cloudbaby
发表于 2005-5-15 21:02:05
1 /*2* This is the 1999 rewrite of IP Firewalling, aiming for kernel 2.3.x.3*4* Copyright ?1999 Paul `Rusty' Russell & Michael J. Neuling5*/6 #include 7 #include 8 9 #define FILTER_VALID_HOOKS ((1 ihl * 4 < sizeof(struct iphdr)) {109 if (net_ratelimit())110 printk("ipt_hook: happy cracking.\n");111 return NF_ACCEPT;112 }113 114 return ipt_do_table(pskb, hook, in, out, &packet_filter, NULL);115 }116 117 static struct nf_hook_ops ipt_ops[]118 = { { { NULL, NULL }, ipt_hook, PF_INET, NF_IP_LOCAL_IN, NF_IP_PRI_FILTER },119 { { NULL, NULL }, ipt_hook, PF_INET, NF_IP_FORWARD, NF_IP_PRI_FILTER },120 { { NULL, NULL }, ipt_local_out_hook, PF_INET, NF_IP_LOCAL_OUT,121 NF_IP_PRI_FILTER }122 };123 124 /* Default to forward because I got too much mail already. */125 static int forward = NF_ACCEPT;126 MODULE_PARM(forward, "i");127 128 static int __init init(void)129 {130 int ret;131 132 if (forward < 0 || forward > NF_MAX_VERDICT) {133 printk("iptables forward must be 0 or 1\n");134 return -EINVAL;135 }136 137 /* Entry 1 is the FORWARD hook */138 initial_table.entries.target.verdict = -forward - 1;139 140 /* Register table */141 ret = ipt_register_table(&packet_filter);142 if (ret < 0)143 return ret;144 145 /* Register hooks */146 ret = nf_register_hook(&ipt_ops);147 if (ret < 0)148 goto cleanup_table;149 150 ret = nf_register_hook(&ipt_ops);151 if (ret < 0)152 goto cleanup_hook0;153 154 ret = nf_register_hook(&ipt_ops);155 if (ret < 0)156 goto cleanup_hook1;157 158 return ret;159 160cleanup_hook1:161 nf_unregister_hook(&ipt_ops);162cleanup_hook0:163 nf_unregister_hook(&ipt_ops);164cleanup_table:165 ipt_unregister_table(&packet_filter);166 167 return ret;168 }169 170 static void __exit fini(void)171 {172 unsigned int i;173 174 for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)175 nf_unregister_hook(&ipt_ops);176 177 ipt_unregister_table(&packet_filter);178 }179 180 module_init(init);181 module_exit(fini);182 MODULE_LICENSE("GPL");183
页:
[1]