11da177e4SLinus Torvalds /* 21da177e4SLinus Torvalds * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x. 31da177e4SLinus Torvalds * 41da177e4SLinus Torvalds * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling 51da177e4SLinus Torvalds * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org> 61da177e4SLinus Torvalds * 71da177e4SLinus Torvalds * This program is free software; you can redistribute it and/or modify 81da177e4SLinus Torvalds * it under the terms of the GNU General Public License version 2 as 91da177e4SLinus Torvalds * published by the Free Software Foundation. 101da177e4SLinus Torvalds */ 111da177e4SLinus Torvalds 121da177e4SLinus Torvalds #include <linux/module.h> 131da177e4SLinus Torvalds #include <linux/moduleparam.h> 141da177e4SLinus Torvalds #include <linux/netfilter_ipv6/ip6_tables.h> 151da177e4SLinus Torvalds 161da177e4SLinus Torvalds MODULE_LICENSE("GPL"); 171da177e4SLinus Torvalds MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>"); 181da177e4SLinus Torvalds MODULE_DESCRIPTION("ip6tables filter table"); 191da177e4SLinus Torvalds 201da177e4SLinus Torvalds #define FILTER_VALID_HOOKS ((1 << NF_IP6_LOCAL_IN) | (1 << NF_IP6_FORWARD) | (1 << NF_IP6_LOCAL_OUT)) 211da177e4SLinus Torvalds 221da177e4SLinus Torvalds /* Standard entry. */ 231da177e4SLinus Torvalds struct ip6t_standard 241da177e4SLinus Torvalds { 251da177e4SLinus Torvalds struct ip6t_entry entry; 261da177e4SLinus Torvalds struct ip6t_standard_target target; 271da177e4SLinus Torvalds }; 281da177e4SLinus Torvalds 291da177e4SLinus Torvalds struct ip6t_error_target 301da177e4SLinus Torvalds { 311da177e4SLinus Torvalds struct ip6t_entry_target target; 321da177e4SLinus Torvalds char errorname[IP6T_FUNCTION_MAXNAMELEN]; 331da177e4SLinus Torvalds }; 341da177e4SLinus Torvalds 351da177e4SLinus Torvalds struct ip6t_error 361da177e4SLinus Torvalds { 371da177e4SLinus Torvalds struct ip6t_entry entry; 381da177e4SLinus Torvalds struct ip6t_error_target target; 391da177e4SLinus Torvalds }; 401da177e4SLinus Torvalds 411da177e4SLinus Torvalds static struct 421da177e4SLinus Torvalds { 431da177e4SLinus Torvalds struct ip6t_replace repl; 441da177e4SLinus Torvalds struct ip6t_standard entries[3]; 451da177e4SLinus Torvalds struct ip6t_error term; 461da177e4SLinus Torvalds } initial_table __initdata 471da177e4SLinus Torvalds = { { "filter", FILTER_VALID_HOOKS, 4, 481da177e4SLinus Torvalds sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error), 491da177e4SLinus Torvalds { [NF_IP6_LOCAL_IN] = 0, 501da177e4SLinus Torvalds [NF_IP6_FORWARD] = sizeof(struct ip6t_standard), 511da177e4SLinus Torvalds [NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2 }, 521da177e4SLinus Torvalds { [NF_IP6_LOCAL_IN] = 0, 531da177e4SLinus Torvalds [NF_IP6_FORWARD] = sizeof(struct ip6t_standard), 541da177e4SLinus Torvalds [NF_IP6_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2 }, 551da177e4SLinus Torvalds 0, NULL, { } }, 561da177e4SLinus Torvalds { 571da177e4SLinus Torvalds /* LOCAL_IN */ 581da177e4SLinus Torvalds { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 591da177e4SLinus Torvalds 0, 601da177e4SLinus Torvalds sizeof(struct ip6t_entry), 611da177e4SLinus Torvalds sizeof(struct ip6t_standard), 621da177e4SLinus Torvalds 0, { 0, 0 }, { } }, 631da177e4SLinus Torvalds { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, 