Commit | Line | Data |
---|---|---|
d2912cb1 | 1 | // SPDX-License-Identifier: GPL-2.0-only |
2e4e6a17 HW |
2 | /* iptables module for using new netfilter netlink queue |
3 | * | |
4 | * (C) 2005 by Harald Welte <laforge@netfilter.org> | |
2e4e6a17 HW |
5 | */ |
6 | ||
e016c5e4 FW |
7 | #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt |
8 | ||
2e4e6a17 HW |
9 | #include <linux/module.h> |
10 | #include <linux/skbuff.h> | |
11 | ||
12 | #include <linux/netfilter.h> | |
13 | #include <linux/netfilter_arp.h> | |
14 | #include <linux/netfilter/x_tables.h> | |
15 | #include <linux/netfilter/xt_NFQUEUE.h> | |
16 | ||
97a2d41c EL |
17 | #include <net/netfilter/nf_queue.h> |
18 | ||
2e4e6a17 | 19 | MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); |
2ae15b64 | 20 | MODULE_DESCRIPTION("Xtables: packet forwarding to netlink"); |
2e4e6a17 HW |
21 | MODULE_LICENSE("GPL"); |
22 | MODULE_ALIAS("ipt_NFQUEUE"); | |
23 | MODULE_ALIAS("ip6t_NFQUEUE"); | |
24 | MODULE_ALIAS("arpt_NFQUEUE"); | |
25 | ||
10662aa3 FW |
26 | static u32 jhash_initval __read_mostly; |
27 | ||
2e4e6a17 | 28 | static unsigned int |
4b560b44 | 29 | nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par) |
2e4e6a17 | 30 | { |
7eb35586 | 31 | const struct xt_NFQ_info *tinfo = par->targinfo; |
2e4e6a17 HW |
32 | |
33 | return NF_QUEUE_NR(tinfo->queuenum); | |
34 | } | |
35 | ||
5c33448c | 36 | static unsigned int |
37 | nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par) | |
38 | { | |
39 | const struct xt_NFQ_info_v1 *info = par->targinfo; | |
40 | u32 queue = info->queuenum; | |
41 | ||
97a2d41c EL |
42 | if (info->queues_total > 1) { |
43 | queue = nfqueue_hash(skb, queue, info->queues_total, | |
613dbd95 | 44 | xt_family(par), jhash_initval); |
97a2d41c | 45 | } |
10662aa3 FW |
46 | return NF_QUEUE_NR(queue); |
47 | } | |
10662aa3 | 48 | |
94b27cc3 FW |
49 | static unsigned int |
50 | nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par) | |
10662aa3 | 51 | { |
94b27cc3 FW |
52 | const struct xt_NFQ_info_v2 *info = par->targinfo; |
53 | unsigned int ret = nfqueue_tg_v1(skb, par); | |
54 | ||
55 | if (info->bypass) | |
56 | ret |= NF_VERDICT_FLAG_QUEUE_BYPASS; | |
57 | return ret; | |
58 | } | |
59 | ||
60 | static int nfqueue_tg_check(const struct xt_tgchk_param *par) | |
61 | { | |
8746ddcf | 62 | const struct xt_NFQ_info_v3 *info = par->targinfo; |
10662aa3 FW |
63 | u32 maxid; |
64 | ||
97a2d41c EL |
65 | init_hashrandom(&jhash_initval); |
66 | ||
10662aa3 | 67 | if (info->queues_total == 0) { |
e016c5e4 | 68 | pr_info_ratelimited("number of total queues is 0\n"); |
d6b00a53 | 69 | return -EINVAL; |
10662aa3 FW |
70 | } |
71 | maxid = info->queues_total - 1 + info->queuenum; | |
72 | if (maxid > 0xffff) { | |
e016c5e4 FW |
73 | pr_info_ratelimited("number of queues (%u) out of range (got %u)\n", |
74 | info->queues_total, maxid); | |
4a5a5c73 | 75 | return -ERANGE; |
