1 /* iptables module for using new netfilter netlink queue
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/jhash.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_arp.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter/xt_NFQUEUE.h>
23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24 MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25 MODULE_LICENSE("GPL");
26 MODULE_ALIAS("ipt_NFQUEUE");
27 MODULE_ALIAS("ip6t_NFQUEUE");
28 MODULE_ALIAS("arpt_NFQUEUE");
30 static u32 jhash_initval __read_mostly
;
31 static bool rnd_inited __read_mostly
;
34 nfqueue_tg(struct sk_buff
*skb
, const struct xt_action_param
*par
)
36 const struct xt_NFQ_info
*tinfo
= par
->targinfo
;
38 return NF_QUEUE_NR(tinfo
->queuenum
);
41 static u32
hash_v4(const struct sk_buff
*skb
)
43 const struct iphdr
*iph
= ip_hdr(skb
);
45 /* packets in either direction go into same queue */
46 if ((__force u32
)iph
->saddr
< (__force u32
)iph
->daddr
)
47 return jhash_3words((__force u32
)iph
->saddr
,
48 (__force u32
)iph
->daddr
, iph
->protocol
, jhash_initval
);
50 return jhash_3words((__force u32
)iph
->daddr
,
51 (__force u32
)iph
->saddr
, iph
->protocol
, jhash_initval
);
54 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
55 static u32
hash_v6(const struct sk_buff
*skb
)
57 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
60 if ((__force u32
)ip6h
->saddr
.s6_addr32
[3] <
61 (__force u32
)ip6h
->daddr
.s6_addr32
[3]) {
62 a
= (__force u32
) ip6h
->saddr
.s6_addr32
[3];
63 b
= (__force u32
) ip6h
->daddr
.s6_addr32
[3];
65 b
= (__force u32
) ip6h
->saddr
.s6_addr32
[3];
66 a
= (__force u32
) ip6h
->daddr
.s6_addr32
[3];
69 if ((__force u32
)ip6h
->saddr
.s6_addr32
[1] <
70 (__force u32
)ip6h
->daddr
.s6_addr32
[1])
71 c
= (__force u32
) ip6h
->saddr
.s6_addr32
[1];
73 c
= (__force u32
) ip6h
->daddr
.s6_addr32
[1];
75 return jhash_3words(a
, b
, c
, jhash_initval
);
80 nfqueue_tg_v1(struct sk_buff
*skb
, const struct xt_action_param
*par
)
82 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
83 u32 queue
= info
->queuenum
;
85 if (info
->queues_total
> 1) {
86 if (par
->family
== NFPROTO_IPV4
)
87 queue
= (((u64
) hash_v4(skb
) * info
->queues_total
) >>
89 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
90 else if (par
->family
== NFPROTO_IPV6
)
91 queue
= (((u64
) hash_v6(skb
) * info
->queues_total
) >>
95 return NF_QUEUE_NR(queue
);
99 nfqueue_tg_v2(struct sk_buff
*skb
, const struct xt_action_param
*par
)
101 const struct xt_NFQ_info_v2
*info
= par
->targinfo
;
102 unsigned int ret
= nfqueue_tg_v1(skb
, par
);
105 ret
|= NF_VERDICT_FLAG_QUEUE_BYPASS
;
109 static int nfqueue_tg_check(const struct xt_tgchk_param
*par
)
111 const struct xt_NFQ_info_v2
*info
= par
->targinfo
;
114 if (unlikely(!rnd_inited
)) {
115 get_random_bytes(&jhash_initval
, sizeof(jhash_initval
));
118 if (info
->queues_total
== 0) {
119 pr_err("NFQUEUE: number of total queues is 0\n");
122 maxid
= info
->queues_total
- 1 + info
->queuenum
;
123 if (maxid
> 0xffff) {
124 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
125 info
->queues_total
, maxid
);
128 if (par
->target
->revision
== 2 && info
->bypass
> 1)
133 static struct xt_target nfqueue_tg_reg
[] __read_mostly
= {
136 .family
= NFPROTO_UNSPEC
,
137 .target
= nfqueue_tg
,
138 .targetsize
= sizeof(struct xt_NFQ_info
),
144 .family
= NFPROTO_UNSPEC
,
145 .checkentry
= nfqueue_tg_check
,
146 .target
= nfqueue_tg_v1
,
147 .targetsize
= sizeof(struct xt_NFQ_info_v1
),
153 .family
= NFPROTO_UNSPEC
,
154 .checkentry
= nfqueue_tg_check
,
155 .target
= nfqueue_tg_v2
,
156 .targetsize
= sizeof(struct xt_NFQ_info_v2
),
161 static int __init
nfqueue_tg_init(void)
163 return xt_register_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
166 static void __exit
nfqueue_tg_exit(void)
168 xt_unregister_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
171 module_init(nfqueue_tg_init
);
172 module_exit(nfqueue_tg_exit
);