iptable_raw.c revision 802169a4b0f71d25a0f798a9c0657a565b1e79bc
1e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki/* 21da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT . 31da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 41da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 51da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 61da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/module.h> 71da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/netfilter_ipv4/ip_tables.h> 8802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy#include <net/ip.h> 91da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT)) 111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic struct 131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_replace repl; 151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_standard entries[2]; 161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_error term; 171da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} initial_table __initdata = { 181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .repl = { 19e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .name = "raw", 20e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .valid_hooks = RAW_VALID_HOOKS, 211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .num_entries = 3, 221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error), 23e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .hook_entry = { 241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds [NF_IP_PRE_ROUTING] = 0, 253c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) 263c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy }, 27e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .underflow = { 281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds [NF_IP_PRE_ROUTING] = 0, 293c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) 303c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy }, 311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .entries = { 333c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */ 343c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */ 351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 363c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy .term = IPT_ERROR_INIT, /* ERROR */ 371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 39e60a13e030867078f3c9fef8dca6cd8a5b883478Jan Engelhardtstatic struct xt_table packet_raw = { 40e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .name = "raw", 41e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .valid_hooks = RAW_VALID_HOOKS, 42e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .lock = RW_LOCK_UNLOCKED, 432e4e6a17af35be359cc8f1c924f8f198fbd478ccHarald Welte .me = THIS_MODULE, 442e4e6a17af35be359cc8f1c924f8f198fbd478ccHarald Welte .af = AF_INET, 451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* The work comes in here from netfilter.c. */ 481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic unsigned int 491da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsipt_hook(unsigned int hook, 501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct sk_buff **pskb, 511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds const struct net_device *in, 521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds const struct net_device *out, 531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int (*okfn)(struct sk_buff *)) 541da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 55fe1cb10873b44cf89082465823ee6d4d4ac63ad7Patrick McHardy return ipt_do_table(pskb, hook, in, out, &packet_raw); 561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 58802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardystatic unsigned int 59802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardyipt_local_hook(unsigned int hook, 60802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy struct sk_buff **pskb, 61802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy const struct net_device *in, 62802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy const struct net_device *out, 63802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy int (*okfn)(struct sk_buff *)) 64802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy{ 65802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy /* root is playing with raw sockets. */ 66802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy if ((*pskb)->len < sizeof(struct iphdr) || 67802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy ip_hdrlen(*pskb) < sizeof(struct iphdr)) { 68802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy if (net_ratelimit()) 69802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy printk("iptable_raw: ignoring short SOCK_RAW" 70802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy "packet.\n"); 71802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy return NF_ACCEPT; 72802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy } 73802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy return ipt_do_table(pskb, hook, in, out, &packet_raw); 74802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy} 75802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy 761da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* 'raw' is the very first table. */ 771da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic struct nf_hook_ops ipt_ops[] = { 781da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 79964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .hook = ipt_hook, 80964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .pf = PF_INET, 81964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .hooknum = NF_IP_PRE_ROUTING, 82964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .priority = NF_IP_PRI_RAW, 83964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .owner = THIS_MODULE, 841da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 851da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 86802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy .hook = ipt_local_hook, 87964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .pf = PF_INET, 88964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .hooknum = NF_IP_LOCAL_OUT, 89964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .priority = NF_IP_PRI_RAW, 90964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .owner = THIS_MODULE, 911da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 921da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 931da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 9465b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonstatic int __init iptable_raw_init(void) 951da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 961da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int ret; 971da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 981da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Register table */ 991da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ret = ipt_register_table(&packet_raw, &initial_table.repl); 1001da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (ret < 0) 1011da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1021da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1031da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Register hooks */ 104964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 1051da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (ret < 0) 1061da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto cleanup_table; 1071da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1081da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1091da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1101da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cleanup_table: 1111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipt_unregister_table(&packet_raw); 1121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 11565b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonstatic void __exit iptable_raw_fini(void) 1161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 117964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 1181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds ipt_unregister_table(&packet_raw); 1191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1201da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 12165b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonmodule_init(iptable_raw_init); 12265b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonmodule_exit(iptable_raw_fini); 1231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus TorvaldsMODULE_LICENSE("GPL"); 124