iptable_raw.c 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
  4. *
  5. * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@netfilter.org>
  6. */
  7. #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  8. #include <linux/module.h>
  9. #include <linux/netfilter_ipv4/ip_tables.h>
  10. #include <linux/slab.h>
  11. #include <net/ip.h>
  12. #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
  13. static int __net_init iptable_raw_table_init(struct net *net);
  14. static bool raw_before_defrag __read_mostly;
  15. MODULE_PARM_DESC(raw_before_defrag, "Enable raw table before defrag");
  16. module_param(raw_before_defrag, bool, 0000);
  17. static const struct xt_table packet_raw = {
  18. .name = "raw",
  19. .valid_hooks = RAW_VALID_HOOKS,
  20. .me = THIS_MODULE,
  21. .af = NFPROTO_IPV4,
  22. .priority = NF_IP_PRI_RAW,
  23. .table_init = iptable_raw_table_init,
  24. };
  25. static const struct xt_table packet_raw_before_defrag = {
  26. .name = "raw",
  27. .valid_hooks = RAW_VALID_HOOKS,
  28. .me = THIS_MODULE,
  29. .af = NFPROTO_IPV4,
  30. .priority = NF_IP_PRI_RAW_BEFORE_DEFRAG,
  31. .table_init = iptable_raw_table_init,
  32. };
  33. /* The work comes in here from netfilter.c. */
  34. static unsigned int
  35. iptable_raw_hook(void *priv, struct sk_buff *skb,
  36. const struct nf_hook_state *state)
  37. {
  38. return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
  39. }
  40. static struct nf_hook_ops *rawtable_ops __read_mostly;
  41. static int __net_init iptable_raw_table_init(struct net *net)
  42. {
  43. struct ipt_replace *repl;
  44. const struct xt_table *table = &packet_raw;
  45. int ret;
  46. if (raw_before_defrag)
  47. table = &packet_raw_before_defrag;
  48. if (net->ipv4.iptable_raw)
  49. return 0;
  50. repl = ipt_alloc_initial_table(table);
  51. if (repl == NULL)
  52. return -ENOMEM;
  53. ret = ipt_register_table(net, table, repl, rawtable_ops,
  54. &net->ipv4.iptable_raw);
  55. kfree(repl);
  56. return ret;
  57. }
  58. static void __net_exit iptable_raw_net_pre_exit(struct net *net)
  59. {
  60. if (net->ipv4.iptable_raw)
  61. ipt_unregister_table_pre_exit(net, net->ipv4.iptable_raw,
  62. rawtable_ops);
  63. }
  64. static void __net_exit iptable_raw_net_exit(struct net *net)
  65. {
  66. if (!net->ipv4.iptable_raw)
  67. return;
  68. ipt_unregister_table_exit(net, net->ipv4.iptable_raw);
  69. net->ipv4.iptable_raw = NULL;
  70. }
  71. static struct pernet_operations iptable_raw_net_ops = {
  72. .pre_exit = iptable_raw_net_pre_exit,
  73. .exit = iptable_raw_net_exit,
  74. };
  75. static int __init iptable_raw_init(void)
  76. {
  77. int ret;
  78. const struct xt_table *table = &packet_raw;
  79. if (raw_before_defrag) {
  80. table = &packet_raw_before_defrag;
  81. pr_info("Enabling raw table before defrag\n");
  82. }
  83. rawtable_ops = xt_hook_ops_alloc(table, iptable_raw_hook);
  84. if (IS_ERR(rawtable_ops))
  85. return PTR_ERR(rawtable_ops);
  86. ret = register_pernet_subsys(&iptable_raw_net_ops);
  87. if (ret < 0) {
  88. kfree(rawtable_ops);
  89. return ret;
  90. }
  91. ret = iptable_raw_table_init(&init_net);
  92. if (ret) {
  93. unregister_pernet_subsys(&iptable_raw_net_ops);
  94. kfree(rawtable_ops);
  95. }
  96. return ret;
  97. }
  98. static void __exit iptable_raw_fini(void)
  99. {
  100. unregister_pernet_subsys(&iptable_raw_net_ops);
  101. kfree(rawtable_ops);
  102. }
  103. module_init(iptable_raw_init);
  104. module_exit(iptable_raw_fini);
  105. MODULE_LICENSE("GPL");