1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * 'raw' table, which is the very first hooked in at PRE_ROUTING and LOCAL_OUT .
4 *
5 * Copyright (C) 2003 Jozsef Kadlecsik <kadlec@netfilter.org>
6 */
7 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
8 #include <linux/module.h>
9 #include <linux/netfilter_ipv4/ip_tables.h>
10 #include <linux/slab.h>
11 #include <net/ip.h>
12
13 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
14
15 static int __net_init iptable_raw_table_init(struct net *net);
16
17 static bool raw_before_defrag __read_mostly;
18 MODULE_PARM_DESC(raw_before_defrag, "Enable raw table before defrag");
19 module_param(raw_before_defrag, bool, 0000);
20
21 static const struct xt_table packet_raw = {
22 .name = "raw",
23 .valid_hooks = RAW_VALID_HOOKS,
24 .me = THIS_MODULE,
25 .af = NFPROTO_IPV4,
26 .priority = NF_IP_PRI_RAW,
27 .table_init = iptable_raw_table_init,
28 };
29
30 static const struct xt_table packet_raw_before_defrag = {
31 .name = "raw",
32 .valid_hooks = RAW_VALID_HOOKS,
33 .me = THIS_MODULE,
34 .af = NFPROTO_IPV4,
35 .priority = NF_IP_PRI_RAW_BEFORE_DEFRAG,
36 .table_init = iptable_raw_table_init,
37 };
38
39 /* The work comes in here from netfilter.c. */
40 static unsigned int
iptable_raw_hook(void * priv,struct sk_buff * skb,const struct nf_hook_state * state)41 iptable_raw_hook(void *priv, struct sk_buff *skb,
42 const struct nf_hook_state *state)
43 {
44 return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
45 }
46
47 static struct nf_hook_ops *rawtable_ops __read_mostly;
48
iptable_raw_table_init(struct net * net)49 static int __net_init iptable_raw_table_init(struct net *net)
50 {
51 struct ipt_replace *repl;
52 const struct xt_table *table = &packet_raw;
53 int ret;
54
55 if (raw_before_defrag)
56 table = &packet_raw_before_defrag;
57
58 if (net->ipv4.iptable_raw)
59 return 0;
60
61 repl = ipt_alloc_initial_table(table);
62 if (repl == NULL)
63 return -ENOMEM;
64 ret = ipt_register_table(net, table, repl, rawtable_ops,
65 &net->ipv4.iptable_raw);
66 kfree(repl);
67 return ret;
68 }
69
iptable_raw_net_pre_exit(struct net * net)70 static void __net_exit iptable_raw_net_pre_exit(struct net *net)
71 {
72 if (net->ipv4.iptable_raw)
73 ipt_unregister_table_pre_exit(net, net->ipv4.iptable_raw,
74 rawtable_ops);
75 }
76
iptable_raw_net_exit(struct net * net)77 static void __net_exit iptable_raw_net_exit(struct net *net)
78 {
79 if (!net->ipv4.iptable_raw)
80 return;
81 ipt_unregister_table_exit(net, net->ipv4.iptable_raw);
82 net->ipv4.iptable_raw = NULL;
83 }
84
85 static struct pernet_operations iptable_raw_net_ops = {
86 .pre_exit = iptable_raw_net_pre_exit,
87 .exit = iptable_raw_net_exit,
88 };
89
iptable_raw_init(void)90 static int __init iptable_raw_init(void)
91 {
92 int ret;
93 const struct xt_table *table = &packet_raw;
94
95 if (raw_before_defrag) {
96 table = &packet_raw_before_defrag;
97
98 pr_info("Enabling raw table before defrag\n");
99 }
100
101 rawtable_ops = xt_hook_ops_alloc(table, iptable_raw_hook);
102 if (IS_ERR(rawtable_ops))
103 return PTR_ERR(rawtable_ops);
104
105 ret = register_pernet_subsys(&iptable_raw_net_ops);
106 if (ret < 0) {
107 kfree(rawtable_ops);
108 return ret;
109 }
110
111 ret = iptable_raw_table_init(&init_net);
112 if (ret) {
113 unregister_pernet_subsys(&iptable_raw_net_ops);
114 kfree(rawtable_ops);
115 }
116
117 return ret;
118 }
119
iptable_raw_fini(void)120 static void __exit iptable_raw_fini(void)
121 {
122 unregister_pernet_subsys(&iptable_raw_net_ops);
123 kfree(rawtable_ops);
124 }
125
126 module_init(iptable_raw_init);
127 module_exit(iptable_raw_fini);
128 MODULE_LICENSE("GPL");
129