641da177e4SLinus Torvalds -NF_ACCEPT - 1 } }, 651da177e4SLinus Torvalds /* FORWARD */ 661da177e4SLinus Torvalds { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 671da177e4SLinus Torvalds 0, 681da177e4SLinus Torvalds sizeof(struct ip6t_entry), 691da177e4SLinus Torvalds sizeof(struct ip6t_standard), 701da177e4SLinus Torvalds 0, { 0, 0 }, { } }, 711da177e4SLinus Torvalds { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, 721da177e4SLinus Torvalds -NF_ACCEPT - 1 } }, 731da177e4SLinus Torvalds /* LOCAL_OUT */ 741da177e4SLinus Torvalds { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 751da177e4SLinus Torvalds 0, 761da177e4SLinus Torvalds sizeof(struct ip6t_entry), 771da177e4SLinus Torvalds sizeof(struct ip6t_standard), 781da177e4SLinus Torvalds 0, { 0, 0 }, { } }, 791da177e4SLinus Torvalds { { { { IP6T_ALIGN(sizeof(struct ip6t_standard_target)), "" } }, { } }, 801da177e4SLinus Torvalds -NF_ACCEPT - 1 } } 811da177e4SLinus Torvalds }, 821da177e4SLinus Torvalds /* ERROR */ 831da177e4SLinus Torvalds { { { { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, { { { 0 } } }, "", "", { 0 }, { 0 }, 0, 0, 0 }, 841da177e4SLinus Torvalds 0, 851da177e4SLinus Torvalds sizeof(struct ip6t_entry), 861da177e4SLinus Torvalds sizeof(struct ip6t_error), 871da177e4SLinus Torvalds 0, { 0, 0 }, { } }, 881da177e4SLinus Torvalds { { { { IP6T_ALIGN(sizeof(struct ip6t_error_target)), IP6T_ERROR_TARGET } }, 891da177e4SLinus Torvalds { } }, 901da177e4SLinus Torvalds "ERROR" 911da177e4SLinus Torvalds } 921da177e4SLinus Torvalds } 931da177e4SLinus Torvalds }; 941da177e4SLinus Torvalds 95e60a13e0SJan Engelhardt static struct xt_table packet_filter = { 961da177e4SLinus Torvalds .name = "filter", 971da177e4SLinus Torvalds .valid_hooks = FILTER_VALID_HOOKS, 981da177e4SLinus Torvalds .lock = RW_LOCK_UNLOCKED, 991da177e4SLinus Torvalds .me = THIS_MODULE, 1002e4e6a17SHarald Welte .af = AF_INET6, 1011da177e4SLinus Torvalds }; 1021da177e4SLinus Torvalds 1031da177e4SLinus Torvalds /* The work comes in here from netfilter.c. */ 1041da177e4SLinus Torvalds static unsigned int 1051da177e4SLinus Torvalds ip6t_hook(unsigned int hook, 1061da177e4SLinus Torvalds struct sk_buff **pskb, 1071da177e4SLinus Torvalds const struct net_device *in, 1081da177e4SLinus Torvalds const struct net_device *out, 1091da177e4SLinus Torvalds int (*okfn)(struct sk_buff *)) 1101da177e4SLinus Torvalds { 111fe1cb108SPatrick McHardy return ip6t_do_table(pskb, hook, in, out, &packet_filter); 1121da177e4SLinus Torvalds } 1131da177e4SLinus Torvalds 1141da177e4SLinus Torvalds static unsigned int 1151da177e4SLinus Torvalds ip6t_local_out_hook(unsigned int hook, 1161da177e4SLinus Torvalds struct sk_buff **pskb, 1171da177e4SLinus Torvalds const struct net_device *in, 1181da177e4SLinus Torvalds const struct net_device *out, 1191da177e4SLinus Torvalds int (*okfn)(struct sk_buff *)) 1201da177e4SLinus Torvalds { 1211da177e4SLinus Torvalds #if 0 1221da177e4SLinus Torvalds /* root is playing with raw sockets. */ 1231da177e4SLinus Torvalds if ((*pskb)->len < sizeof(struct iphdr) 1241da177e4SLinus Torvalds || (*pskb)->nh.iph->ihl * 4 < sizeof(struct iphdr)) { 1251da177e4SLinus Torvalds if (net_ratelimit()) 1261da177e4SLinus Torvalds printk("ip6t_hook: happy cracking.