git.oblomov.eu Git - linux-2.6/blob - net/ipv4/netfilter/arptable_filter.c

   1 /*
   2  * Filtering ARP tables module.
   3  *
   4  * Copyright (C) 2002 David S. Miller (davem@redhat.com)
   5  *
   6  */
   7
   8 #include <linux/module.h>
   9 #include <linux/netfilter_arp/arp_tables.h>
  10
  11 MODULE_LICENSE("GPL");
  12 MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
  13 MODULE_DESCRIPTION("arptables filter table");
  14
  15 #define FILTER_VALID_HOOKS ((1 << NF_ARP_IN) | (1 << NF_ARP_OUT) | \
  16                            (1 << NF_ARP_FORWARD))
  17
  18 /* Standard entry. */
  19 struct arpt_standard
  20 {
  21         struct arpt_entry entry;
  22         struct arpt_standard_target target;
  23 };
  24
  25 struct arpt_error_target
  26 {
  27         struct arpt_entry_target target;
  28         char errorname[ARPT_FUNCTION_MAXNAMELEN];
  29 };
  30
  31 struct arpt_error
  32 {
  33         struct arpt_entry entry;
  34         struct arpt_error_target target;
  35 };
  36
  37 static struct
  38 {
  39         struct arpt_replace repl;
  40         struct arpt_standard entries[3];
  41         struct arpt_error term;
  42 } initial_table __initdata
  43 = { { "filter", FILTER_VALID_HOOKS, 4,
  44       sizeof(struct arpt_standard) * 3 + sizeof(struct arpt_error),
  45       { [NF_ARP_IN] = 0,
  46         [NF_ARP_OUT] = sizeof(struct arpt_standard),
  47         [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard), },
  48       { [NF_ARP_IN] = 0,
  49         [NF_ARP_OUT] = sizeof(struct arpt_standard),
  50         [NF_ARP_FORWARD] = 2 * sizeof(struct arpt_standard), },
  51       0, NULL, { } },
  52     {
  53             /* ARP_IN */
  54             {
  55                     {
  56                             {
  57                                     { 0 }, { 0 }, { 0 }, { 0 },
  58                                     0, 0,
  59                                     { { 0, }, { 0, } },
  60                                     { { 0, }, { 0, } },
  61                                     0, 0,
  62                                     0, 0,
  63                                     0, 0,
  64                                     "", "", { 0 }, { 0 },
  65                                     0, 0
  66                             },
  67                             sizeof(struct arpt_entry),
  68                             sizeof(struct arpt_standard),
  69                             0,
  70                             { 0, 0 }, { } },
  71                     { { { { ARPT_ALIGN(sizeof(struct arpt_standard_target)), "" } }, { } },
  72                       -NF_ACCEPT - 1 }
  73             },
  74             /* ARP_OUT */
  75             {
  76                     {
  77                             {
  78                                     { 0 }, { 0 }, { 0 }, { 0 },
  79                                     0, 0,
  80                                     { { 0, }, { 0, } },
  81                                     { { 0, }, { 0, } },
  82                                     0, 0,
  83                                     0, 0,
  84                                     0, 0,
  85                                     "", "", { 0 }, { 0 },
  86                                     0, 0
  87                             },
  88                             sizeof(struct arpt_entry),
  89                             sizeof(struct arpt_standard),
  90                             0,
  91                             { 0, 0 }, { } },
  92                     { { { { ARPT_ALIGN(sizeof(struct arpt_standard_target)), "" } }, { } },
  93                       -NF_ACCEPT - 1 }
  94             },
  95             /* ARP_FORWARD */
  96             {
  97                     {
  98                             {
  99                                     { 0 }, { 0 }, { 0 }, { 0 },
 100                                     0, 0,
 101                                     { { 0, }, { 0, } },
 102                                     { { 0, }, { 0, } },
 103                                     0, 0,
 104                                     0, 0,
 105                                     0, 0,
 106                                     "", "", { 0 }, { 0 },
 107                                     0, 0
 108                             },
 109                             sizeof(struct arpt_entry),
 110                             sizeof(struct arpt_standard),
 111                             0,
 112                             { 0, 0 }, { } },
 113                     { { { { ARPT_ALIGN(sizeof(struct arpt_standard_target)), "" } }, { } },
 114                       -NF_ACCEPT - 1 }
 115             }
 116     },
 117     /* ERROR */
 118     {
 119             {
 120                     {
 121                             { 0 }, { 0 }, { 0 }, { 0 },
 122                             0, 0,
 123                             { { 0, }, { 0, } },
 124                             { { 0, }, { 0, } },
 125                             0, 0,
 126                             0, 0,
 127                             0, 0,
 128                             "", "", { 0 }, { 0 },
 129                             0, 0
 130                     },
 131                     sizeof(struct arpt_entry),
 132                     sizeof(struct arpt_error),
 133                     0,
 134                     { 0, 0 }, { } },
 135             { { { { ARPT_ALIGN(sizeof(struct arpt_error_target)), ARPT_ERROR_TARGET } },
 136                 { } },
 137               "ERROR"
 138             }
 139     }
 140 };
 141
 142 static struct arpt_table packet_filter = {
 143         .name           = "filter",
 144         .valid_hooks    = FILTER_VALID_HOOKS,
 145         .lock           = RW_LOCK_UNLOCKED,
 146         .private        = NULL,
 147         .me             = THIS_MODULE,
 148 };
 149
 150 /* The work comes in here from netfilter.c */
 151 static unsigned int arpt_hook(unsigned int hook,
 152                               struct sk_buff **pskb,
 153                               const struct net_device *in,
 154                               const struct net_device *out,
 155                               int (*okfn)(struct sk_buff *))
 156 {
 157         return arpt_do_table(pskb, hook, in, out, &packet_filter, NULL);
 158 }
 159
 160 static struct nf_hook_ops arpt_ops[] = {
 161         {
 162                 .hook           = arpt_hook,
 163                 .owner          = THIS_MODULE,
 164                 .pf             = NF_ARP,
 165                 .hooknum        = NF_ARP_IN,
 166         },
 167         {
 168                 .hook           = arpt_hook,
 169                 .owner          = THIS_MODULE,
 170                 .pf             = NF_ARP,
 171                 .hooknum        = NF_ARP_OUT,
 172         },
 173         {
 174                 .hook           = arpt_hook,
 175                 .owner          = THIS_MODULE,
 176                 .pf             = NF_ARP,
 177                 .hooknum        = NF_ARP_FORWARD,
 178         },
 179 };
 180
 181 static int __init init(void)
 182 {
 183         int ret, i;
 184
 185         /* Register table */
 186         ret = arpt_register_table(&packet_filter, &initial_table.repl);
 187         if (ret < 0)
 188                 return ret;
 189
 190         for (i = 0; i < ARRAY_SIZE(arpt_ops); i++)
 191                 if ((ret = nf_register_hook(&arpt_ops[i])) < 0)
 192                         goto cleanup_hooks;
 193         return ret;
 194
 195 cleanup_hooks:
 196         while (--i >= 0)
 197                 nf_unregister_hook(&arpt_ops[i]);
 198
 199         arpt_unregister_table(&packet_filter);
 200         return ret;
 201 }
 202
 203 static void __exit fini(void)
 204 {
 205         unsigned int i;
 206
 207         for (i = 0; i < ARRAY_SIZE(arpt_ops); i++)
 208                 nf_unregister_hook(&arpt_ops[i]);
 209
 210         arpt_unregister_table(&packet_filter);
 211 }
 212
 213 module_init(init);
 214 module_exit(fini);