1/* 2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 3 * 4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 */ 11 12#include <linux/module.h> 13#include <linux/moduleparam.h> 14#include <linux/netfilter_ipv6/ip6_tables.h> 15#include <linux/slab.h> 16 17MODULE_LICENSE("GPL"); 18MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 19MODULE_DESCRIPTION("ip6tables filter table"); 20 21#define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \ 22 (1 << NF_INET_FORWARD) | \ 23 (1 << NF_INET_LOCAL_OUT)) 24 25static const struct xt_table packet_filter = { 26 .name = "filter", 27 .valid_hooks = FILTER_VALID_HOOKS, 28 .me = THIS_MODULE, 29 .af = NFPROTO_IPV6, 30 .priority = NF_IP6_PRI_FILTER, 31}; 32 33/* The work comes in here from netfilter.c. */ 34static unsigned int 35ip6table_filter_hook(unsigned int hook, struct sk_buff *skb, 36 const struct net_device *in, const struct net_device *out, 37 int (*okfn)(struct sk_buff *)) 38{ 39 const struct net *net = dev_net((in != NULL) ? in : out); 40 41 return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter); 42} 43 44static struct nf_hook_ops *filter_ops __read_mostly; 45 46/* Default to forward because I got too much mail already. */ 47static int forward = NF_ACCEPT; 48module_param(forward, bool, 0000); 49 50static int __net_init ip6table_filter_net_init(struct net *net) 51{ 52 struct ip6t_replace *repl; 53 54 repl = ip6t_alloc_initial_table(&packet_filter); 55 if (repl == NULL) 56 return -ENOMEM; 57 /* Entry 1 is the FORWARD hook */ 58 ((struct ip6t_standard *)repl->entries)[1].target.verdict = 59 -forward - 1; 60 61 net->ipv6.ip6table_filter = 62 ip6t_register_table(net, &packet_filter, repl); 63 kfree(repl); 64 if (IS_ERR(net->ipv6.ip6table_filter)) 65 return PTR_ERR(net->ipv6.ip6table_filter); 66 return 0; 67} 68 69static void __net_exit ip6table_filter_net_exit(struct net *net) 70{ 71 ip6t_unregister_table(net, net->ipv6.ip6table_filter); 72} 73 74static struct pernet_operations ip6table_filter_net_ops = { 75 .init = ip6table_filter_net_init, 76 .exit = ip6table_filter_net_exit, 77}; 78 79static int __init ip6table_filter_init(void) 80{ 81 int ret; 82 83 if (forward < 0 || forward > NF_MAX_VERDICT) { 84 pr_err("iptables forward must be 0 or 1\n"); 85 return -EINVAL; 86 } 87 88 ret = register_pernet_subsys(&ip6table_filter_net_ops); 89 if (ret < 0) 90 return ret; 91 92 /* Register hooks */ 93 filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook); 94 if (IS_ERR(filter_ops)) { 95 ret = PTR_ERR(filter_ops); 96 goto cleanup_table; 97 } 98 99 return ret; 100 101 cleanup_table: 102 unregister_pernet_subsys(&ip6table_filter_net_ops); 103 return ret; 104} 105 106static void __exit ip6table_filter_fini(void) 107{ 108 xt_hook_unlink(&packet_filter, filter_ops); 109 unregister_pernet_subsys(&ip6table_filter_net_ops); 110} 111 112module_init(ip6table_filter_init); 113module_exit(ip6table_filter_fini); 114