[deliverable/linux.git] / net / ipv6 / netfilter / nf_tables_ipv6.c

/*
 * Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
 * Copyright (c) 2012-2013 Pablo Neira Ayuso <pablo@netfilter.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code funded by Astaro AG (http://www.astaro.com/)
 */

#include <linux/init.h>
#include <linux/module.h>
#include <linux/ipv6.h>
#include <linux/netfilter_ipv6.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables_ipv6.h>

static unsigned int nft_ipv6_output(const struct nf_hook_ops *ops,
				    struct sk_buff *skb,
				    const struct net_device *in,
				    const struct net_device *out,
				    int (*okfn)(struct sk_buff *))
{
	struct nft_pktinfo pkt;

	if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
		if (net_ratelimit())
			pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
				"packet\n");
		return NF_ACCEPT;
	}
	if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
		return NF_DROP;

	return nft_do_chain_pktinfo(&pkt, ops);
}

static struct nft_af_info nft_af_ipv6 __read_mostly = {
	.family		= NFPROTO_IPV6,
	.nhooks		= NF_INET_NUMHOOKS,
	.owner		= THIS_MODULE,
	.hooks		= {
		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
	},
};

static unsigned int
nft_do_chain_ipv6(const struct nf_hook_ops *ops,
		  struct sk_buff *skb,
		  const struct net_device *in,
		  const struct net_device *out,
		  int (*okfn)(struct sk_buff *))
{
	struct nft_pktinfo pkt;

	/* malformed packet, drop it */
	if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
		return NF_DROP;

	return nft_do_chain_pktinfo(&pkt, ops);
}

static struct nf_chain_type filter_ipv6 = {
	.family		= NFPROTO_IPV6,
	.name		= "filter",
	.type		= NFT_CHAIN_T_DEFAULT,
	.hook_mask	= (1 << NF_INET_LOCAL_IN) |
			  (1 << NF_INET_LOCAL_OUT) |
			  (1 << NF_INET_FORWARD) |
			  (1 << NF_INET_PRE_ROUTING) |
			  (1 << NF_INET_POST_ROUTING),
	.fn		= {
		[NF_INET_LOCAL_IN]	= nft_do_chain_ipv6,
		[NF_INET_LOCAL_OUT]	= nft_ipv6_output,
		[NF_INET_FORWARD]	= nft_do_chain_ipv6,
		[NF_INET_PRE_ROUTING]	= nft_do_chain_ipv6,
		[NF_INET_POST_ROUTING]	= nft_do_chain_ipv6,
	},
};

static int __init nf_tables_ipv6_init(void)
{
	nft_register_chain_type(&filter_ipv6);
	return nft_register_afinfo(&nft_af_ipv6);
}
static void __exit nf_tables_ipv6_exit(void)
{
	nft_unregister_afinfo(&nft_af_ipv6);
	nft_unregister_chain_type(&filter_ipv6);
}

module_init(nf_tables_ipv6_init);
module_exit(nf_tables_ipv6_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
MODULE_ALIAS_NFT_FAMILY(AF_INET6);
Commit	Line	Data
96518518 PM	1	/*
96518518 PM	2	* Copyright (c) 2008 Patrick McHardy <kaber@trash.net>
9370761c	3	* Copyright (c) 2012-2013 Pablo Neira Ayuso <pablo@netfilter.org>
96518518 PM	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*
	9	* Development of this code funded by Astaro AG (http://www.astaro.com/)
	10	*/
	11
	12	#include <linux/init.h>
	13	#include <linux/module.h>
	14	#include <linux/ipv6.h>
	15	#include <linux/netfilter_ipv6.h>
	16	#include <net/netfilter/nf_tables.h>
0ca743a5	17	#include <net/netfilter/nf_tables_ipv6.h>
96518518 PM	18
	19	static unsigned int nft_ipv6_output(const struct nf_hook_ops *ops,
	20	struct sk_buff *skb,
	21	const struct net_device *in,
	22	const struct net_device *out,
	23	int (okfn)(struct sk_buff ))
	24	{
0ca743a5 PNA	25	struct nft_pktinfo pkt;
0ca743a5 PNA	26
96518518 PM	27	if (unlikely(skb->len < sizeof(struct ipv6hdr))) {
	28	if (net_ratelimit())
	29	pr_info("nf_tables_ipv6: ignoring short SOCK_RAW "
	30	"packet\n");
	31	return NF_ACCEPT;
	32	}
0ca743a5 PNA	33	if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
0ca743a5 PNA	34	return NF_DROP;
96518518	35
0ca743a5	36	return nft_do_chain_pktinfo(&pkt, ops);
96518518 PM	37	}
	38
	39	static struct nft_af_info nft_af_ipv6 __read_mostly = {
	40	.family = NFPROTO_IPV6,
	41	.nhooks = NF_INET_NUMHOOKS,
	42	.owner = THIS_MODULE,
	43	.hooks = {
	44	[NF_INET_LOCAL_OUT] = nft_ipv6_output,
	45	},
	46	};
	47
0ca743a5 PNA	48	static unsigned int
	49	nft_do_chain_ipv6(const struct nf_hook_ops *ops,
	50	struct sk_buff *skb,
	51	const struct net_device *in,
	52	const struct net_device *out,
	53	int (okfn)(struct sk_buff ))
	54	{
	55	struct nft_pktinfo pkt;
	56
	57	/* malformed packet, drop it */
	58	if (nft_set_pktinfo_ipv6(&pkt, ops, skb, in, out) < 0)
	59	return NF_DROP;
	60
	61	return nft_do_chain_pktinfo(&pkt, ops);
	62	}
	63
9370761c PNA	64	static struct nf_chain_type filter_ipv6 = {
	65	.family = NFPROTO_IPV6,
	66	.name = "filter",
	67	.type = NFT_CHAIN_T_DEFAULT,
	68	.hook_mask = (1 << NF_INET_LOCAL_IN) \|
	69	(1 << NF_INET_LOCAL_OUT) \|
	70	(1 << NF_INET_FORWARD) \|
	71	(1 << NF_INET_PRE_ROUTING) \|
	72	(1 << NF_INET_POST_ROUTING),
	73	.fn = {
0ca743a5 PNA	74	[NF_INET_LOCAL_IN] = nft_do_chain_ipv6,
	75	[NF_INET_LOCAL_OUT] = nft_ipv6_output,
	76	[NF_INET_FORWARD] = nft_do_chain_ipv6,
	77	[NF_INET_PRE_ROUTING] = nft_do_chain_ipv6,
	78	[NF_INET_POST_ROUTING] = nft_do_chain_ipv6,
9370761c PNA	79	},
	80	};
	81
96518518 PM	82	static int __init nf_tables_ipv6_init(void)
96518518 PM	83	{
9370761c	84	nft_register_chain_type(&filter_ipv6);
96518518 PM	85	return nft_register_afinfo(&nft_af_ipv6);
96518518 PM	86	}
96518518 PM	87	static void __exit nf_tables_ipv6_exit(void)
	88	{
	89	nft_unregister_afinfo(&nft_af_ipv6);
9370761c	90	nft_unregister_chain_type(&filter_ipv6);
96518518 PM	91	}
	92
	93	module_init(nf_tables_ipv6_init);
	94	module_exit(nf_tables_ipv6_exit);
	95
	96	MODULE_LICENSE("GPL");
	97	MODULE_AUTHOR("Patrick McHardy <kaber@trash.net>");
	98	MODULE_ALIAS_NFT_FAMILY(AF_INET6);