1/* 2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 3 * 4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 6 * 7 * This program is free software; you can redistribute it and/or modify 8 * it under the terms of the GNU General Public License version 2 as 9 * published by the Free Software Foundation. 10 * 11 */ 12 13#include <linux/module.h> 14#include <linux/moduleparam.h> 15#include <linux/netfilter_ipv4/ip_tables.h> 16#include <net/ip.h> 17 18MODULE_LICENSE("GPL"); 19MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 20MODULE_DESCRIPTION("iptables filter table"); 21 22#define FILTER_VALID_HOOKS ((1 << NF_IP_LOCAL_IN) | (1 << NF_IP_FORWARD) | (1 << NF_IP_LOCAL_OUT)) 23 24static struct 25{ 26 struct ipt_replace repl; 27 struct ipt_standard entries[3]; 28 struct ipt_error term; 29} initial_table __initdata = { 30 .repl = { 31 .name = "filter", 32 .valid_hooks = FILTER_VALID_HOOKS, 33 .num_entries = 4, 34 .size = sizeof(struct ipt_standard) * 3 + sizeof(struct ipt_error), 35 .hook_entry = { 36 [NF_IP_LOCAL_IN] = 0, 37 [NF_IP_FORWARD] = sizeof(struct ipt_standard), 38 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2, 39 }, 40 .underflow = { 41 [NF_IP_LOCAL_IN] = 0, 42 [NF_IP_FORWARD] = sizeof(struct ipt_standard), 43 [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) * 2, 44 }, 45 }, 46 .entries = { 47 IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_IN */ 48 IPT_STANDARD_INIT(NF_ACCEPT), /* FORWARD */ 49 IPT_STANDARD_INIT(NF_ACCEPT), /* LOCAL_OUT */ 50 }, 51 .term = IPT_ERROR_INIT, /* ERROR */ 52}; 53 54static struct xt_table packet_filter = { 55 .name = "filter", 56 .valid_hooks = FILTER_VALID_HOOKS, 57 .lock = RW_LOCK_UNLOCKED, 58 .me = THIS_MODULE, 59 .af = AF_INET, 60}; 61 62/* The work comes in here from netfilter.c. */ 63static unsigned int 64ipt_hook(unsigned int hook, 65 struct sk_buff **pskb, 66 const struct net_device *in, 67 const struct net_device *out, 68 int (*okfn)(struct sk_buff *)) 69{ 70 return ipt_do_table(pskb, hook, in, out, &packet_filter); 71} 72 73static unsigned int 74ipt_local_out_hook(unsigned int hook, 75 struct sk_buff **pskb, 76 const struct net_device *in, 77 const struct net_device *out, 78 int (*okfn)(struct sk_buff *)) 79{ 80 /* root is playing with raw sockets. */ 81 if ((*pskb)->len < sizeof(struct iphdr) 82 || ip_hdrlen(*pskb) < sizeof(struct iphdr)) { 83 if (net_ratelimit()) 84 printk("iptable_filter: ignoring short SOCK_RAW " 85 "packet.\n"); 86 return NF_ACCEPT; 87 } 88 89 return ipt_do_table(pskb, hook, in, out, &packet_filter); 90} 91 92static struct nf_hook_ops ipt_ops[] = { 93 { 94 .hook = ipt_hook, 95 .owner = THIS_MODULE, 96 .pf = PF_INET, 97 .hooknum = NF_IP_LOCAL_IN, 98 .priority = NF_IP_PRI_FILTER, 99 }, 100 { 101 .hook = ipt_hook, 102 .owner = THIS_MODULE, 103 .pf = PF_INET, 104 .hooknum = NF_IP_FORWARD, 105 .priority = NF_IP_PRI_FILTER, 106 }, 107 { 108 .hook = ipt_local_out_hook, 109 .owner = THIS_MODULE, 110 .pf = PF_INET, 111 .hooknum = NF_IP_LOCAL_OUT, 112 .priority = NF_IP_PRI_FILTER, 113 }, 114}; 115 116/* Default to forward because I got too much mail already. */ 117static int forward = NF_ACCEPT; 118module_param(forward, bool, 0000); 119 120static int __init iptable_filter_init(void) 121{ 122 int ret; 123 124 if (forward < 0 || forward > NF_MAX_VERDICT) { 125 printk("iptables forward must be 0 or 1\n"); 126 return -EINVAL; 127 } 128 129 /* Entry 1 is the FORWARD hook */ 130 initial_table.entries[1].target.verdict = -forward - 1; 131 132 /* Register table */ 133 ret = ipt_register_table(&packet_filter, &initial_table.repl); 134 if (ret < 0) 135 return ret; 136 137 /* Register hooks */ 138 ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 139 if (ret < 0) 140 goto cleanup_table; 141 142 return ret; 143 144 cleanup_table: 145 ipt_unregister_table(&packet_filter); 146 return ret; 147} 148 149static void __exit iptable_filter_fini(void) 150{ 151 nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 152 ipt_unregister_table(&packet_filter); 153} 154 155module_init(iptable_filter_init); 156module_exit(iptable_filter_fini); 157