1d2912cb1SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only 21da177e4SLinus Torvalds /* 31da177e4SLinus Torvalds * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 41da177e4SLinus Torvalds * 51da177e4SLinus Torvalds * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 61da177e4SLinus Torvalds * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 71da177e4SLinus Torvalds */ 81da177e4SLinus Torvalds 91da177e4SLinus Torvalds #include <linux/module.h> 101da177e4SLinus Torvalds #include <linux/moduleparam.h> 111da177e4SLinus Torvalds #include <linux/netfilter_ipv6/ip6_tables.h> 125a0e3ad6STejun Heo #include <linux/slab.h> 131da177e4SLinus Torvalds 141da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 151da177e4SLinus Torvalds MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 161da177e4SLinus Torvalds MODULE_DESCRIPTION("ip6tables filter table"); 171da177e4SLinus Torvalds 186e23ae2aSPatrick McHardy #define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \ 196e23ae2aSPatrick McHardy (1 << NF_INET_FORWARD) | \ 206e23ae2aSPatrick McHardy (1 << NF_INET_LOCAL_OUT)) 211da177e4SLinus Torvalds 22b9e69e12SFlorian Westphal static int __net_init ip6table_filter_table_init(struct net *net); 23b9e69e12SFlorian Westphal 2435aad0ffSJan Engelhardt static const struct xt_table packet_filter = { 251da177e4SLinus Torvalds .name = "filter", 261da177e4SLinus Torvalds .valid_hooks = FILTER_VALID_HOOKS, 271da177e4SLinus Torvalds .me = THIS_MODULE, 28f88e6a8aSJan Engelhardt .af = NFPROTO_IPV6, 292b95efe7SJan Engelhardt .priority = NF_IP6_PRI_FILTER, 30b9e69e12SFlorian Westphal .table_init = ip6table_filter_table_init, 311da177e4SLinus Torvalds }; 321da177e4SLinus Torvalds 331da177e4SLinus Torvalds /* The work comes in here from netfilter.c. */ 341da177e4SLinus Torvalds static unsigned int 3506198b34SEric W. Biederman ip6table_filter_hook(void *priv, struct sk_buff *skb, 36238e54c9SDavid S. Miller const struct nf_hook_state *state) 3743de9dfeSAlexey Dobriyan { 386cb8ff3fSEric W. Biederman return ip6t_do_table(skb, state, state->net->ipv6.ip6table_filter); 391da177e4SLinus Torvalds } 401da177e4SLinus Torvalds 412b95efe7SJan Engelhardt static struct nf_hook_ops *filter_ops __read_mostly; 421da177e4SLinus Torvalds 431da177e4SLinus Torvalds /* Default to forward because I got too much mail already. */ 44523f610eSRusty Russell static bool forward = true; 451da177e4SLinus Torvalds module_param(forward, bool, 0000); 461da177e4SLinus Torvalds 47b9e69e12SFlorian Westphal static int __net_init ip6table_filter_table_init(struct net *net) 488280aa61SAlexey Dobriyan { 49e3eaa991SJan Engelhardt struct ip6t_replace *repl; 50a67dd266SFlorian Westphal int err; 51e3eaa991SJan Engelhardt 52b9e69e12SFlorian Westphal if (net->ipv6.ip6table_filter) 53b9e69e12SFlorian Westphal return 0; 54b9e69e12SFlorian Westphal 55e3eaa991SJan Engelhardt repl = ip6t_alloc_initial_table(&packet_filter); 56e3eaa991SJan Engelhardt if (repl == NULL) 57e3eaa991SJan Engelhardt return -ENOMEM; 58e3eaa991SJan Engelhardt /* Entry 1 is the FORWARD hook */ 59e3eaa991SJan Engelhardt ((struct ip6t_standard *)repl->entries)[1].target.verdict = 60523f610eSRusty Russell forward ? -NF_ACCEPT - 1 : -NF_DROP - 1; 61e3eaa991SJan Engelhardt 62a67dd266SFlorian Westphal err = ip6t_register_table(net, &packet_filter, repl, filter_ops, 63a67dd266SFlorian Westphal &net->ipv6.ip6table_filter); 64e3eaa991SJan Engelhardt kfree(repl); 65a67dd266SFlorian Westphal return err; 668280aa61SAlexey Dobriyan } 678280aa61SAlexey Dobriyan 68b9e69e12SFlorian Westphal static int __net_init ip6table_filter_net_init(struct net *net) 69b9e69e12SFlorian Westphal { 70b9e69e12SFlorian Westphal if (net == &init_net || !forward) 71b9e69e12SFlorian Westphal return ip6table_filter_table_init(net); 72b9e69e12SFlorian Westphal 73b9e69e12SFlorian Westphal return 0; 74b9e69e12SFlorian Westphal } 75b9e69e12SFlorian Westphal 765f027bc7SDavid Wilder static void __net_exit ip6table_filter_net_pre_exit(struct net *net) 775f027bc7SDavid Wilder { 78*6c071754SFlorian Westphal ip6t_unregister_table_pre_exit(net, "filter", 795f027bc7SDavid Wilder filter_ops); 805f027bc7SDavid Wilder } 815f027bc7SDavid Wilder 828280aa61SAlexey Dobriyan static void __net_exit ip6table_filter_net_exit(struct net *net) 838280aa61SAlexey Dobriyan { 84*6c071754SFlorian Westphal ip6t_unregister_table_exit(net, "filter"); 85b9e69e12SFlorian Westphal net->ipv6.ip6table_filter = NULL; 868280aa61SAlexey Dobriyan } 878280aa61SAlexey Dobriyan 888280aa61SAlexey Dobriyan static struct pernet_operations ip6table_filter_net_ops = { 898280aa61SAlexey Dobriyan .init = ip6table_filter_net_init, 905f027bc7SDavid Wilder .pre_exit = ip6table_filter_net_pre_exit, 918280aa61SAlexey Dobriyan .exit = ip6table_filter_net_exit, 928280aa61SAlexey Dobriyan }; 938280aa61SAlexey Dobriyan 9465b4b4e8SAndrew Morton static int __init ip6table_filter_init(void) 951da177e4SLinus Torvalds { 961da177e4SLinus Torvalds int ret; 971da177e4SLinus Torvalds 98b9e69e12SFlorian Westphal filter_ops = xt_hook_ops_alloc(&packet_filter, ip6table_filter_hook); 99b9e69e12SFlorian Westphal if (IS_ERR(filter_ops)) 100b9e69e12SFlorian Westphal return PTR_ERR(filter_ops); 101b9e69e12SFlorian Westphal 1028280aa61SAlexey Dobriyan ret = register_pernet_subsys(&ip6table_filter_net_ops); 1038280aa61SAlexey Dobriyan if (ret < 0) 104b9e69e12SFlorian Westphal kfree(filter_ops); 1051da177e4SLinus Torvalds 1061da177e4SLinus Torvalds return ret; 1071da177e4SLinus Torvalds } 1081da177e4SLinus Torvalds 10965b4b4e8SAndrew Morton static void __exit ip6table_filter_fini(void) 1101da177e4SLinus Torvalds { 1118280aa61SAlexey Dobriyan unregister_pernet_subsys(&ip6table_filter_net_ops); 112b9e69e12SFlorian Westphal kfree(filter_ops); 1131da177e4SLinus Torvalds } 1141da177e4SLinus Torvalds 11565b4b4e8SAndrew Morton module_init(ip6table_filter_init); 11665b4b4e8SAndrew Morton module_exit(ip6table_filter_fini); 117