/net/ipv4/netfilter/iptable_raw.c

http://github.com/mirrors/linux · C · 120 lines · 91 code · 22 blank · 7 comment · 9 complexity · 4bb1845ba512d433cf204d8a997dcca9 MD5 · raw file

  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
  4. *
  5. * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@netfilter.org>
  6. */
  7. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  8. #include <linux/module.h>
  9. #include <linux/netfilter_ipv4/ip_tables.h>
  10. #include <linux/slab.h>
  11. #include <net/ip.h>
  12. #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
  13. static int __net_init iptable_raw_table_init(struct net *net);
  14. static bool raw_before_defrag __read_mostly;
  15. MODULE_PARM_DESC(raw_before_defrag, "Enable raw table before defrag");
  16. module_param(raw_before_defrag, bool, 0000);
  17. static const struct xt_table packet_raw = {
  18. .name = "raw",
  19. .valid_hooks = RAW_VALID_HOOKS,
  20. .me = THIS_MODULE,
  21. .af = NFPROTO_IPV4,
  22. .priority = NF_IP_PRI_RAW,
  23. .table_init = iptable_raw_table_init,
  24. };
  25. static const struct xt_table packet_raw_before_defrag = {
  26. .name = "raw",
  27. .valid_hooks = RAW_VALID_HOOKS,
  28. .me = THIS_MODULE,
  29. .af = NFPROTO_IPV4,
  30. .priority = NF_IP_PRI_RAW_BEFORE_DEFRAG,
  31. .table_init = iptable_raw_table_init,
  32. };
  33. /* The work comes in here from netfilter.c. */
  34. static unsigned int
  35. iptable_raw_hook(void *priv, struct sk_buff *skb,
  36. const struct nf_hook_state *state)
  37. {
  38. return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
  39. }
  40. static struct nf_hook_ops *rawtable_ops __read_mostly;
  41. static int __net_init iptable_raw_table_init(struct net *net)
  42. {
  43. struct ipt_replace *repl;
  44. const struct xt_table *table = &packet_raw;
  45. int ret;
  46. if (raw_before_defrag)
  47. table = &packet_raw_before_defrag;
  48. if (net->ipv4.iptable_raw)
  49. return 0;
  50. repl = ipt_alloc_initial_table(table);
  51. if (repl == NULL)
  52. return -ENOMEM;
  53. ret = ipt_register_table(net, table, repl, rawtable_ops,
  54. &net->ipv4.iptable_raw);
  55. kfree(repl);
  56. return ret;
  57. }
  58. static void __net_exit iptable_raw_net_exit(struct net *net)
  59. {
  60. if (!net->ipv4.iptable_raw)
  61. return;
  62. ipt_unregister_table(net, net->ipv4.iptable_raw, rawtable_ops);
  63. net->ipv4.iptable_raw = NULL;
  64. }
  65. static struct pernet_operations iptable_raw_net_ops = {
  66. .exit = iptable_raw_net_exit,
  67. };
  68. static int __init iptable_raw_init(void)
  69. {
  70. int ret;
  71. const struct xt_table *table = &packet_raw;
  72. if (raw_before_defrag) {
  73. table = &packet_raw_before_defrag;
  74. pr_info("Enabling raw table before defrag\n");
  75. }
  76. rawtable_ops = xt_hook_ops_alloc(table, iptable_raw_hook);
  77. if (IS_ERR(rawtable_ops))
  78. return PTR_ERR(rawtable_ops);
  79. ret = register_pernet_subsys(&iptable_raw_net_ops);
  80. if (ret < 0) {
  81. kfree(rawtable_ops);
  82. return ret;
  83. }
  84. ret = iptable_raw_table_init(&init_net);
  85. if (ret) {
  86. unregister_pernet_subsys(&iptable_raw_net_ops);
  87. kfree(rawtable_ops);
  88. }
  89. return ret;
  90. }
  91. static void __exit iptable_raw_fini(void)
  92. {
  93. unregister_pernet_subsys(&iptable_raw_net_ops);
  94. kfree(rawtable_ops);
  95. }
  96. module_init(iptable_raw_init);
  97. module_exit(iptable_raw_fini);
  98. MODULE_LICENSE("GPL");