iptable_raw.c revision f54e9367f8499a9bf6b2afbc0dce63e1d53c525a
1e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki/* 21da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT . 31da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * 41da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 51da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds */ 61da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/module.h> 71da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds#include <linux/netfilter_ipv4/ip_tables.h> 8802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy#include <net/ip.h> 91da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 106e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT)) 111da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1235aad0ffdf548617940ca1e78be1f2e0bafc4496Jan Engelhardtstatic const struct 131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_replace repl; 151da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_standard entries[2]; 161da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds struct ipt_error term; 179335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan} initial_table __net_initdata = { 181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .repl = { 19e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .name = "raw", 20e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .valid_hooks = RAW_VALID_HOOKS, 211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .num_entries = 3, 221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error), 23e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .hook_entry = { 246e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_PRE_ROUTING] = 0, 256e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) 263c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy }, 27e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .underflow = { 286e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_PRE_ROUTING] = 0, 296e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy [NF_INET_LOCAL_OUT] = sizeof(struct ipt_standard) 303c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy }, 311da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds .entries = { 333c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy IPT_STANDARD_INIT(NF_ACCEPT), /* PRE_ROUTING */ 343c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */ 351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 363c2ad469c317147fc1de19579f8173ddb68a9e91Patrick McHardy .term = IPT_ERROR_INIT, /* ERROR */ 371da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 381da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 3935aad0ffdf548617940ca1e78be1f2e0bafc4496Jan Engelhardtstatic const struct xt_table packet_raw = { 40e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .name = "raw", 41e905a9edab7f4f14f9213b52234e4a346c690911YOSHIFUJI Hideaki .valid_hooks = RAW_VALID_HOOKS, 422e4e6a17af35be359cc8f1c924f8f198fbd478ccHarald Welte .me = THIS_MODULE, 43f88e6a8a50a603f8347343e75d035889784a507cJan Engelhardt .af = NFPROTO_IPV4, 441da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 451da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 461da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* The work comes in here from netfilter.c. */ 471da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsstatic unsigned int 481da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvaldsipt_hook(unsigned int hook, 493db05fea51cdb162cfa8f69e9cfb9e228919d2a9Herbert Xu struct sk_buff *skb, 501da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds const struct net_device *in, 511da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds const struct net_device *out, 521da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int (*okfn)(struct sk_buff *)) 531da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 54666953df353194bef76086fa3f126241cbac3e3aAlexey Dobriyan return ipt_do_table(skb, hook, in, out, 5548dc7865aa3db9404aedc8677d9daf8f8f469ab0Alexey Dobriyan dev_net(in)->ipv4.iptable_raw); 561da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 571da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 58802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardystatic unsigned int 59802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardyipt_local_hook(unsigned int hook, 603db05fea51cdb162cfa8f69e9cfb9e228919d2a9Herbert Xu struct sk_buff *skb, 61802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy const struct net_device *in, 62802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy const struct net_device *out, 63802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy int (*okfn)(struct sk_buff *)) 64802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy{ 65802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy /* root is playing with raw sockets. */ 663db05fea51cdb162cfa8f69e9cfb9e228919d2a9Herbert Xu if (skb->len < sizeof(struct iphdr) || 6788843104a19d5896bf67ab6bd685e976240dd04aPatrick McHardy ip_hdrlen(skb) < sizeof(struct iphdr)) 68802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy return NF_ACCEPT; 69666953df353194bef76086fa3f126241cbac3e3aAlexey Dobriyan return ipt_do_table(skb, hook, in, out, 7048dc7865aa3db9404aedc8677d9daf8f8f469ab0Alexey Dobriyan dev_net(out)->ipv4.iptable_raw); 71802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy} 72802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy 731da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds/* 'raw' is the very first table. */ 741999414a4ece2b8cea3fb3c4dc8fe06796256269Patrick McHardystatic struct nf_hook_ops ipt_ops[] __read_mostly = { 751da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 76964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .hook = ipt_hook, 7724c232d8e911ef6189e02da411dc2b72cb03bfcfJan Engelhardt .pf = NFPROTO_IPV4, 786e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy .hooknum = NF_INET_PRE_ROUTING, 79964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .priority = NF_IP_PRI_RAW, 80964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .owner = THIS_MODULE, 811da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 821da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds { 83802169a4b0f71d25a0f798a9c0657a565b1e79bcPatrick McHardy .hook = ipt_local_hook, 8424c232d8e911ef6189e02da411dc2b72cb03bfcfJan Engelhardt .pf = NFPROTO_IPV4, 856e23ae2a48750bda407a4a58f52a4865d7308bf5Patrick McHardy .hooknum = NF_INET_LOCAL_OUT, 86964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .priority = NF_IP_PRI_RAW, 87964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy .owner = THIS_MODULE, 881da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds }, 891da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds}; 901da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 919335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyanstatic int __net_init iptable_raw_net_init(struct net *net) 929335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan{ 939335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan /* Register table */ 949335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan net->ipv4.iptable_raw = 959335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan ipt_register_table(net, &packet_raw, &initial_table.repl); 969335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan if (IS_ERR(net->ipv4.iptable_raw)) 979335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan return PTR_ERR(net->ipv4.iptable_raw); 989335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan return 0; 999335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan} 1009335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan 1019335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyanstatic void __net_exit iptable_raw_net_exit(struct net *net) 1029335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan{ 103f54e9367f8499a9bf6b2afbc0dce63e1d53c525aAlexey Dobriyan ipt_unregister_table(net, net->ipv4.iptable_raw); 1049335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan} 1059335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan 1069335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyanstatic struct pernet_operations iptable_raw_net_ops = { 1079335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan .init = iptable_raw_net_init, 1089335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan .exit = iptable_raw_net_exit, 1099335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan}; 1109335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan 11165b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonstatic int __init iptable_raw_init(void) 1121da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 1131da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds int ret; 1141da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1159335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan ret = register_pernet_subsys(&iptable_raw_net_ops); 1169335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan if (ret < 0) 1179335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan return ret; 1181da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1191da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds /* Register hooks */ 120964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 1211da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds if (ret < 0) 1221da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds goto cleanup_table; 1231da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1241da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1251da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 1261da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds cleanup_table: 1279335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan unregister_pernet_subsys(&iptable_raw_net_ops); 1281da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds return ret; 1291da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1301da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 13165b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonstatic void __exit iptable_raw_fini(void) 1321da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds{ 133964ddaa10de8f3aeed12bc2a30726514ff309e64Patrick McHardy nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 1349335f047fe61587ec82ff12fbb1220bcfdd32006Alexey Dobriyan unregister_pernet_subsys(&iptable_raw_net_ops); 1351da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds} 1361da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus Torvalds 13765b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonmodule_init(iptable_raw_init); 13865b4b4e81a5094d52cbe372b887b1779abe53f9bAndrew Mortonmodule_exit(iptable_raw_fini); 1391da177e4c3f41524e886b7f1b8a0c1fc7321cacLinus TorvaldsMODULE_LICENSE("GPL"); 140