[linux-block.git] / net / netfilter / nft_queue.c

// SPDX-License-Identifier: GPL-2.0-only
/*
 * Copyright (c) 2013 Eric Leblond <eric@regit.org>
 *
 * Development of this code partly funded by OISF
 * (http://www.openinfosecfoundation.org/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/jhash.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_queue.h>

static u32 jhash_initval __read_mostly;

struct nft_queue {
	u8	sreg_qnum;
	u16	queuenum;
	u16	queues_total;
	u16	flags;
};

static void nft_queue_eval(const struct nft_expr *expr,
			   struct nft_regs *regs,
			   const struct nft_pktinfo *pkt)
{
	struct nft_queue *priv = nft_expr_priv(expr);
	u32 queue = priv->queuenum;
	u32 ret;

	if (priv->queues_total > 1) {
		if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
			int cpu = raw_smp_processor_id();

			queue = priv->queuenum + cpu % priv->queues_total;
		} else {
			queue = nfqueue_hash(pkt->skb, queue,
					     priv->queues_total, nft_pf(pkt),
					     jhash_initval);
		}
	}

	ret = NF_QUEUE_NR(queue);
	if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
		ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;

	regs->verdict.code = ret;
}

static void nft_queue_sreg_eval(const struct nft_expr *expr,
				struct nft_regs *regs,
				const struct nft_pktinfo *pkt)
{
	struct nft_queue *priv = nft_expr_priv(expr);
	u32 queue, ret;

	queue = regs->data[priv->sreg_qnum];

	ret = NF_QUEUE_NR(queue);
	if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
		ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;

	regs->verdict.code = ret;
}

static int nft_queue_validate(const struct nft_ctx *ctx,
			      const struct nft_expr *expr,
			      const struct nft_data **data)
{
	static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) |
						     (1 << NF_INET_LOCAL_IN) |
						     (1 << NF_INET_FORWARD) |
						     (1 << NF_INET_LOCAL_OUT) |
						     (1 << NF_INET_POST_ROUTING));

	switch (ctx->family) {
	case NFPROTO_IPV4:
	case NFPROTO_IPV6:
	case NFPROTO_INET:
	case NFPROTO_BRIDGE:
		break;
	case NFPROTO_NETDEV: /* lacks okfn */
		fallthrough;
	default:
		return -EOPNOTSUPP;
	}

	return nft_chain_validate_hooks(ctx->chain, supported_hooks);
}

static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
	[NFTA_QUEUE_NUM]	= { .type = NLA_U16 },
	[NFTA_QUEUE_TOTAL]	= { .type = NLA_U16 },
	[NFTA_QUEUE_FLAGS]	= { .type = NLA_U16 },
	[NFTA_QUEUE_SREG_QNUM]	= { .type = NLA_U32 },
};

static int nft_queue_init(const struct nft_ctx *ctx,
			  const struct nft_expr *expr,
			  const struct nlattr * const tb[])
{
	struct nft_queue *priv = nft_expr_priv(expr);
	u32 maxid;

	priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));

	if (tb[NFTA_QUEUE_TOTAL])
		priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
	else
		priv->queues_total = 1;

	if (priv->queues_total == 0)
		return -EINVAL;

	maxid = priv->queues_total - 1 + priv->queuenum;
	if (maxid > U16_MAX)
		return -ERANGE;

	if (tb[NFTA_QUEUE_FLAGS]) {
		priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
		if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
			return -EINVAL;
	}
	return 0;
}

static int nft_queue_sreg_init(const struct nft_ctx *ctx,
			       const struct nft_expr *expr,
			       const struct nlattr * const tb[])
{
	struct nft_queue *priv = nft_expr_priv(expr);
	int err;

	err = nft_parse_register_load(tb[NFTA_QUEUE_SREG_QNUM],
				      &priv->sreg_qnum, sizeof(u32));
	if (err < 0)
		return err;

	if (tb[NFTA_QUEUE_FLAGS]) {
		priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
		if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
			return -EINVAL;
		if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT)
			return -EOPNOTSUPP;
	}

