Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
ip6table_filter.c
Go to the documentation of this file.
1 /*
2  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
3  *
4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5  * Copyright (C) 2000-2004 Netfilter Core Team <[email protected]>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11 
12 #include <linux/module.h>
13 #include <linux/moduleparam.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
15 #include <linux/slab.h>
16 
17 MODULE_LICENSE("GPL");
18 MODULE_AUTHOR("Netfilter Core Team <[email protected]>");
19 MODULE_DESCRIPTION("ip6tables filter table");
20 
21 #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
22  (1 << NF_INET_FORWARD) | \
23  (1 << NF_INET_LOCAL_OUT))
24 
25 static const struct xt_table packet_filter = {
26  .name = "filter",
27  .valid_hooks = FILTER_VALID_HOOKS,
28  .me = THIS_MODULE,
29  .af = NFPROTO_IPV6,
30  .priority = NF_IP6_PRI_FILTER,
31 };
32 
33 /* The work comes in here from netfilter.c. */
34 static unsigned int
35 ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
36  const struct net_device *in, const struct net_device *out,
37  int (*okfn)(struct sk_buff *))
38 {
39  const struct net *net = dev_net((in != NULL) ? in : out);
40 
41  return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
42 }
43 
44 static struct nf_hook_ops *filter_ops __read_mostly;
45 
46 /* Default to forward because I got too much mail already. */
47 static bool forward = true;
48 module_param(forward, bool, 0000);
49 
50 static int __net_init ip6table_filter_net_init(struct net *net)
51 {
52  struct ip6t_replace *repl;
53 
54  repl = ip6t_alloc_initial_table(&packet_filter);
55  if (repl == NULL)
56  return -ENOMEM;
57  /* Entry 1 is the FORWARD hook */
58  ((struct ip6t_standard *)repl->entries)[1].target.verdict =
59  forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
60 
61  net->ipv6.ip6table_filter =
62  ip6t_register_table(net, &packet_filter, repl);
63  kfree(repl);
64  return PTR_RET(net->ipv6.ip6table_filter);
65 }
66 
67 static void __net_exit ip6table_filter_net_exit(struct net *net)
68 {
69  ip6t_unregister_table(net, net->ipv6.ip6table_filter);
70 }
71 
72 static struct pernet_operations ip6table_filter_net_ops = {
73  .init = ip6table_filter_net_init,
74  .exit = ip6table_filter_net_exit,
75 };
76 
77 static int __init ip6table_filter_init(void)
78 {
79  int ret;
80 
81  ret = register_pernet_subsys(&ip6table_filter_net_ops);
82  if (ret < 0)
83  return ret;
84 
85  /* Register hooks */
86  filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook);
87  if (IS_ERR(filter_ops)) {
88  ret = PTR_ERR(filter_ops);
89  goto cleanup_table;
90  }
91 
92  return ret;
93 
94  cleanup_table:
95  unregister_pernet_subsys(&ip6table_filter_net_ops);
96  return ret;
97 }
98 
99 static void __exit ip6table_filter_fini(void)
100 {
101  xt_hook_unlink(&packet_filter, filter_ops);
102  unregister_pernet_subsys(&ip6table_filter_net_ops);
103 }
104 
105 module_init(ip6table_filter_init);
106 module_exit(ip6table_filter_fini);