iptable_raw.c revision 2b95efe7f6bb750256a702cc32d33b0cb2cd8223
1e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki/* 21da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT . 31da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 41da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 51da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 61da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/module.h> 71da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/netfilter_ipv4/ip_tables.h> 8802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy#include <net/ip.h> 91da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 106e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT)) 111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1235aad0ffdf548617940ca1e78be1f2e0bafc4496Jan Engelhardtstatic const struct 131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_replace repl; 151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_standard entries[2]; 161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_error term; 179335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan} initial_table __net_initdata = { 181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .repl = { 19e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .name = "raw", 20e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .valid_hooks = RAW_VALID_HOOKS, 211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .num_entries = 3, 221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error), 23e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .hook_entry = { 246e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_PRE_ROUTING] = 0, 256e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) 263c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy }, 27e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .underflow = { 286e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_PRE_ROUTING] = 0, 296e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) 303c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy }, 311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .entries = { 333c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */ 343c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */ 351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 363c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy .term = IPT_ERROR_INIT, /* ERROR */ 371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3935aad0ffdf548617940ca1e78be1f2e0bafc4496Jan Engelhardtstatic const struct xt_table packet_raw = { 40e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .name = "raw", 41e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .valid_hooks = RAW_VALID_HOOKS, 422e4e6a17af35be359cc8f1c924f8f198fbd478ccHarald Welte .me = THIS_MODULE, 43f88e6a8a50a603f8347343e75d035889784a507cJan Engelhardt .af = NFPROTO_IPV4, 442b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardt .priority = NF_IP_PRI_RAW, 451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* The work comes in here from netfilter.c. */ 481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic unsigned int 49737535c5cf3524e4bfaa91e22edefd52eccabbceJan Engelhardtiptable_raw_hook(unsigned int hook, struct sk_buff *skb, 50737535c5cf3524e4bfaa91e22edefd52eccabbceJan Engelhardt const struct net_device *in, const struct net_device *out, 51737535c5cf3524e4bfaa91e22edefd52eccabbceJan Engelhardt int (*okfn)(struct sk_buff *)) 521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 532b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt const struct net *net; 541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 552b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt if (hook == NF_INET_LOCAL_OUT && 562b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt (skb->len < sizeof(struct iphdr) || 572b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt ip_hdrlen(skb) < sizeof(struct iphdr))) 582b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt /* root is playing with raw sockets. */ 59802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy return NF_ACCEPT; 602b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt 612b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt net = dev_net((in != NULL) ? in : out); 622b21e051472fdb4680076278b2ccf63ebc1cc3bcJan Engelhardt return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw); 63802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy} 64802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy 652b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardtstatic struct nf_hook_ops *rawtable_ops __read_mostly; 661da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 679335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyanstatic int __net_init iptable_raw_net_init(struct net *net) 689335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan{ 699335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan /* Register table */ 709335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan net->ipv4.iptable_raw = 719335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan ipt_register_table(net, &packet_raw, &initial_table.repl); 729335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan if (IS_ERR(net->ipv4.iptable_raw)) 739335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan return PTR_ERR(net->ipv4.iptable_raw); 749335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan return 0; 759335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan} 769335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan 779335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyanstatic void __net_exit iptable_raw_net_exit(struct net *net) 789335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan{ 79f54e9367f8499a9bf6b2afbc0dce63e1d53c525aAlexey Dobriyan ipt_unregister_table(net, net->ipv4.iptable_raw); 809335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan} 819335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan 829335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyanstatic struct pernet_operations iptable_raw_net_ops = { 839335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan .init = iptable_raw_net_init, 849335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan .exit = iptable_raw_net_exit, 859335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan}; 869335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan 8765b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonstatic int __init iptable_raw_init(void) 881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int ret; 901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 919335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan ret = register_pernet_subsys(&iptable_raw_net_ops); 929335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan if (ret < 0) 939335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan return ret; 941da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 951da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Register hooks */ 962b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardt rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook); 972b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardt if (IS_ERR(rawtable_ops)) { 982b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardt ret = PTR_ERR(rawtable_ops); 991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto cleanup_table; 1002b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardt } 1011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1041da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cleanup_table: 1059335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan unregister_pernet_subsys(&iptable_raw_net_ops); 1061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 10965b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonstatic void __exit iptable_raw_fini(void) 1101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1112b95efe7f6bb750256a702cc32d33b0cb2cd8223Jan Engelhardt xt_hook_unlink(&packet_raw, rawtable_ops); 1129335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan unregister_pernet_subsys(&iptable_raw_net_ops); 1131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 11565b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonmodule_init(iptable_raw_init); 11665b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonmodule_exit(iptable_raw_fini); 1171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus TorvaldsMODULE_LICENSE("GPL"); 118