	return 0;
}

static int nft_queue_dump(struct sk_buff *skb,
			  const struct nft_expr *expr, bool reset)
{
	const struct nft_queue *priv = nft_expr_priv(expr);

	if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) ||
	    nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) ||
	    nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -1;
}

static int
nft_queue_sreg_dump(struct sk_buff *skb,
		    const struct nft_expr *expr, bool reset)
{
	const struct nft_queue *priv = nft_expr_priv(expr);

	if (nft_dump_register(skb, NFTA_QUEUE_SREG_QNUM, priv->sreg_qnum) ||
	    nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_queue_type;
static const struct nft_expr_ops nft_queue_ops = {
	.type		= &nft_queue_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_queue)),
	.eval		= nft_queue_eval,
	.init		= nft_queue_init,
	.dump		= nft_queue_dump,
	.validate	= nft_queue_validate,
	.reduce		= NFT_REDUCE_READONLY,
};

static const struct nft_expr_ops nft_queue_sreg_ops = {
	.type		= &nft_queue_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_queue)),
	.eval		= nft_queue_sreg_eval,
	.init		= nft_queue_sreg_init,
	.dump		= nft_queue_sreg_dump,
	.validate	= nft_queue_validate,
	.reduce		= NFT_REDUCE_READONLY,
};

static const struct nft_expr_ops *
nft_queue_select_ops(const struct nft_ctx *ctx,
		     const struct nlattr * const tb[])
{
	if (tb[NFTA_QUEUE_NUM] && tb[NFTA_QUEUE_SREG_QNUM])
		return ERR_PTR(-EINVAL);

	init_hashrandom(&jhash_initval);

	if (tb[NFTA_QUEUE_NUM])
		return &nft_queue_ops;

	if (tb[NFTA_QUEUE_SREG_QNUM])
		return &nft_queue_sreg_ops;

	return ERR_PTR(-EINVAL);
}

static struct nft_expr_type nft_queue_type __read_mostly = {
	.name		= "queue",
	.select_ops	= nft_queue_select_ops,
	.policy		= nft_queue_policy,
	.maxattr	= NFTA_QUEUE_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_queue_module_init(void)
{
	return nft_register_expr(&nft_queue_type);
}

static void __exit nft_queue_module_exit(void)
{
	nft_unregister_expr(&nft_queue_type);
}

