Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linvil...
[linux-2.6] / net / ipv6 / netfilter / ip6table_filter.c
1 /*
2  * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
3  *
4  * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5  * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
6  *
7  * This program is free software; you can redistribute it and/or modify
8  * it under the terms of the GNU General Public License version 2 as
9  * published by the Free Software Foundation.
10  */
11
12 #include <linux/module.h>
13 #include <linux/moduleparam.h>
14 #include <linux/netfilter_ipv6/ip6_tables.h>
15
16 MODULE_LICENSE("GPL");
17 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
18 MODULE_DESCRIPTION("ip6tables filter table");
19
20 #define FILTER_VALID_HOOKS ((1 << NF_IP6_LOCAL_IN) | (1 << NF_IP6_FORWARD) | (1 << NF_IP6_LOCAL_OUT))
21
22 /* Standard entry. */
23 struct ip6t_standard
24 {
25         struct ip6t_entry entry;
26         struct ip6t_standard_target target;
27 };
28
29 struct ip6t_error_target
30 {
31         struct ip6t_entry_target target;
32         char errorname[IP6T_FUNCTION_MAXNAMELEN];
33 };
34
35 struct ip6t_error
36 {
37         struct ip6t_entry entry;
38         struct ip6t_error_target target;
39 };
40
41 static struct
42 {
43         struct ip6t_replace repl;
44         struct ip6t_standard entries[3];
45         struct ip6t_error term;
46 } initial_table __initdata
47 = { { "filter", FILTER_VALID_HOOKS, 4,
48       sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
49       { [NF_IP6_LOCAL_IN] = 0,
50         [NF_IP6_FORWARD] = sizeof(struct ip6t_standard),
51         [NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2 },
52       { [NF_IP6_LOCAL_IN] = 0,
53         [NF_IP6_FORWARD] = sizeof(struct ip6t_standard),
54         [NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2 },
55       0, NULL, { } },
56     {
57             /* LOCAL_IN */
58             { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
59                 0,
60                 sizeof(struct ip6t_entry),
61                 sizeof(struct ip6t_standard),
62                 0, { 0, 0 }, { } },
63               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
64                 -NF_ACCEPT - 1 } },
65             /* FORWARD */
66             { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
67                 0,
68                 sizeof(struct ip6t_entry),
69                 sizeof(struct ip6t_standard),
70                 0, { 0, 0 }, { } },
71               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
72                 -NF_ACCEPT - 1 } },
73             /* LOCAL_OUT */
74             { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
75                 0,
76                 sizeof(struct ip6t_entry),
77                 sizeof(struct ip6t_standard),
78                 0, { 0, 0 }, { } },
79               { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } },
80                 -NF_ACCEPT - 1 } }
81     },
82     /* ERROR */
83     { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 },
84         0,
85         sizeof(struct ip6t_entry),
86         sizeof(struct ip6t_error),
87         0, { 0, 0 }, { } },
88       { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } },
89           { } },
90         "ERROR"
91       }
92     }
93 };
94
95 static struct ip6t_table packet_filter = {
96         .name           = "filter",
97         .valid_hooks    = FILTER_VALID_HOOKS,
98         .lock           = RW_LOCK_UNLOCKED,
99         .me             = THIS_MODULE,
100         .af             = AF_INET6,
101 };
102
103 /* The work comes in here from netfilter.c. */
104 static unsigned int
105 ip6t_hook(unsigned int hook,
106          struct sk_buff **pskb,
107          const struct net_device *in,
108          const struct net_device *out,
109          int (*okfn)(struct sk_buff *))
110 {
111         return ip6t_do_table(pskb, hook, in, out, &packet_filter, NULL);
112 }
113
114 static unsigned int
115 ip6t_local_out_hook(unsigned int hook,
116                    struct sk_buff **pskb,
117                    const struct net_device *in,
118                    const struct net_device *out,
119                    int (*okfn)(struct sk_buff *))
120 {
121 #if 0
122         /* root is playing with raw sockets. */
123         if ((*pskb)->len < sizeof(struct iphdr)
124             || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) {
125                 if (net_ratelimit())
126                         printk("ip6t_hook: happy cracking.\n");
127                 return NF_ACCEPT;
128         }
129 #endif
130
131         return ip6t_do_table(pskb, hook, in, out, &packet_filter, NULL);
132 }
133
134 static struct nf_hook_ops ip6t_ops[] = {
135         {
136                 .hook           = ip6t_hook,
137                 .owner          = THIS_MODULE,
138                 .pf             = PF_INET6,
139                 .hooknum        = NF_IP6_LOCAL_IN,
140                 .priority       = NF_IP6_PRI_FILTER,
141         },
142         {
143                 .hook           = ip6t_hook,
144                 .owner          = THIS_MODULE,
145                 .pf             = PF_INET6,
146                 .hooknum        = NF_IP6_FORWARD,
147                 .priority       = NF_IP6_PRI_FILTER,
148         },
149         {
150                 .hook           = ip6t_local_out_hook,
151                 .owner          = THIS_MODULE,
152                 .pf             = PF_INET6,
153                 .hooknum        = NF_IP6_LOCAL_OUT,
154                 .priority       = NF_IP6_PRI_FILTER,
155         },
156 };
157
158 /* Default to forward because I got too much mail already. */
159 static int forward = NF_ACCEPT;
160 module_param(forward, bool, 0000);
161
162 static int __init ip6table_filter_init(void)
163 {
164         int ret;
165
166         if (forward < 0 || forward > NF_MAX_VERDICT) {
167                 printk("iptables forward must be 0 or 1\n");
168                 return -EINVAL;
169         }
170
171         /* Entry 1 is the FORWARD hook */
172         initial_table.entries[1].target.verdict = -forward - 1;
173
174         /* Register table */
175         ret = ip6t_register_table(&packet_filter, &initial_table.repl);
176         if (ret < 0)
177                 return ret;
178
179         /* Register hooks */
180         ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
181         if (ret < 0)
182                 goto cleanup_table;
183
184         return ret;
185
186  cleanup_table:
187         ip6t_unregister_table(&packet_filter);
188         return ret;
189 }
190
191 static void __exit ip6table_filter_fini(void)
192 {
193         nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
194         ip6t_unregister_table(&packet_filter);
195 }
196
197 module_init(ip6table_filter_init);
198 module_exit(ip6table_filter_fini);