1/*
2 * This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.
3 *
4 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
5 * Copyright (C) 2000-2004 Netfilter Core Team <coreteam@netfilter.org>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 */
12
13#include <linux/module.h>
14#include <linux/moduleparam.h>
15#include <linux/netfilter_ipv4/ip_tables.h>
16#include <linux/slab.h>
17#include <net/ip.h>
18
19MODULE_LICENSE("GPL");
20MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
21MODULE_DESCRIPTION("iptables filter table");
22
23#define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \
24 (1 << NF_INET_FORWARD) | \
25 (1 << NF_INET_LOCAL_OUT))
26static int __net_init iptable_filter_table_init(struct net *net);
27
28static const struct xt_table packet_filter = {
29 .name = "filter",
30 .valid_hooks = FILTER_VALID_HOOKS,
31 .me = THIS_MODULE,
32 .af = NFPROTO_IPV4,
33 .priority = NF_IP_PRI_FILTER,
34 .table_init = iptable_filter_table_init,
35};
36
37static unsigned int
38iptable_filter_hook(void *priv, struct sk_buff *skb,
39 const struct nf_hook_state *state)
40{
41 return ipt_do_table(skb, state, state->net->ipv4.iptable_filter);
42}
43
44static struct nf_hook_ops *filter_ops __read_mostly;
45
46/* Default to forward because I got too much mail already. */
47static bool forward __read_mostly = true;
48module_param(forward, bool, 0000);
49
50static int __net_init iptable_filter_table_init(struct net *net)
51{
52 struct ipt_replace *repl;
53 int err;
54
55 if (net->ipv4.iptable_filter)
56 return 0;
57
58 repl = ipt_alloc_initial_table(&packet_filter);
59 if (repl == NULL)
60 return -ENOMEM;
61 /* Entry 1 is the FORWARD hook */
62 ((struct ipt_standard *)repl->entries)[1].target.verdict =
63 forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;
64
65 err = ipt_register_table(net, &packet_filter, repl, filter_ops,
66 &net->ipv4.iptable_filter);
67 kfree(repl);
68 return err;
69}
70
71static int __net_init iptable_filter_net_init(struct net *net)
72{
73 if (net == &init_net || !forward)
74 return iptable_filter_table_init(net);
75
76 return 0;
77}
78
79static void __net_exit iptable_filter_net_exit(struct net *net)
80{
81 if (!net->ipv4.iptable_filter)
82 return;
83 ipt_unregister_table(net, net->ipv4.iptable_filter, filter_ops);
84 net->ipv4.iptable_filter = NULL;
85}
86
87static struct pernet_operations iptable_filter_net_ops = {
88 .init = iptable_filter_net_init,
89 .exit = iptable_filter_net_exit,
90};
91
92static int __init iptable_filter_init(void)
93{
94 int ret;
95
96 filter_ops = xt_hook_ops_alloc(&packet_filter, iptable_filter_hook);
97 if (IS_ERR(filter_ops))
98 return PTR_ERR(filter_ops);
99
100 ret = register_pernet_subsys(&iptable_filter_net_ops);
101 if (ret < 0)
102 kfree(filter_ops);
103
104 return ret;
105}
106
107static void __exit iptable_filter_fini(void)
108{
109 unregister_pernet_subsys(&iptable_filter_net_ops);
110 kfree(filter_ops);
111}
112
113module_init(iptable_filter_init);
114module_exit(iptable_filter_fini);
115