module_init(nft_queue_module_init);
module_exit(nft_queue_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
MODULE_ALIAS_NFT_EXPR("queue");
MODULE_DESCRIPTION("Netfilter nftables queue module");
Commit	Line	Data
d2912cb1	1	// SPDX-License-Identifier: GPL-2.0-only
0aff078d EL	2	/*
	3	* Copyright (c) 2013 Eric Leblond <eric@regit.org>
	4	*
0aff078d EL	5	* Development of this code partly funded by OISF
	6	* (http://www.openinfosecfoundation.org/)
	7	*/
	8
	9	#include <linux/kernel.h>
	10	#include <linux/init.h>
	11	#include <linux/module.h>
	12	#include <linux/netlink.h>
	13	#include <linux/jhash.h>
	14	#include <linux/netfilter.h>
	15	#include <linux/netfilter/nf_tables.h>
	16	#include <net/netfilter/nf_tables.h>
	17	#include <net/netfilter/nf_queue.h>
	18
	19	static u32 jhash_initval __read_mostly;
	20
	21	struct nft_queue {
4f16d25c PNA	22	u8 sreg_qnum;
	23	u16 queuenum;
	24	u16 queues_total;
	25	u16 flags;
0aff078d EL	26	};
	27
	28	static void nft_queue_eval(const struct nft_expr *expr,
a55e22e9	29	struct nft_regs *regs,
0aff078d EL	30	const struct nft_pktinfo *pkt)
	31	{
	32	struct nft_queue *priv = nft_expr_priv(expr);
	33	u32 queue = priv->queuenum;
	34	u32 ret;
	35
	36	if (priv->queues_total > 1) {
	37	if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
c2e756ff	38	int cpu = raw_smp_processor_id();
0aff078d EL	39
	40	queue = priv->queuenum + cpu % priv->queues_total;
	41	} else {
	42	queue = nfqueue_hash(pkt->skb, queue,
0e5a1c7e	43	priv->queues_total, nft_pf(pkt),
0aff078d EL	44	jhash_initval);
	45	}
	46	}
	47
	48	ret = NF_QUEUE_NR(queue);
	49	if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
	50	ret \|= NF_VERDICT_FLAG_QUEUE_BYPASS;
	51
a55e22e9	52	regs->verdict.code = ret;
0aff078d EL	53	}
0aff078d EL	54
8061bb54 LZ	55	static void nft_queue_sreg_eval(const struct nft_expr *expr,
	56	struct nft_regs *regs,
	57	const struct nft_pktinfo *pkt)
	58	{
	59	struct nft_queue *priv = nft_expr_priv(expr);
	60	u32 queue, ret;
	61
	62	queue = regs->data[priv->sreg_qnum];
	63
	64	ret = NF_QUEUE_NR(queue);
	65	if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
	66	ret \|= NF_VERDICT_FLAG_QUEUE_BYPASS;
	67
	68	regs->verdict.code = ret;
	69	}
	70
47f4f510 FW	71	static int nft_queue_validate(const struct nft_ctx *ctx,
	72	const struct nft_expr *expr,
	73	const struct nft_data **data)
	74	{
	75	static const unsigned int supported_hooks = ((1 << NF_INET_PRE_ROUTING) \|
	76	(1 << NF_INET_LOCAL_IN) \|
	77	(1 << NF_INET_FORWARD) \|
	78	(1 << NF_INET_LOCAL_OUT) \|
	79	(1 << NF_INET_POST_ROUTING));
	80
	81	switch (ctx->family) {
	82	case NFPROTO_IPV4:
	83	case NFPROTO_IPV6:
	84	case NFPROTO_INET:
	85	case NFPROTO_BRIDGE:
	86	break;
	87	case NFPROTO_NETDEV: /* lacks okfn */
	88	fallthrough;
	89	default:
	90	return -EOPNOTSUPP;
	91	}
	92
	93	return nft_chain_validate_hooks(ctx->chain, supported_hooks);
	94	}
	95
0aff078d EL	96	static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
	97	[NFTA_QUEUE_NUM] = { .type = NLA_U16 },
	98	[NFTA_QUEUE_TOTAL] = { .type = NLA_U16 },
	99	[NFTA_QUEUE_FLAGS] = { .type = NLA_U16 },
8061bb54	100	[NFTA_QUEUE_SREG_QNUM] = { .type = NLA_U32 },
0aff078d EL	101	};
	102
	103	static int nft_queue_init(const struct nft_ctx *ctx,
8061bb54 LZ	104	const struct nft_expr *expr,
8061bb54 LZ	105	const struct nlattr * const tb[])
0aff078d EL	106	{
0aff078d EL	107	struct nft_queue *priv = nft_expr_priv(expr);
fe01111d	108	u32 maxid;
0aff078d	109
0aff078d EL	110	priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
0aff078d EL	111
8061bb54	112	if (tb[NFTA_QUEUE_TOTAL])
0aff078d	113	priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
fe01111d LZ	114	else
	115	priv->queues_total = 1;
	116
	117	if (priv->queues_total == 0)
	118	return -EINVAL;
	119
	120	maxid = priv->queues_total - 1 + priv->queuenum;
	121	if (maxid > U16_MAX)
	122	return -ERANGE;
	123
8061bb54 LZ	124	if (tb[NFTA_QUEUE_FLAGS]) {