\n"); 1271da177e4SLinus Torvalds return NF_ACCEPT; 1281da177e4SLinus Torvalds } 1291da177e4SLinus Torvalds #endif 1301da177e4SLinus Torvalds 131fe1cb108SPatrick McHardy return ip6t_do_table(pskb, hook, in, out, &packet_filter); 1321da177e4SLinus Torvalds } 1331da177e4SLinus Torvalds 1341da177e4SLinus Torvalds static struct nf_hook_ops ip6t_ops[] = { 1351da177e4SLinus Torvalds { 1361da177e4SLinus Torvalds .hook = ip6t_hook, 1371da177e4SLinus Torvalds .owner = THIS_MODULE, 1381da177e4SLinus Torvalds .pf = PF_INET6, 1391da177e4SLinus Torvalds .hooknum = NF_IP6_LOCAL_IN, 1401da177e4SLinus Torvalds .priority = NF_IP6_PRI_FILTER, 1411da177e4SLinus Torvalds }, 1421da177e4SLinus Torvalds { 1431da177e4SLinus Torvalds .hook = ip6t_hook, 1441da177e4SLinus Torvalds .owner = THIS_MODULE, 1451da177e4SLinus Torvalds .pf = PF_INET6, 1461da177e4SLinus Torvalds .hooknum = NF_IP6_FORWARD, 1471da177e4SLinus Torvalds .priority = NF_IP6_PRI_FILTER, 1481da177e4SLinus Torvalds }, 1491da177e4SLinus Torvalds { 1501da177e4SLinus Torvalds .hook = ip6t_local_out_hook, 1511da177e4SLinus Torvalds .owner = THIS_MODULE, 1521da177e4SLinus Torvalds .pf = PF_INET6, 1531da177e4SLinus Torvalds .hooknum = NF_IP6_LOCAL_OUT, 1541da177e4SLinus Torvalds .priority = NF_IP6_PRI_FILTER, 1551da177e4SLinus Torvalds }, 1561da177e4SLinus Torvalds }; 1571da177e4SLinus Torvalds 1581da177e4SLinus Torvalds /* Default to forward because I got too much mail already. */ 1591da177e4SLinus Torvalds static int forward = NF_ACCEPT; 1601da177e4SLinus Torvalds module_param(forward, bool, 0000); 1611da177e4SLinus Torvalds 16265b4b4e8SAndrew Morton static int __init ip6table_filter_init(void) 1631da177e4SLinus Torvalds { 1641da177e4SLinus Torvalds int ret; 1651da177e4SLinus Torvalds 1661da177e4SLinus Torvalds if (forward < 0 || forward > NF_MAX_VERDICT) { 1671da177e4SLinus Torvalds printk("iptables forward must be 0 or 1\n"); 1681da177e4SLinus Torvalds return -EINVAL; 1691da177e4SLinus Torvalds } 1701da177e4SLinus Torvalds 1711da177e4SLinus Torvalds /* Entry 1 is the FORWARD hook */ 1721da177e4SLinus Torvalds initial_table.entries[1].target.verdict = -forward - 1; 1731da177e4SLinus Torvalds 1741da177e4SLinus Torvalds /* Register table */ 1751da177e4SLinus Torvalds ret = ip6t_register_table(&packet_filter, &initial_table.repl); 1761da177e4SLinus Torvalds if (ret < 0) 1771da177e4SLinus Torvalds return ret; 1781da177e4SLinus Torvalds 1791da177e4SLinus Torvalds /* Register hooks */ 180964ddaa1SPatrick McHardy ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops)); 1811da177e4SLinus Torvalds if (ret < 0) 1821da177e4SLinus Torvalds goto cleanup_table; 1831da177e4SLinus Torvalds 1841da177e4SLinus Torvalds return ret; 1851da177e4SLinus Torvalds 1861da177e4SLinus Torvalds cleanup_table: 1871da177e4SLinus Torvalds ip6t_unregister_table(&packet_filter); 1881da177e4SLinus Torvalds return ret; 1891da177e4SLinus Torvalds } 1901da177e4SLinus Torvalds 19165b4b4e8SAndrew Morton static void __exit ip6table_filter_fini(void) 1921da177e4SLinus Torvalds { 193964ddaa1SPatrick McHardy nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops)); 1941da177e4SLinus Torvalds ip6t_unregister_table(&packet_filter); 1951da177e4SLinus Torvalds } 1961da177e4SLinus Torvalds 19765b4b4e8SAndrew Morton module_init(ip6table_filter_init); 19865b4b4e8SAndrew Morton module_exit(ip6table_filter_fini); 199