1 /*
2 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
3 * Copyright (c) 2012-2013 Pablo Neira Ayuso <pablo@netfilter.org>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Development of this code funded by Astaro AG (http://www.astaro.com/)
10 */
11
12 #include <linux/init.h>
13 #include <linux/module.h>
14 #include <linux/ipv6.h>
15 #include <linux/netfilter_ipv6.h>
16 #include <net/netfilter/nf_tables.h>
17 #include <net/netfilter/nf_tables_ipv6.h>
18
nft_do_chain_ipv6(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)19 static unsigned int nft_do_chain_ipv6(void *priv,
20 struct sk_buff *skb,
21 const struct nf_hook_state *state)
22 {
23 struct nft_pktinfo pkt;
24
25 nft_set_pktinfo_ipv6(&pkt, skb, state);
26
27 return nft_do_chain(&pkt, priv);
28 }
29
nft_ipv6_output(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)30 static unsigned int nft_ipv6_output(void *priv,
31 struct sk_buff *skb,
32 const struct nf_hook_state *state)
33 {
34 if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
35 if (net_ratelimit())
36 pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
37 "packet\n");
38 return NF_ACCEPT;
39 }
40
41 return nft_do_chain_ipv6(priv, skb, state);
42 }
43
44 struct nft_af_info nft_af_ipv6 __read_mostly = {
45 .family = NFPROTO_IPV6,
46 .nhooks = NF_INET_NUMHOOKS,
47 .owner = THIS_MODULE,
48 .nops = 1,
49 .hooks = {
50 [NF_INET_LOCAL_IN] = nft_do_chain_ipv6,
51 [NF_INET_LOCAL_OUT] = nft_ipv6_output,
52 [NF_INET_FORWARD] = nft_do_chain_ipv6,
53 [NF_INET_PRE_ROUTING] = nft_do_chain_ipv6,
54 [NF_INET_POST_ROUTING] = nft_do_chain_ipv6,
55 },
56 };
57 EXPORT_SYMBOL_GPL(nft_af_ipv6);
58
nf_tables_ipv6_init_net(struct net * net)59 static int nf_tables_ipv6_init_net(struct net *net)
60 {
61 net->nft.ipv6 = kmalloc(sizeof(struct nft_af_info), GFP_KERNEL);
62 if (net->nft.ipv6 == NULL)
63 return -ENOMEM;
64
65 memcpy(net->nft.ipv6, &nft_af_ipv6, sizeof(nft_af_ipv6));
66
67 if (nft_register_afinfo(net, net->nft.ipv6) < 0)
68 goto err;
69
70 return 0;
71 err:
72 kfree(net->nft.ipv6);
73 return -ENOMEM;
74 }
75
nf_tables_ipv6_exit_net(struct net * net)76 static void nf_tables_ipv6_exit_net(struct net *net)
77 {
78 nft_unregister_afinfo(net, net->nft.ipv6);
79 kfree(net->nft.ipv6);
80 }
81
82 static struct pernet_operations nf_tables_ipv6_net_ops = {
83 .init = nf_tables_ipv6_init_net,
84 .exit = nf_tables_ipv6_exit_net,
85 };
86
87 static const struct nf_chain_type filter_ipv6 = {
88 .name = "filter",
89 .type = NFT_CHAIN_T_DEFAULT,
90 .family = NFPROTO_IPV6,
91 .owner = THIS_MODULE,
92 .hook_mask = (1 << NF_INET_LOCAL_IN) |
93 (1 << NF_INET_LOCAL_OUT) |
94 (1 << NF_INET_FORWARD) |
95 (1 << NF_INET_PRE_ROUTING) |
96 (1 << NF_INET_POST_ROUTING),
97 };
98
nf_tables_ipv6_init(void)99 static int __init nf_tables_ipv6_init(void)
100 {
101 int ret;
102
103 ret = nft_register_chain_type(&filter_ipv6);
104 if (ret < 0)
105 return ret;
106
107 ret = register_pernet_subsys(&nf_tables_ipv6_net_ops);
108 if (ret < 0)
109 nft_unregister_chain_type(&filter_ipv6);
110
111 return ret;
112 }
113
nf_tables_ipv6_exit(void)114 static void __exit nf_tables_ipv6_exit(void)
115 {
116 unregister_pernet_subsys(&nf_tables_ipv6_net_ops);
117 nft_unregister_chain_type(&filter_ipv6);
118 }
119
120 module_init(nf_tables_ipv6_init);
121 module_exit(nf_tables_ipv6_exit);
122
123 MODULE_LICENSE("GPL");
124 MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
125 MODULE_ALIAS_NFT_FAMILY(AF_INET6);
126