iptable_raw.c 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148
  1. /*
  2. * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
  3. *
  4. * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  5. */
  6. #include <linux/module.h>
  7. #include <linux/netfilter_ipv4/ip_tables.h>
  8. #define RAW_VALID_HOOKS ((1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT))
  9. static struct
  10. {
  11. struct ipt_replace repl;
  12. struct ipt_standard entries[2];
  13. struct ipt_error term;
  14. } initial_table __initdata = {
  15. .repl = {
  16. .name = "raw",
  17. .valid_hooks = RAW_VALID_HOOKS,
  18. .num_entries = 3,
  19. .size = sizeof(struct ipt_standard) * 2 + sizeof(struct ipt_error),
  20. .hook_entry = {
  21. [NF_IP_PRE_ROUTING] = 0,
  22. [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) },
  23. .underflow = {
  24. [NF_IP_PRE_ROUTING] = 0,
  25. [NF_IP_LOCAL_OUT] = sizeof(struct ipt_standard) },
  26. },
  27. .entries = {
  28. /* PRE_ROUTING */
  29. {
  30. .entry = {
  31. .target_offset = sizeof(struct ipt_entry),
  32. .next_offset = sizeof(struct ipt_standard),
  33. },
  34. .target = {
  35. .target = {
  36. .u = {
  37. .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
  38. },
  39. },
  40. .verdict = -NF_ACCEPT - 1,
  41. },
  42. },
  43. /* LOCAL_OUT */
  44. {
  45. .entry = {
  46. .target_offset = sizeof(struct ipt_entry),
  47. .next_offset = sizeof(struct ipt_standard),
  48. },
  49. .target = {
  50. .target = {
  51. .u = {
  52. .target_size = IPT_ALIGN(sizeof(struct ipt_standard_target)),
  53. },
  54. },
  55. .verdict = -NF_ACCEPT - 1,
  56. },
  57. },
  58. },
  59. /* ERROR */
  60. .term = {
  61. .entry = {
  62. .target_offset = sizeof(struct ipt_entry),
  63. .next_offset = sizeof(struct ipt_error),
  64. },
  65. .target = {
  66. .target = {
  67. .u = {
  68. .user = {
  69. .target_size = IPT_ALIGN(sizeof(struct ipt_error_target)),
  70. .name = IPT_ERROR_TARGET,
  71. },
  72. },
  73. },
  74. .errorname = "ERROR",
  75. },
  76. }
  77. };
  78. static struct xt_table packet_raw = {
  79. .name = "raw",
  80. .valid_hooks = RAW_VALID_HOOKS,
  81. .lock = RW_LOCK_UNLOCKED,
  82. .me = THIS_MODULE,
  83. .af = AF_INET,
  84. };
  85. /* The work comes in here from netfilter.c. */
  86. static unsigned int
  87. ipt_hook(unsigned int hook,
  88. struct sk_buff **pskb,
  89. const struct net_device *in,
  90. const struct net_device *out,
  91. int (*okfn)(struct sk_buff *))
  92. {
  93. return ipt_do_table(pskb, hook, in, out, &packet_raw);
  94. }
  95. /* 'raw' is the very first table. */
  96. static struct nf_hook_ops ipt_ops[] = {
  97. {
  98. .hook = ipt_hook,
  99. .pf = PF_INET,
  100. .hooknum = NF_IP_PRE_ROUTING,
  101. .priority = NF_IP_PRI_RAW,
  102. .owner = THIS_MODULE,
  103. },
  104. {
  105. .hook = ipt_hook,
  106. .pf = PF_INET,
  107. .hooknum = NF_IP_LOCAL_OUT,
  108. .priority = NF_IP_PRI_RAW,
  109. .owner = THIS_MODULE,
  110. },
  111. };
  112. static int __init iptable_raw_init(void)
  113. {
  114. int ret;
  115. /* Register table */
  116. ret = ipt_register_table(&packet_raw, &initial_table.repl);
  117. if (ret < 0)
  118. return ret;
  119. /* Register hooks */
  120. ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
  121. if (ret < 0)
  122. goto cleanup_table;
  123. return ret;
  124. cleanup_table:
  125. ipt_unregister_table(&packet_raw);
  126. return ret;
  127. }
  128. static void __exit iptable_raw_fini(void)
  129. {
  130. nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
  131. ipt_unregister_table(&packet_raw);
  132. }
  133. module_init(iptable_raw_init);
  134. module_exit(iptable_raw_fini);
  135. MODULE_LICENSE("GPL");