	125	priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
	126	if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
	127	return -EINVAL;
	128	}
	129	return 0;
	130	}
	131
	132	static int nft_queue_sreg_init(const struct nft_ctx *ctx,
	133	const struct nft_expr *expr,
	134	const struct nlattr * const tb[])
	135	{
	136	struct nft_queue *priv = nft_expr_priv(expr);
	137	int err;
	138
4f16d25c PNA	139	err = nft_parse_register_load(tb[NFTA_QUEUE_SREG_QNUM],
4f16d25c PNA	140	&priv->sreg_qnum, sizeof(u32));
8061bb54 LZ	141	if (err < 0)
	142	return err;
	143
	144	if (tb[NFTA_QUEUE_FLAGS]) {
0aff078d EL	145	priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
	146	if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
	147	return -EINVAL;
8061bb54 LZ	148	if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT)
8061bb54 LZ	149	return -EOPNOTSUPP;
0aff078d	150	}
8061bb54	151
0aff078d EL	152	return 0;
	153	}
	154
7d34aa3e PS	155	static int nft_queue_dump(struct sk_buff *skb,
7d34aa3e PS	156	const struct nft_expr *expr, bool reset)
0aff078d EL	157	{
	158	const struct nft_queue *priv = nft_expr_priv(expr);
	159
	160	if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) \|\|
	161	nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) \|\|
	162	nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
	163	goto nla_put_failure;
	164
	165	return 0;
	166
	167	nla_put_failure:
	168	return -1;
	169	}
	170
8061bb54	171	static int
7d34aa3e PS	172	nft_queue_sreg_dump(struct sk_buff *skb,
7d34aa3e PS	173	const struct nft_expr *expr, bool reset)
8061bb54 LZ	174	{
	175	const struct nft_queue *priv = nft_expr_priv(expr);
	176
	177	if (nft_dump_register(skb, NFTA_QUEUE_SREG_QNUM, priv->sreg_qnum) \|\|
	178	nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
	179	goto nla_put_failure;
	180
	181	return 0;
	182
	183	nla_put_failure:
	184	return -1;
	185	}
	186
0aff078d EL	187	static struct nft_expr_type nft_queue_type;
	188	static const struct nft_expr_ops nft_queue_ops = {
	189	.type = &nft_queue_type,
	190	.size = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
	191	.eval = nft_queue_eval,
	192	.init = nft_queue_init,
	193	.dump = nft_queue_dump,
47f4f510	194	.validate = nft_queue_validate,
b2d30654	195	.reduce = NFT_REDUCE_READONLY,
0aff078d EL	196	};
0aff078d EL	197
8061bb54 LZ	198	static const struct nft_expr_ops nft_queue_sreg_ops = {
	199	.type = &nft_queue_type,
	200	.size = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
	201	.eval = nft_queue_sreg_eval,
	202	.init = nft_queue_sreg_init,
	203	.dump = nft_queue_sreg_dump,
47f4f510	204	.validate = nft_queue_validate,
b2d30654	205	.reduce = NFT_REDUCE_READONLY,
8061bb54 LZ	206	};
	207
	208	static const struct nft_expr_ops *
	209	nft_queue_select_ops(const struct nft_ctx *ctx,
	210	const struct nlattr * const tb[])
	211	{
	212	if (tb[NFTA_QUEUE_NUM] && tb[NFTA_QUEUE_SREG_QNUM])
	213	return ERR_PTR(-EINVAL);
	214
	215	init_hashrandom(&jhash_initval);
	216
	217	if (tb[NFTA_QUEUE_NUM])
	218	return &nft_queue_ops;
	219
	220	if (tb[NFTA_QUEUE_SREG_QNUM])
	221	return &nft_queue_sreg_ops;
	222
	223	return ERR_PTR(-EINVAL);
	224	}
	225
0aff078d EL	226	static struct nft_expr_type nft_queue_type __read_mostly = {
0aff078d EL	227	.name = "queue",
d4ef3835	228	.select_ops = nft_queue_select_ops,
0aff078d EL	229	.policy = nft_queue_policy,
	230	.maxattr = NFTA_QUEUE_MAX,
	231	.owner = THIS_MODULE,
	232	};
	233
	234	static int __init nft_queue_module_init(void)
	235	{
	236	return nft_register_expr(&nft_queue_type);
	237	}
	238
	239	static void __exit nft_queue_module_exit(void)
	240	{
	241	nft_unregister_expr(&nft_queue_type);
	242	}
	243
	244	module_init(nft_queue_module_init);
	245	module_exit(nft_queue_module_exit);
	246
	247	MODULE_LICENSE("GPL");
	248	MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
	249	MODULE_ALIAS_NFT_EXPR("queue");
4cacc395	250	MODULE_DESCRIPTION("Netfilter nftables queue module");