11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 51da177e4SLinus Torvalds * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 61da177e4SLinus Torvalds * 71da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or modify 81da177e4SLinus Torvalds * it under the terms of the GNU General Public License version 2 as 91da177e4SLinus Torvalds * published by the Free Software Foundation. 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 121da177e4SLinus Torvalds #include <linux/module.h> 131da177e4SLinus Torvalds #include <linux/moduleparam.h> 141da177e4SLinus Torvalds #include <linux/netfilter_ipv6/ip6_tables.h> 155a0e3ad6STejun Heo #include <linux/slab.h> 161da177e4SLinus Torvalds 171da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 181da177e4SLinus Torvalds MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 191da177e4SLinus Torvalds MODULE_DESCRIPTION("ip6tables filter table"); 201da177e4SLinus Torvalds 216e23ae2aSPatrick McHardy #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \ 226e23ae2aSPatrick McHardy (1 << NF_INET_FORWARD) | \ 236e23ae2aSPatrick McHardy (1 << NF_INET_LOCAL_OUT)) 241da177e4SLinus Torvalds 2535aad0ffSJan Engelhardt static const struct xt_table packet_filter = { 261da177e4SLinus Torvalds .name = "filter", 271da177e4SLinus Torvalds .valid_hooks = FILTER_VALID_HOOKS, 281da177e4SLinus Torvalds .me = THIS_MODULE, 29f88e6a8aSJan Engelhardt .af = NFPROTO_IPV6, 302b95efe7SJan Engelhardt .priority = NF_IP6_PRI_FILTER, 311da177e4SLinus Torvalds }; 321da177e4SLinus Torvalds 331da177e4SLinus Torvalds /* The work comes in here from netfilter.c. */ 341da177e4SLinus Torvalds static unsigned int 35795aa6efSPatrick McHardy ip6table_filter_hook(const struct nf_hook_ops *ops, struct sk_buff *skb, 36238e54c9SDavid S. Miller const struct nf_hook_state *state) 3743de9dfeSAlexey Dobriyan { 38238e54c9SDavid S. Miller const struct net *net = dev_net(state->in ? state->in : state->out); 39737535c5SJan Engelhardt 40238e54c9SDavid S. Miller return ip6t_do_table(skb, ops->hooknum, state->in, state->out, 41795aa6efSPatrick McHardy net->ipv6.ip6table_filter); 421da177e4SLinus Torvalds } 431da177e4SLinus Torvalds 442b95efe7SJan Engelhardt static struct nf_hook_ops *filter_ops __read_mostly; 451da177e4SLinus Torvalds 461da177e4SLinus Torvalds /* Default to forward because I got too much mail already. */ 47523f610eSRusty Russell static bool forward = true; 481da177e4SLinus Torvalds module_param(forward, bool, 0000); 491da177e4SLinus Torvalds 508280aa61SAlexey Dobriyan static int __net_init ip6table_filter_net_init(struct net *net) 518280aa61SAlexey Dobriyan { 52e3eaa991SJan Engelhardt struct ip6t_replace *repl; 53e3eaa991SJan Engelhardt 54e3eaa991SJan Engelhardt repl = ip6t_alloc_initial_table(&packet_filter); 55e3eaa991SJan Engelhardt if (repl == NULL) 56e3eaa991SJan Engelhardt return -ENOMEM; 57e3eaa991SJan Engelhardt /* Entry 1 is the FORWARD hook */ 58e3eaa991SJan Engelhardt ((struct ip6t_standard *)repl->entries)[1].target.verdict = 59523f610eSRusty Russell forward ? -NF_ACCEPT - 1 : -NF_DROP - 1; 60e3eaa991SJan Engelhardt 618280aa61SAlexey Dobriyan net->ipv6.ip6table_filter = 62e3eaa991SJan Engelhardt ip6t_register_table(net, &packet_filter, repl); 63e3eaa991SJan Engelhardt kfree(repl); 648c6ffba0SRusty Russell return PTR_ERR_OR_ZERO(net->ipv6.ip6table_filter); 658280aa61SAlexey Dobriyan } 668280aa61SAlexey Dobriyan 678280aa61SAlexey Dobriyan static void __net_exit ip6table_filter_net_exit(struct net *net) 688280aa61SAlexey Dobriyan { 69f54e9367SAlexey Dobriyan ip6t_unregister_table(net, net->ipv6.ip6table_filter); 708280aa61SAlexey Dobriyan } 718280aa61SAlexey Dobriyan 728280aa61SAlexey Dobriyan static struct pernet_operations ip6table_filter_net_ops = { 738280aa61SAlexey Dobriyan .init = ip6table_filter_net_init, 748280aa61SAlexey Dobriyan .exit = ip6table_filter_net_exit, 758280aa61SAlexey Dobriyan }; 768280aa61SAlexey Dobriyan 7765b4b4e8SAndrew Morton static int __init ip6table_filter_init(void) 781da177e4SLinus Torvalds { 791da177e4SLinus Torvalds int ret; 801da177e4SLinus Torvalds 818280aa61SAlexey Dobriyan ret = register_pernet_subsys(&ip6table_filter_net_ops); 828280aa61SAlexey Dobriyan if (ret < 0) 838280aa61SAlexey Dobriyan return ret; 841da177e4SLinus Torvalds 851da177e4SLinus Torvalds /* Register hooks */ 862b95efe7SJan Engelhardt filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook); 872b95efe7SJan Engelhardt if (IS_ERR(filter_ops)) { 882b95efe7SJan Engelhardt ret = PTR_ERR(filter_ops); 891da177e4SLinus Torvalds goto cleanup_table; 902b95efe7SJan Engelhardt } 911da177e4SLinus Torvalds 921da177e4SLinus Torvalds return ret; 931da177e4SLinus Torvalds 941da177e4SLinus Torvalds cleanup_table: 958280aa61SAlexey Dobriyan unregister_pernet_subsys(&ip6table_filter_net_ops); 961da177e4SLinus Torvalds return ret; 971da177e4SLinus Torvalds } 981da177e4SLinus Torvalds 9965b4b4e8SAndrew Morton static void __exit ip6table_filter_fini(void) 1001da177e4SLinus Torvalds { 1012b95efe7SJan Engelhardt xt_hook_unlink(&packet_filter, filter_ops); 1028280aa61SAlexey Dobriyan unregister_pernet_subsys(&ip6table_filter_net_ops); 1031da177e4SLinus Torvalds } 1041da177e4SLinus Torvalds 10565b4b4e8SAndrew Morton module_init(ip6table_filter_init); 10665b4b4e8SAndrew Morton module_exit(ip6table_filter_fini); 107