tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* iptables module for using new netfilter netlink queue
2 *
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 */
10
11#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
13#include <linux/module.h>
14#include <linux/skbuff.h>
15
16#include <linux/netfilter.h>
17#include <linux/netfilter_arp.h>
18#include <linux/netfilter/x_tables.h>
19#include <linux/netfilter/xt_NFQUEUE.h>
20
21#include <net/netfilter/nf_queue.h>
22
23MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25MODULE_LICENSE("GPL");
26MODULE_ALIAS("ipt_NFQUEUE");
27MODULE_ALIAS("ip6t_NFQUEUE");
28MODULE_ALIAS("arpt_NFQUEUE");
29
30static u32 jhash_initval __read_mostly;
31
32static unsigned int
33nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par)
34{
35 const struct xt_NFQ_info *tinfo = par->targinfo;
36
37 return NF_QUEUE_NR(tinfo->queuenum);
38}
39
40static unsigned int
41nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
42{
43 const struct xt_NFQ_info_v1 *info = par->targinfo;
44 u32 queue = info->queuenum;
45
46 if (info->queues_total > 1) {
47 queue = nfqueue_hash(skb, queue, info->queues_total,
48 xt_family(par), jhash_initval);
49 }
50 return NF_QUEUE_NR(queue);
51}
52
53static unsigned int
54nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
55{
56 const struct xt_NFQ_info_v2 *info = par->targinfo;
57 unsigned int ret = nfqueue_tg_v1(skb, par);
58
59 if (info->bypass)
60 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
61 return ret;
62}
63
64static int nfqueue_tg_check(const struct xt_tgchk_param *par)
65{
66 const struct xt_NFQ_info_v3 *info = par->targinfo;
67 u32 maxid;
68
69 init_hashrandom(&jhash_initval);
70
71 if (info->queues_total == 0) {
72 pr_info_ratelimited("number of total queues is 0\n");
73 return -EINVAL;
74 }
75 maxid = info->queues_total - 1 + info->queuenum;
76 if (maxid > 0xffff) {
77 pr_info_ratelimited("number of queues (%u) out of range (got %u)\n",
78 info->queues_total, maxid);
79 return -ERANGE;
80 }
81 if (par->target->revision == 2 && info->flags > 1)
82 return -EINVAL;
83 if (par->target->revision == 3 && info->flags & ~NFQ_FLAG_MASK)
84 return -EINVAL;
85
86 return 0;
87}
88
89static unsigned int
90nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
91{
92 const struct xt_NFQ_info_v3 *info = par->targinfo;
93 u32 queue = info->queuenum;
94 int ret;
95
96 if (info->queues_total > 1) {
97 if (info->flags & NFQ_FLAG_CPU_FANOUT) {
98 int cpu = smp_processor_id();
99
100 queue = info->queuenum + cpu % info->queues_total;
101 } else {
102 queue = nfqueue_hash(skb, queue, info->queues_total,
103 xt_family(par), jhash_initval);
104 }
105 }
106
107 ret = NF_QUEUE_NR(queue);
108 if (info->flags & NFQ_FLAG_BYPASS)
109 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
110
111 return ret;
112}
113
114static struct xt_target nfqueue_tg_reg[] __read_mostly = {
115 {
116 .name = "NFQUEUE",
117 .family = NFPROTO_UNSPEC,
118 .target = nfqueue_tg,
119 .targetsize = sizeof(struct xt_NFQ_info),
120 .me = THIS_MODULE,
121 },
122 {
123 .name = "NFQUEUE",
124 .revision = 1,
125 .family = NFPROTO_UNSPEC,
126 .checkentry = nfqueue_tg_check,
127 .target = nfqueue_tg_v1,
128 .targetsize = sizeof(struct xt_NFQ_info_v1),
129 .me = THIS_MODULE,
130 },
131 {
132 .name = "NFQUEUE",
133 .revision = 2,
134 .family = NFPROTO_UNSPEC,
135 .checkentry = nfqueue_tg_check,
136 .target = nfqueue_tg_v2,
137 .targetsize = sizeof(struct xt_NFQ_info_v2),
138 .me = THIS_MODULE,
139 },
140 {
141 .name = "NFQUEUE",
142 .revision = 3,
143 .family = NFPROTO_UNSPEC,
144 .checkentry = nfqueue_tg_check,
145 .target = nfqueue_tg_v3,
146 .targetsize = sizeof(struct xt_NFQ_info_v3),
147 .me = THIS_MODULE,
148 },
149};
150
151static int __init nfqueue_tg_init(void)
152{
153 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
154}
155
156static void __exit nfqueue_tg_exit(void)
157{
158 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
159}
160
161module_init(nfqueue_tg_init);
162module_exit(nfqueue_tg_exit);