10662aa3 | 76 | } |
8746ddcf | 77 | if (par->target->revision == 2 && info->flags > 1) |
78 | return -EINVAL; | |
79 | if (par->target->revision == 3 && info->flags & ~NFQ_FLAG_MASK) | |
94b27cc3 | 80 | return -EINVAL; |
8746ddcf | 81 | |
d6b00a53 | 82 | return 0; |
10662aa3 FW |
83 | } |
84 | ||
8746ddcf | 85 | static unsigned int |
86 | nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par) | |
87 | { | |
88 | const struct xt_NFQ_info_v3 *info = par->targinfo; | |
89 | u32 queue = info->queuenum; | |
d9547773 | 90 | int ret; |
8746ddcf | 91 | |
92 | if (info->queues_total > 1) { | |
93 | if (info->flags & NFQ_FLAG_CPU_FANOUT) { | |
94 | int cpu = smp_processor_id(); | |
95 | ||
96 | queue = info->queuenum + cpu % info->queues_total; | |
97a2d41c EL |
97 | } else { |
98 | queue = nfqueue_hash(skb, queue, info->queues_total, | |
613dbd95 | 99 | xt_family(par), jhash_initval); |
97a2d41c | 100 | } |
8746ddcf | 101 | } |
5c33448c | 102 | |
d9547773 HE |
103 | ret = NF_QUEUE_NR(queue); |
104 | if (info->flags & NFQ_FLAG_BYPASS) | |
105 | ret |= NF_VERDICT_FLAG_QUEUE_BYPASS; | |
106 | ||
107 | return ret; | |
8746ddcf | 108 | } |
109 | ||
d3c5ee6d | 110 | static struct xt_target nfqueue_tg_reg[] __read_mostly = { |
4470bbc7 PM |
111 | { |
112 | .name = "NFQUEUE", | |
61f5abca | 113 | .family = NFPROTO_UNSPEC, |
d3c5ee6d | 114 | .target = nfqueue_tg, |
4470bbc7 PM |
115 | .targetsize = sizeof(struct xt_NFQ_info), |
116 | .me = THIS_MODULE, | |
117 | }, | |
10662aa3 FW |
118 | { |
119 | .name = "NFQUEUE", | |
120 | .revision = 1, | |
f76a47c8 | 121 | .family = NFPROTO_UNSPEC, |
94b27cc3 | 122 | .checkentry = nfqueue_tg_check, |
f76a47c8 | 123 | .target = nfqueue_tg_v1, |
10662aa3 FW |
124 | .targetsize = sizeof(struct xt_NFQ_info_v1), |
125 | .me = THIS_MODULE, | |
126 | }, | |
94b27cc3 FW |
127 | { |
128 | .name = "NFQUEUE", | |
129 | .revision = 2, | |
130 | .family = NFPROTO_UNSPEC, | |
131 | .checkentry = nfqueue_tg_check, | |
132 | .target = nfqueue_tg_v2, | |
133 | .targetsize = sizeof(struct xt_NFQ_info_v2), | |
134 | .me = THIS_MODULE, | |
135 | }, | |
8746ddcf | 136 | { |
137 | .name = "NFQUEUE", | |
138 | .revision = 3, | |
139 | .family = NFPROTO_UNSPEC, | |
140 | .checkentry = nfqueue_tg_check, | |
141 | .target = nfqueue_tg_v3, | |
142 | .targetsize = sizeof(struct xt_NFQ_info_v3), | |
143 | .me = THIS_MODULE, | |
144 | }, | |
2e4e6a17 HW |
145 | }; |
146 | ||
d3c5ee6d | 147 | static int __init nfqueue_tg_init(void) |
2e4e6a17 | 148 | { |
d3c5ee6d | 149 | return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); |
2e4e6a17 HW |
150 | } |
151 | ||
d3c5ee6d | 152 | static void __exit nfqueue_tg_exit(void) |
2e4e6a17 | 153 | { |
d3c5ee6d | 154 | xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); |
2e4e6a17 HW |
155 | } |
156 | ||
d3c5ee6d JE |
157 | module_init(nfqueue_tg_init); |
158 | module_exit(nfqueue_tg_exit); |