← Back to branch summary

~ubuntu-branches/ubuntu/precise/linux-lowlatency/precise

« back to all changes in this revision

Viewing changes to net/ipv4/netfilter/iptable_filter.c

  • Committer: Package Import Robot
  • Author(s): Alessio Igor Bogani
  • Date: 2011-10-26 11:13:05 UTC
  • Revision ID: package-import@ubuntu.com-20111026111305-tz023xykf0i6eosh
Tags: upstream-3.2.0
Import upstream version 3.2.0

Show diffs side-by-side

added added

removed removed

Lines of Context:
net/ipv4/netfilter/iptable_filter.c
 
1
/*
 
2
 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
 
3
 *
 
4
 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
 
5
 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
 
6
 *
 
7
 * This program is free software; you can redistribute it and/or modify
 
8
 * it under the terms of the GNU General Public License version 2 as
 
9
 * published by the Free Software Foundation.
 
10
 *
 
11
 */
 
12
 
 
13
#include <linux/module.h>
 
14
#include <linux/moduleparam.h>
 
15
#include <linux/netfilter_ipv4/ip_tables.h>
 
16
#include <linux/slab.h>
 
17
#include <net/ip.h>
 
18
 
 
19
MODULE_LICENSE("GPL");
 
20
MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
 
21
MODULE_DESCRIPTION("iptables filter table");
 
22
 
 
23
#define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
 
24
                            (1 << NF_INET_FORWARD) | \
 
25
                            (1 << NF_INET_LOCAL_OUT))
 
26
 
 
27
static const struct xt_table packet_filter = {
 
28
        .name           = "filter",
 
29
        .valid_hooks    = FILTER_VALID_HOOKS,
 
30
        .me             = THIS_MODULE,
 
31
        .af             = NFPROTO_IPV4,
 
32
        .priority       = NF_IP_PRI_FILTER,
 
33
};
 
34
 
 
35
static unsigned int
 
36
iptable_filter_hook(unsigned int hook, struct sk_buff *skb,
 
37
                    const struct net_device *in, const struct net_device *out,
 
38
                    int (*okfn)(struct sk_buff *))
 
39
{
 
40
        const struct net *net;
 
41
 
 
42
        if (hook == NF_INET_LOCAL_OUT &&
 
43
            (skb->len < sizeof(struct iphdr) ||
 
44
             ip_hdrlen(skb) < sizeof(struct iphdr)))
 
45
                /* root is playing with raw sockets. */
 
46
                return NF_ACCEPT;
 
47
 
 
48
        net = dev_net((in != NULL) ? in : out);
 
49
        return ipt_do_table(skb, hook, in, out, net->ipv4.iptable_filter);
 
50
}
 
51
 
 
52
static struct nf_hook_ops *filter_ops __read_mostly;
 
53
 
 
54
/* Default to forward because I got too much mail already. */
 
55
static int forward = NF_ACCEPT;
 
56
module_param(forward, bool, 0000);
 
57
 
 
58
static int __net_init iptable_filter_net_init(struct net *net)
 
59
{
 
60
        struct ipt_replace *repl;
 
61
 
 
62
        repl = ipt_alloc_initial_table(&packet_filter);
 
63
        if (repl == NULL)
 
64
                return -ENOMEM;
 
65
        /* Entry 1 is the FORWARD hook */
 
66
        ((struct ipt_standard *)repl->entries)[1].target.verdict =
 
67
                -forward - 1;
 
68
 
 
69
        net->ipv4.iptable_filter =
 
70
                ipt_register_table(net, &packet_filter, repl);
 
71
        kfree(repl);
 
72
        if (IS_ERR(net->ipv4.iptable_filter))
 
73
                return PTR_ERR(net->ipv4.iptable_filter);
 
74
        return 0;
 
75
}
 
76
 
 
77
static void __net_exit iptable_filter_net_exit(struct net *net)
 
78
{
 
79
        ipt_unregister_table(net, net->ipv4.iptable_filter);
 
80
}
 
81
 
 
82
static struct pernet_operations iptable_filter_net_ops = {
 
83
        .init = iptable_filter_net_init,
 
84
        .exit = iptable_filter_net_exit,
 
85
};
 
86
 
 
87
static int __init iptable_filter_init(void)
 
88
{
 
89
        int ret;
 
90
 
 
91
        if (forward < 0 || forward > NF_MAX_VERDICT) {
 
92
                pr_err("iptables forward must be 0 or 1\n");
 
93
                return -EINVAL;
 
94
        }
 
95
 
 
96
        ret = register_pernet_subsys(&iptable_filter_net_ops);
 
97
        if (ret < 0)
 
98
                return ret;
 
99
 
 
100
        /* Register hooks */
 
101
        filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
 
102
        if (IS_ERR(filter_ops)) {
 
103
                ret = PTR_ERR(filter_ops);
 
104
                goto cleanup_table;
 
105
        }
 
106
 
 
107
        return ret;
 
108
 
 
109
 cleanup_table:
 
110
        unregister_pernet_subsys(&iptable_filter_net_ops);
 
111
        return ret;
 
112
}
 
113
 
 
114
static void __exit iptable_filter_fini(void)
 
115
{
 
116
        xt_hook_unlink(&packet_filter, filter_ops);
 
117
        unregister_pernet_subsys(&iptable_filter_net_ops);
 
118
}
 
119
 
 
120
module_init(iptable_filter_init);
 
121
module_exit(iptable_filter_fini);