1 /* iptables module for using new netfilter netlink queue
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/jhash.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_arp.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter/xt_NFQUEUE.h>
23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24 MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25 MODULE_LICENSE("GPL");
26 MODULE_ALIAS("ipt_NFQUEUE");
27 MODULE_ALIAS("ip6t_NFQUEUE");
28 MODULE_ALIAS("arpt_NFQUEUE");
30 static u32 jhash_initval __read_mostly
;
31 static bool rnd_inited __read_mostly
;
34 nfqueue_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
36 const struct xt_NFQ_info
*tinfo
= par
->targinfo
;
38 return NF_QUEUE_NR(tinfo
->queuenum
);
41 static u32
hash_v4(const struct sk_buff
*skb
)
43 const struct iphdr
*iph
= ip_hdr(skb
);
45 /* packets in either direction go into same queue */
46 if (iph
->saddr
< iph
->daddr
)
47 return jhash_3words((__force u32
)iph
->saddr
,
48 (__force u32
)iph
->daddr
, iph
->protocol
, jhash_initval
);
50 return jhash_3words((__force u32
)iph
->daddr
,
51 (__force u32
)iph
->saddr
, iph
->protocol
, jhash_initval
);
54 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
55 static u32
hash_v6(const struct sk_buff
*skb
)
57 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
60 if (ip6h
->saddr
.s6_addr32
[3] < ip6h
->daddr
.s6_addr32
[3]) {
61 a
= (__force u32
) ip6h
->saddr
.s6_addr32
[3];
62 b
= (__force u32
) ip6h
->daddr
.s6_addr32
[3];
64 b
= (__force u32
) ip6h
->saddr
.s6_addr32
[3];
65 a
= (__force u32
) ip6h
->daddr
.s6_addr32
[3];
68 if (ip6h
->saddr
.s6_addr32
[1] < ip6h
->daddr
.s6_addr32
[1])
69 c
= (__force u32
) ip6h
->saddr
.s6_addr32
[1];
71 c
= (__force u32
) ip6h
->daddr
.s6_addr32
[1];
73 return jhash_3words(a
, b
, c
, jhash_initval
);
78 nfqueue_tg_v1(struct sk_buff
*skb
, const struct xt_action_param
*par
)
80 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
81 u32 queue
= info
->queuenum
;
83 if (info
->queues_total
> 1) {
84 if (par
->family
== NFPROTO_IPV4
)
85 queue
= (((u64
) hash_v4(skb
) * info
->queues_total
) >>
87 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
88 else if (par
->family
== NFPROTO_IPV6
)
89 queue
= (((u64
) hash_v6(skb
) * info
->queues_total
) >>
93 return NF_QUEUE_NR(queue
);
97 nfqueue_tg_v2(struct sk_buff
*skb
, const struct xt_action_param
*par
)
99 const struct xt_NFQ_info_v2
*info
= par
->targinfo
;
100 unsigned int ret
= nfqueue_tg_v1(skb
, par
);
103 ret
|= NF_VERDICT_FLAG_QUEUE_BYPASS
;
107 static int nfqueue_tg_check(const struct xt_tgchk_param
*par
)
109 const struct xt_NFQ_info_v2
*info
= par
->targinfo
;
112 if (unlikely(!rnd_inited
)) {
113 get_random_bytes(&jhash_initval
, sizeof(jhash_initval
));
116 if (info
->queues_total
== 0) {
117 pr_err("NFQUEUE: number of total queues is 0\n");
120 maxid
= info
->queues_total
- 1 + info
->queuenum
;
121 if (maxid
> 0xffff) {
122 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
123 info
->queues_total
, maxid
);
126 if (par
->target
->revision
== 2 && info
->bypass
> 1)
131 static struct xt_target nfqueue_tg_reg
[] __read_mostly
= {
134 .family
= NFPROTO_UNSPEC
,
135 .target
= nfqueue_tg
,
136 .targetsize
= sizeof(struct xt_NFQ_info
),
142 .family
= NFPROTO_UNSPEC
,
143 .checkentry
= nfqueue_tg_check
,
144 .target
= nfqueue_tg_v1
,
145 .targetsize
= sizeof(struct xt_NFQ_info_v1
),
151 .family
= NFPROTO_UNSPEC
,
152 .checkentry
= nfqueue_tg_check
,
153 .target
= nfqueue_tg_v2
,
154 .targetsize
= sizeof(struct xt_NFQ_info_v2
),
159 static int __init
nfqueue_tg_init(void)
161 return xt_register_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
164 static void __exit
nfqueue_tg_exit(void)
166 xt_unregister_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
169 module_init(nfqueue_tg_init
);
170 module_exit(nfqueue_tg_exit
);