iptable_filter.c revision 2e4e6a17af35be359cc8f1c924f8f198fbd478cc
1/* 2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 3 * 4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 */ 12 13#include <linux/module.h> 14#include <linux/moduleparam.h> 15#include <linux/netfilter_ipv4/ip_tables.h> 16 17MODULE_LICENSE("GPL"); 18MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 19MODULE_DESCRIPTION("iptables filter table"); 20 21#define FILTER_VALID_HOOKS ((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)) 22 23static struct 24{ 25 struct ipt_replace repl; 26 struct ipt_standard entries[3]; 27 struct ipt_error term; 28} initial_table __initdata 29= { { "filter", FILTER_VALID_HOOKS, 4, 30 sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error), 31 { [NF_IP_LOCAL_IN] = 0, 32 [NF_IP_FORWARD] = sizeof(struct ipt_standard), 33 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 }, 34 { [NF_IP_LOCAL_IN] = 0, 35 [NF_IP_FORWARD] = sizeof(struct ipt_standard), 36 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2 }, 37 0, NULL, { } }, 38 { 39 /* LOCAL_IN */ 40 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 41 0, 42 sizeof(struct ipt_entry), 43 sizeof(struct ipt_standard), 44 0, { 0, 0 }, { } }, 45 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, 46 -NF_ACCEPT - 1 } }, 47 /* FORWARD */ 48 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 49 0, 50 sizeof(struct ipt_entry), 51 sizeof(struct ipt_standard), 52 0, { 0, 0 }, { } }, 53 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, 54 -NF_ACCEPT - 1 } }, 55 /* LOCAL_OUT */ 56 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 57 0, 58 sizeof(struct ipt_entry), 59 sizeof(struct ipt_standard), 60 0, { 0, 0 }, { } }, 61 { { { { IPT_ALIGN(sizeof(struct ipt_standard_target)), "" } }, { } }, 62 -NF_ACCEPT - 1 } } 63 }, 64 /* ERROR */ 65 { { { { 0 }, { 0 }, { 0 }, { 0 }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 66 0, 67 sizeof(struct ipt_entry), 68 sizeof(struct ipt_error), 69 0, { 0, 0 }, { } }, 70 { { { { IPT_ALIGN(sizeof(struct ipt_error_target)), IPT_ERROR_TARGET } }, 71 { } }, 72 "ERROR" 73 } 74 } 75}; 76 77static struct ipt_table packet_filter = { 78 .name = "filter", 79 .valid_hooks = FILTER_VALID_HOOKS, 80 .lock = RW_LOCK_UNLOCKED, 81 .me = THIS_MODULE, 82 .af = AF_INET, 83}; 84 85/* The work comes in here from netfilter.c. */ 86static unsigned int 87ipt_hook(unsigned int hook, 88 struct sk_buff **pskb, 89 const struct net_device *in, 90 const struct net_device *out, 91 int (*okfn)(struct sk_buff *)) 92{ 93 return ipt_do_table(pskb, hook, in, out, &packet_filter, NULL); 94} 95 96static unsigned int 97ipt_local_out_hook(unsigned int hook, 98 struct sk_buff **pskb, 99 const struct net_device *in, 100 const struct net_device *out, 101 int (*okfn)(struct sk_buff *)) 102{ 103 /* root is playing with raw sockets. */ 104 if ((*pskb)->len < sizeof(struct iphdr) 105 || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) { 106 if (net_ratelimit()) 107 printk("ipt_hook: happy cracking.\n"); 108 return NF_ACCEPT; 109 } 110 111 return ipt_do_table(pskb, hook, in, out, &packet_filter, NULL); 112} 113 114static struct nf_hook_ops ipt_ops[] = { 115 { 116 .hook = ipt_hook, 117 .owner = THIS_MODULE, 118 .pf = PF_INET, 119 .hooknum = NF_IP_LOCAL_IN, 120 .priority = NF_IP_PRI_FILTER, 121 }, 122 { 123 .hook = ipt_hook, 124 .owner = THIS_MODULE, 125 .pf = PF_INET, 126 .hooknum = NF_IP_FORWARD, 127 .priority = NF_IP_PRI_FILTER, 128 }, 129 { 130 .hook = ipt_local_out_hook, 131 .owner = THIS_MODULE, 132 .pf = PF_INET, 133 .hooknum = NF_IP_LOCAL_OUT, 134 .priority = NF_IP_PRI_FILTER, 135 }, 136}; 137 138/* Default to forward because I got too much mail already. */ 139static int forward = NF_ACCEPT; 140module_param(forward, bool, 0000); 141 142static int __init init(void) 143{ 144 int ret; 145 146 if (forward < 0 || forward > NF_MAX_VERDICT) { 147 printk("iptables forward must be 0 or 1\n"); 148 return -EINVAL; 149 } 150 151 /* Entry 1 is the FORWARD hook */ 152 initial_table.entries[1].target.verdict = -forward - 1; 153 154 /* Register table */ 155 ret = ipt_register_table(&packet_filter, &initial_table.repl); 156 if (ret < 0) 157 return ret; 158 159 /* Register hooks */ 160 ret = nf_register_hook(&ipt_ops[0]); 161 if (ret < 0) 162 goto cleanup_table; 163 164 ret = nf_register_hook(&ipt_ops[1]); 165 if (ret < 0) 166 goto cleanup_hook0; 167 168 ret = nf_register_hook(&ipt_ops[2]); 169 if (ret < 0) 170 goto cleanup_hook1; 171 172 return ret; 173 174 cleanup_hook1: 175 nf_unregister_hook(&ipt_ops[1]); 176 cleanup_hook0: 177 nf_unregister_hook(&ipt_ops[0]); 178 cleanup_table: 179 ipt_unregister_table(&packet_filter); 180 181 return ret; 182} 183 184static void __exit fini(void) 185{ 186 unsigned int i; 187 188 for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++) 189 nf_unregister_hook(&ipt_ops[i]); 190 191 ipt_unregister_table(&packet_filter); 192} 193 194module_init(init); 195module_exit(fini); 196