1/* 2 * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT . 3 * 4 * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 5 */ 6#include <linux/module.h> 7#include <linux/netfilter_ipv4/ip_tables.h> 8#include <linux/slab.h> 9#include <net/ip.h> 10 11#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT)) 12 13static const struct xt_table packet_raw = { 14 .name = "raw", 15 .valid_hooks = RAW_VALID_HOOKS, 16 .me = THIS_MODULE, 17 .af = NFPROTO_IPV4, 18 .priority = NF_IP_PRI_RAW, 19}; 20 21/* The work comes in here from netfilter.c. */ 22static unsigned int 23iptable_raw_hook(unsigned int hook, struct sk_buff *skb, 24 const struct net_device *in, const struct net_device *out, 25 int (*okfn)(struct sk_buff *)) 26{ 27 const struct net *net; 28 29 if (hook == NF_INET_LOCAL_OUT && 30 (skb->len < sizeof(struct iphdr) || 31 ip_hdrlen(skb) < sizeof(struct iphdr))) 32 /* root is playing with raw sockets. */ 33 return NF_ACCEPT; 34 35 net = dev_net((in != NULL) ? in : out); 36 return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_raw); 37} 38 39static struct nf_hook_ops *rawtable_ops __read_mostly; 40 41static int __net_init iptable_raw_net_init(struct net *net) 42{ 43 struct ipt_replace *repl; 44 45 repl = ipt_alloc_initial_table(&packet_raw); 46 if (repl == NULL) 47 return -ENOMEM; 48 net->ipv4.iptable_raw = 49 ipt_register_table(net, &packet_raw, repl); 50 kfree(repl); 51 if (IS_ERR(net->ipv4.iptable_raw)) 52 return PTR_ERR(net->ipv4.iptable_raw); 53 return 0; 54} 55 56static void __net_exit iptable_raw_net_exit(struct net *net) 57{ 58 ipt_unregister_table(net, net->ipv4.iptable_raw); 59} 60 61static struct pernet_operations iptable_raw_net_ops = { 62 .init = iptable_raw_net_init, 63 .exit = iptable_raw_net_exit, 64}; 65 66static int __init iptable_raw_init(void) 67{ 68 int ret; 69 70 ret = register_pernet_subsys(&iptable_raw_net_ops); 71 if (ret < 0) 72 return ret; 73 74 /* Register hooks */ 75 rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook); 76 if (IS_ERR(rawtable_ops)) { 77 ret = PTR_ERR(rawtable_ops); 78 goto cleanup_table; 79 } 80 81 return ret; 82 83 cleanup_table: 84 unregister_pernet_subsys(&iptable_raw_net_ops); 85 return ret; 86} 87 88static void __exit iptable_raw_fini(void) 89{ 90 xt_hook_unlink(&packet_raw, rawtable_ops); 91 unregister_pernet_subsys(&iptable_raw_net_ops); 92} 93 94module_init(iptable_raw_init); 95module_exit(iptable_raw_fini); 96MODULE_LICENSE("GPL"); 97