iptable_filter.c revision 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
1/* 2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 3 * 4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 */ 12 13#include <linux/module.h> 14#include <linux/moduleparam.h> 15#include <linux/netfilter_ipv4/ip_tables.h> 16 17MODULE_LICENSE("GPL"); 18MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 19MODULE_DESCRIPTION("iptables filter table"); 20 21#define FILTER_VALID_HOOKS ((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)) 22 23static struct 24{ 25 struct ipt_replace repl; 26 struct ipt_standard entries[3]; 27 struct ipt_error term; 28} initial_table __initdata 29= { { "filter", FILTER_VALID_HOOKS, 4, 30 sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error), 31 { [NF_IP_LOCAL_IN] = 0, 32 [NF_IP_FORWARD] = sizeof(struct ipt_standard), 33 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 }, 34 { [NF_IP_LOCAL_IN] = 0, 35 [NF_IP_FORWARD] = sizeof(struct ipt_standard), 36 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 }, 37 0, NULL, { } }, 38 { 39 /* LOCAL_IN */ 40 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 41 0, 42 sizeof(struct ipt_entry), 43 sizeof(struct ipt_standard), 44 0, { 0, 0 }, { } }, 45 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, 46 -NF_ACCEPT - 1 } }, 47 /* FORWARD */ 48 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 49 0, 50 sizeof(struct ipt_entry), 51 sizeof(struct ipt_standard), 52 0, { 0, 0 }, { } }, 53 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, 54 -NF_ACCEPT - 1 } }, 55 /* LOCAL_OUT */ 56 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 57 0, 58 sizeof(struct ipt_entry), 59 sizeof(struct ipt_standard), 60 0, { 0, 0 }, { } }, 61 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, 62 -NF_ACCEPT - 1 } } 63 }, 64 /* ERROR */ 65 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 66 0, 67 sizeof(struct ipt_entry), 68 sizeof(struct ipt_error), 69 0, { 0, 0 }, { } }, 70 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } }, 71 { } }, 72 "ERROR" 73 } 74 } 75}; 76 77static struct ipt_table packet_filter = { 78 .name = "filter", 79 .valid_hooks = FILTER_VALID_HOOKS, 80 .lock = RW_LOCK_UNLOCKED, 81 .me = THIS_MODULE 82}; 83 84/* The work comes in here from netfilter.c. */ 85static unsigned int 86ipt_hook(unsigned int hook, 87 struct sk_buff **pskb, 88 const struct net_device *in, 89 const struct net_device *out, 90 int (*okfn)(struct sk_buff *)) 91{ 92 return ipt_do_table(pskb, hook, in, out, &packet_filter, NULL); 93} 94 95static unsigned int 96ipt_local_out_hook(unsigned int hook, 97 struct sk_buff **pskb, 98 const struct net_device *in, 99 const struct net_device *out, 100 int (*okfn)(struct sk_buff *)) 101{ 102 /* root is playing with raw sockets. */ 103 if ((*pskb)->len < sizeof(struct iphdr) 104 || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) { 105 if (net_ratelimit()) 106 printk("ipt_hook: happy cracking.\n"); 107 return NF_ACCEPT; 108 } 109 110 return ipt_do_table(pskb, hook, in, out, &packet_filter, NULL); 111} 112 113static struct nf_hook_ops ipt_ops[] = { 114 { 115 .hook = ipt_hook, 116 .owner = THIS_MODULE, 117 .pf = PF_INET, 118 .hooknum = NF_IP_LOCAL_IN, 119 .priority = NF_IP_PRI_FILTER, 120 }, 121 { 122 .hook = ipt_hook, 123 .owner = THIS_MODULE, 124 .pf = PF_INET, 125 .hooknum = NF_IP_FORWARD, 126 .priority = NF_IP_PRI_FILTER, 127 }, 128 { 129 .hook = ipt_local_out_hook, 130 .owner = THIS_MODULE, 131 .pf = PF_INET, 132 .hooknum = NF_IP_LOCAL_OUT, 133 .priority = NF_IP_PRI_FILTER, 134 }, 135}; 136 137/* Default to forward because I got too much mail already. */ 138static int forward = NF_ACCEPT; 139module_param(forward, bool, 0000); 140 141static int __init init(void) 142{ 143 int ret; 144 145 if (forward < 0 || forward > NF_MAX_VERDICT) { 146 printk("iptables forward must be 0 or 1\n"); 147 return -EINVAL; 148 } 149 150 /* Entry 1 is the FORWARD hook */ 151 initial_table.entries[1].target.verdict = -forward - 1; 152 153 /* Register table */ 154 ret = ipt_register_table(&packet_filter, &initial_table.repl); 155 if (ret < 0) 156 return ret; 157 158 /* Register hooks */ 159 ret = nf_register_hook(&ipt_ops[0]); 160 if (ret < 0) 161 goto cleanup_table; 162 163 ret = nf_register_hook(&ipt_ops[1]); 164 if (ret < 0) 165 goto cleanup_hook0; 166 167 ret = nf_register_hook(&ipt_ops[2]); 168 if (ret < 0) 169 goto cleanup_hook1; 170 171 return ret; 172 173 cleanup_hook1: 174 nf_unregister_hook(&ipt_ops[1]); 175 cleanup_hook0: 176 nf_unregister_hook(&ipt_ops[0]); 177 cleanup_table: 178 ipt_unregister_table(&packet_filter); 179 180 return ret; 181} 182 183static void __exit fini(void) 184{ 185 unsigned int i; 186 187 for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++) 188 nf_unregister_hook(&ipt_ops[i]); 189 190 ipt_unregister_table(&packet_filter); 191} 192 193module_init(init); 194module_exit(fini); 195