LXR linux/net/ipv6/netfilter/ip6table

   1/*
   2 * IPv6 raw table, a port of the IPv4 raw table to IPv6
   3 *
   4 * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
   5 */
   6#include <linux/module.h>
   7#include <linux/netfilter_ipv6/ip6_tables.h>
   8
   9#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
  10
  11static const struct
  12{
  13        struct ip6t_replace repl;
  14        struct ip6t_standard entries[2];
  15        struct ip6t_error term;
  16} initial_table __net_initdata = {
  17        .repl = {
  18                .name = "raw",
  19                .valid_hooks = RAW_VALID_HOOKS,
  20                .num_entries = 3,
  21                .size = sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
  22                .hook_entry = {
  23                        [NF_INET_PRE_ROUTING] = 0,
  24                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
  25                },
  26                .underflow = {
  27                        [NF_INET_PRE_ROUTING] = 0,
  28                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
  29                },
  30        },
  31        .entries = {
  32                IP6T_STANDARD_INIT(NF_ACCEPT),  /* PRE_ROUTING */
  33                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
  34        },
  35        .term = IP6T_ERROR_INIT,                /* ERROR */
  36};
  37
  38static const struct xt_table packet_raw = {
  39        .name = "raw",
  40        .valid_hooks = RAW_VALID_HOOKS,
  41        .me = THIS_MODULE,
  42        .af = NFPROTO_IPV6,
  43};
  44
  45/* The work comes in here from netfilter.c. */
  46static unsigned int
  47ip6t_pre_routing_hook(unsigned int hook,
  48         struct sk_buff *skb,
  49         const struct net_device *in,
  50         const struct net_device *out,
  51         int (*okfn)(struct sk_buff *))
  52{
  53        return ip6t_do_table(skb, hook, in, out,
  54                             dev_net(in)->ipv6.ip6table_raw);
  55}
  56
  57static unsigned int
  58ip6t_local_out_hook(unsigned int hook,
  59         struct sk_buff *skb,
  60         const struct net_device *in,
  61         const struct net_device *out,
  62         int (*okfn)(struct sk_buff *))
  63{
  64        return ip6t_do_table(skb, hook, in, out,
  65                             dev_net(out)->ipv6.ip6table_raw);
  66}
  67
  68static struct nf_hook_ops ip6t_ops[] __read_mostly = {
  69        {
  70          .hook = ip6t_pre_routing_hook,
  71          .pf = NFPROTO_IPV6,
  72          .hooknum = NF_INET_PRE_ROUTING,
  73          .priority = NF_IP6_PRI_FIRST,
  74          .owner = THIS_MODULE,
  75        },
  76        {
  77          .hook = ip6t_local_out_hook,
  78          .pf = NFPROTO_IPV6,
  79          .hooknum = NF_INET_LOCAL_OUT,
  80          .priority = NF_IP6_PRI_FIRST,
  81          .owner = THIS_MODULE,
  82        },
  83};
  84
  85static int __net_init ip6table_raw_net_init(struct net *net)
  86{
  87        /* Register table */
  88        net->ipv6.ip6table_raw =
  89                ip6t_register_table(net, &packet_raw, &initial_table.repl);
  90        if (IS_ERR(net->ipv6.ip6table_raw))
  91                return PTR_ERR(net->ipv6.ip6table_raw);
  92        return 0;
  93}
  94
  95static void __net_exit ip6table_raw_net_exit(struct net *net)
  96{
  97        ip6t_unregister_table(net->ipv6.ip6table_raw);
  98}
  99
 100static struct pernet_operations ip6table_raw_net_ops = {
 101        .init = ip6table_raw_net_init,
 102        .exit = ip6table_raw_net_exit,
 103};
 104
 105static int __init ip6table_raw_init(void)
 106{
 107        int ret;
 108
 109        ret = register_pernet_subsys(&ip6table_raw_net_ops);
 110        if (ret < 0)
 111                return ret;
 112
 113        /* Register hooks */
 114        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
 115        if (ret < 0)
 116                goto cleanup_table;
 117
 118        return ret;
 119
 120 cleanup_table:
 121        unregister_pernet_subsys(&ip6table_raw_net_ops);
 122        return ret;
 123}
 124
 125static void __exit ip6table_raw_fini(void)
 126{
 127        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
 128        unregister_pernet_subsys(&ip6table_raw_net_ops);
 129}
 130
 131module_init(ip6table_raw_init);
 132module_exit(ip6table_raw_fini);
 133MODULE_LICENSE("GPL");
 134