Subversion Repositories or1k

/*
 *	Generic loadable firewalls. At the moment only IP will actually
 *	use these, but people can add the others as they are needed.
 *
 *	Authors:	Dave Bonn (for IP)
 *	much hacked by:	Alan Cox
 */
 
#include <linux/module.h> 
#include <linux/config.h>
#include <linux/skbuff.h>
#include <linux/firewall.h>
 
static int firewall_lock=0;
static int firewall_policy[NPROTO];
static struct firewall_ops *firewall_chain[NPROTO];
 
/*
 *	Register a firewall
 */
 
int register_firewall(int pf, struct firewall_ops *fw)
{
	struct firewall_ops **p;
 
	if(pf<0||pf>=NPROTO)
		return -EINVAL;
 
	/*
	 *	Don't allow two people to adjust at once.
	 */
 
	while(firewall_lock)
		schedule();
	firewall_lock=1;
 
	p=&firewall_chain[pf];
 
	while(*p)
	{
		if(fw->fw_priority > (*p)->fw_priority)
			break;
		p=&((*p)->next);
	}
 
 
	/*
	 * We need to use a memory barrier to make sure that this
	 * works correctly even in SMP with weakly ordered writes.
	 *
	 * This is atomic wrt interrupts (and generally walking the
	 * chain), but not wrt itself (so you can't call this from
	 * an interrupt. Not that you'd want to).
	 */
	fw->next=*p;
	mb();
	*p = fw;
 
	/*
	 *	And release the sleep lock
	 */
 
	firewall_lock=0;
	return 0;
}
 
/*
 *	Unregister a firewall
 */
 
int unregister_firewall(int pf, struct firewall_ops *fw)
{
	struct firewall_ops **nl;
 
	if(pf<0||pf>=NPROTO)
		return -EINVAL;
 
	/*
	 *	Don't allow two people to adjust at once.
	 */
 
	while(firewall_lock)
		schedule();
	firewall_lock=1;
 
	nl=&firewall_chain[pf];
 
	while(*nl!=NULL)
	{
		if(*nl==fw)
		{
			struct firewall_ops *f=fw->next;
			*nl = f;
			firewall_lock=0;
			return 0;
		}			
		nl=&((*nl)->next);
	}
	firewall_lock=0;
	return -ENOENT;
}
 
int call_fw_firewall(int pf, struct device *dev, void *phdr, void *arg)
{
	struct firewall_ops *fw=firewall_chain[pf];
 
	while(fw!=NULL)
	{
		int rc=fw->fw_forward(fw,pf,dev,phdr,arg);
		if(rc!=FW_SKIP)
			return rc;
		fw=fw->next;
	}
	return firewall_policy[pf];
}
 
/*
 *	Actual invocation of the chains
 */
 
int call_in_firewall(int pf, struct device *dev, void *phdr, void *arg)
{
	struct firewall_ops *fw=firewall_chain[pf];
 
	while(fw!=NULL)
	{
		int rc=fw->fw_input(fw,pf,dev,phdr,arg);
		if(rc!=FW_SKIP)
			return rc;
		fw=fw->next;
	}
	return firewall_policy[pf];
}
 
int call_out_firewall(int pf, struct device *dev, void *phdr, void *arg)
{
	struct firewall_ops *fw=firewall_chain[pf];
 
	while(fw!=NULL)
	{
		int rc=fw->fw_output(fw,pf,dev,phdr,arg);
		if(rc!=FW_SKIP)
			return rc;
		fw=fw->next;
	}
	/* alan, is this right? */
	return firewall_policy[pf];
}
 
static struct symbol_table firewall_syms = {
#include <linux/symtab_begin.h>
	X(register_firewall),
	X(unregister_firewall),
	X(call_in_firewall),
	X(call_out_firewall),
	X(call_fw_firewall),
#include <linux/symtab_end.h>
};
 
void fwchain_init(void)
{
	int i;
	for(i=0;i<NPROTO;i++)
		firewall_policy[i]=FW_ACCEPT;
	register_symtab(&firewall_syms);
}