict)
+{
+	switch (verdict) {
+	case NF_ACCEPT:
+		return "accept";
+	case NF_DROP:
+		return "drop";
+	case NF_STOLEN:
+		return "stolen";
+	case NF_QUEUE:
+		return "queue";
+	case NF_REPEAT:
+		return "repeat";
+	case NF_STOP:
+		return "stop";
+	case NFT_RETURN:
+		return "return";
+	case NFT_JUMP:
+		return "jump";
+	case NFT_GOTO:
+		return "goto";
+	case NFT_CONTINUE:
+		return "continue";
+	case NFT_BREAK:
+		return "break";
+	default:
+		return "unknown";
+	}
+}
+
+int nftnl_str2verdict(const char *verdict, int *verdict_num)
+{
+	if (strcmp(verdict, "accept") == 0) {
+		*verdict_num = NF_ACCEPT;
+		return 0;
+	} else if (strcmp(verdict, "drop") == 0) {
+		*verdict_num = NF_DROP;
+		return 0;
+	} else if (strcmp(verdict, "return") == 0) {
+		*verdict_num = NFT_RETURN;
+		return 0;
+	} else if (strcmp(verdict, "jump") == 0) {
+		*verdict_num = NFT_JUMP;
+		return 0;
+	} else if (strcmp(verdict, "goto") == 0) {
+		*verdict_num = NFT_GOTO;
+		return 0;
+	}
+
+	return -1;
+}
+
+enum nftnl_cmd_type nftnl_flag2cmd(uint32_t flags)
+{
+	if (flags & NFTNL_OF_EVENT_NEW)
+		return NFTNL_CMD_ADD;
+	else if (flags & NFTNL_OF_EVENT_DEL)
+		return NFTNL_CMD_DELETE;
+
+	return NFTNL_CMD_UNSPEC;
+}
+
+static const char *cmd2tag[NFTNL_CMD_MAX] = {
+	[NFTNL_CMD_ADD]			= "add",
+	[NFTNL_CMD_INSERT]		= "insert",
+	[NFTNL_CMD_DELETE]		= "delete",
+	[NFTNL_CMD_REPLACE]		= "replace",
+	[NFTNL_CMD_FLUSH]			= "flush",
+};
+
+const char *nftnl_cmd2tag(enum nftnl_cmd_type cmd)
+{
+	if (cmd >= NFTNL_CMD_MAX)
+		return "unknown";
+
+	return cmd2tag[cmd];
+}
+
+uint32_t nftnl_str2cmd(const char *cmd)
+{
+	if (strcmp(cmd, "add") == 0)
+		return NFTNL_CMD_ADD;
+	else if (strcmp(cmd, "insert") == 0)
+		return NFTNL_CMD_INSERT;
+	else if (strcmp(cmd, "delete") == 0)
+		return NFTNL_CMD_DELETE;
+	else if (strcmp(cmd, "replace") == 0)
+		return NFTNL_CMD_REPLACE;
+	else if (strcmp(cmd, "flush") == 0)
+		return NFTNL_CMD_FLUSH;
+
+	return NFTNL_CMD_UNSPEC;
+}
+
+int nftnl_fprintf(FILE *fp, const void *obj, uint32_t cmd, uint32_t type,
+		  uint32_t flags,
+		  int (*snprintf_cb)(char *buf, size_t bufsiz, const void *obj,
+				     uint32_t cmd, uint32_t type,
+				     uint32_t flags))
+{
+	char _buf[NFTNL_SNPRINTF_BUFSIZ];
+	char *buf = _buf;
+	size_t bufsiz = sizeof(_buf);
+	int ret;
+
+	ret = snprintf_cb(buf, bufsiz, obj, cmd, type, flags);
+	if (ret <= 0)
+		goto out;
+
+	if (ret >= NFTNL_SNPRINTF_BUFSIZ) {
+		bufsiz = ret + 1;
+
+		buf = malloc(bufsiz);
+		if (buf == NULL)
+			return -1;
+
+		ret = snprintf_cb(buf, bufsiz, obj, cmd, type, flags);
+		if (ret <= 0)
+			goto out;
+	}
+
+	ret = fprintf(fp, "%s", buf);
+
+out:
+	if (buf != _buf)
+		xfree(buf);
+
+	return ret;
+}
+
+void __nftnl_assert_attr_exists(uint16_t attr, uint16_t attr_max,
+				const char *filename, int line)
+{
+	fprintf(stderr, "libnftnl: attribute %d > %d (maximum) assertion failed in %s:%d\n",
+		attr, attr_max, filename, line);
+	exit(EXIT_FAILURE);
+}
+
+void __nftnl_assert_fail(uint16_t attr, const char *filename, int line)
+{
+	fprintf(stderr, "libnftnl: attribute %d assertion failed in %s:%d\n",
+		attr, filename, line);
+	exit(EXIT_FAILURE);
+}
+
+void __noreturn __abi_breakage(const char *file, int line, const char *reason)
+{
+       fprintf(stderr, "nf_tables kernel ABI is broken, contact your vendor.\n"
+		       "%s:%d reason: %s\n", file, line, reason);
+       exit(EXIT_FAILURE);
+}