1/* 2 * ebtable_filter 3 * 4 * Authors: 5 * Bart De Schuymer <bdschuym@pandora.be> 6 * 7 * April, 2002 8 * 9 */ 10 11#include <linux/netfilter_bridge/ebtables.h> 12#include <linux/module.h> 13 14#define FILTER_VALID_HOOKS ((1 << NF_BR_LOCAL_IN) | (1 << NF_BR_FORWARD) | \ 15 (1 << NF_BR_LOCAL_OUT)) 16 17static struct ebt_entries initial_chains[] = { 18 { 19 .name = "INPUT", 20 .policy = EBT_ACCEPT, 21 }, 22 { 23 .name = "FORWARD", 24 .policy = EBT_ACCEPT, 25 }, 26 { 27 .name = "OUTPUT", 28 .policy = EBT_ACCEPT, 29 }, 30}; 31 32static struct ebt_replace_kernel initial_table = { 33 .name = "filter", 34 .valid_hooks = FILTER_VALID_HOOKS, 35 .entries_size = 3 * sizeof(struct ebt_entries), 36 .hook_entry = { 37 [NF_BR_LOCAL_IN] = &initial_chains[0], 38 [NF_BR_FORWARD] = &initial_chains[1], 39 [NF_BR_LOCAL_OUT] = &initial_chains[2], 40 }, 41 .entries = (char *)initial_chains, 42}; 43 44static int check(const struct ebt_table_info *info, unsigned int valid_hooks) 45{ 46 if (valid_hooks & ~FILTER_VALID_HOOKS) 47 return -EINVAL; 48 return 0; 49} 50 51static const struct ebt_table frame_filter = { 52 .name = "filter", 53 .table = &initial_table, 54 .valid_hooks = FILTER_VALID_HOOKS, 55 .check = check, 56 .me = THIS_MODULE, 57}; 58 59static unsigned int 60ebt_in_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, 61 const struct net_device *in, const struct net_device *out, 62 int (*okfn)(struct sk_buff *)) 63{ 64 return ebt_do_table(ops->hooknum, skb, in, out, 65 dev_net(in)->xt.frame_filter); 66} 67 68static unsigned int 69ebt_out_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, 70 const struct net_device *in, const struct net_device *out, 71 int (*okfn)(struct sk_buff *)) 72{ 73 return ebt_do_table(ops->hooknum, skb, in, out, 74 dev_net(out)->xt.frame_filter); 75} 76 77static struct nf_hook_ops ebt_ops_filter[] __read_mostly = { 78 { 79 .hook = ebt_in_hook, 80 .owner = THIS_MODULE, 81 .pf = NFPROTO_BRIDGE, 82 .hooknum = NF_BR_LOCAL_IN, 83 .priority = NF_BR_PRI_FILTER_BRIDGED, 84 }, 85 { 86 .hook = ebt_in_hook, 87 .owner = THIS_MODULE, 88 .pf = NFPROTO_BRIDGE, 89 .hooknum = NF_BR_FORWARD, 90 .priority = NF_BR_PRI_FILTER_BRIDGED, 91 }, 92 { 93 .hook = ebt_out_hook, 94 .owner = THIS_MODULE, 95 .pf = NFPROTO_BRIDGE, 96 .hooknum = NF_BR_LOCAL_OUT, 97 .priority = NF_BR_PRI_FILTER_OTHER, 98 }, 99}; 100 101static int __net_init frame_filter_net_init(struct net *net) 102{ 103 net->xt.frame_filter = ebt_register_table(net, &frame_filter); 104 return PTR_ERR_OR_ZERO(net->xt.frame_filter); 105} 106 107static void __net_exit frame_filter_net_exit(struct net *net) 108{ 109 ebt_unregister_table(net, net->xt.frame_filter); 110} 111 112static struct pernet_operations frame_filter_net_ops = { 113 .init = frame_filter_net_init, 114 .exit = frame_filter_net_exit, 115}; 116 117static int __init ebtable_filter_init(void) 118{ 119 int ret; 120 121 ret = register_pernet_subsys(&frame_filter_net_ops); 122 if (ret < 0) 123 return ret; 124 ret = nf_register_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter)); 125 if (ret < 0) 126 unregister_pernet_subsys(&frame_filter_net_ops); 127 return ret; 128} 129 130static void __exit ebtable_filter_fini(void) 131{ 132 nf_unregister_hooks(ebt_ops_filter, ARRAY_SIZE(ebt_ops_filter)); 133 unregister_pernet_subsys(&frame_filter_net_ops); 134} 135 136module_init(ebtable_filter_init); 137module_exit(ebtable_filter_fini); 138MODULE_LICENSE("GPL"); 139