1 /* iptables module for using new netfilter netlink queue
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/jhash.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_arp.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter/xt_NFQUEUE.h>
23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24 MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25 MODULE_LICENSE("GPL");
26 MODULE_ALIAS("ipt_NFQUEUE");
27 MODULE_ALIAS("ip6t_NFQUEUE");
28 MODULE_ALIAS("arpt_NFQUEUE");
30 static u32 jhash_initval __read_mostly
;
33 nfqueue_tg(struct sk_buff
*skb
, const struct xt_target_param
*par
)
35 const struct xt_NFQ_info
*tinfo
= par
->targinfo
;
37 return NF_QUEUE_NR(tinfo
->queuenum
);
40 static u32
hash_v4(const struct sk_buff
*skb
)
42 const struct iphdr
*iph
= ip_hdr(skb
);
45 /* packets in either direction go into same queue */
46 ipaddr
= iph
->saddr
^ iph
->daddr
;
48 return jhash_2words((__force u32
)ipaddr
, iph
->protocol
, jhash_initval
);
52 nfqueue_tg4_v1(struct sk_buff
*skb
, const struct xt_target_param
*par
)
54 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
55 u32 queue
= info
->queuenum
;
57 if (info
->queues_total
> 1)
58 queue
= hash_v4(skb
) % info
->queues_total
+ queue
;
59 return NF_QUEUE_NR(queue
);
62 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
63 static u32
hash_v6(const struct sk_buff
*skb
)
65 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
68 addr
[0] = ip6h
->saddr
.s6_addr32
[0] ^ ip6h
->daddr
.s6_addr32
[0];
69 addr
[1] = ip6h
->saddr
.s6_addr32
[1] ^ ip6h
->daddr
.s6_addr32
[1];
70 addr
[2] = ip6h
->saddr
.s6_addr32
[2] ^ ip6h
->daddr
.s6_addr32
[2];
71 addr
[3] = ip6h
->saddr
.s6_addr32
[3] ^ ip6h
->daddr
.s6_addr32
[3];
73 return jhash2((__force u32
*)addr
, ARRAY_SIZE(addr
), jhash_initval
);
77 nfqueue_tg6_v1(struct sk_buff
*skb
, const struct xt_target_param
*par
)
79 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
80 u32 queue
= info
->queuenum
;
82 if (info
->queues_total
> 1)
83 queue
= hash_v6(skb
) % info
->queues_total
+ queue
;
84 return NF_QUEUE_NR(queue
);
88 static bool nfqueue_tg_v1_check(const struct xt_tgchk_param
*par
)
90 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
93 if (info
->queues_total
== 0) {
94 pr_err("NFQUEUE: number of total queues is 0\n");
97 maxid
= info
->queues_total
- 1 + info
->queuenum
;
99 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
100 info
->queues_total
, maxid
);
106 static struct xt_target nfqueue_tg_reg
[] __read_mostly
= {
109 .family
= NFPROTO_UNSPEC
,
110 .target
= nfqueue_tg
,
111 .targetsize
= sizeof(struct xt_NFQ_info
),
117 .family
= NFPROTO_IPV4
,
118 .checkentry
= nfqueue_tg_v1_check
,
119 .target
= nfqueue_tg4_v1
,
120 .targetsize
= sizeof(struct xt_NFQ_info_v1
),
123 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
127 .family
= NFPROTO_IPV6
,
128 .checkentry
= nfqueue_tg_v1_check
,
129 .target
= nfqueue_tg6_v1
,
130 .targetsize
= sizeof(struct xt_NFQ_info_v1
),
136 static int __init
nfqueue_tg_init(void)
138 get_random_bytes(&jhash_initval
, sizeof(jhash_initval
));
139 return xt_register_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
142 static void __exit
nfqueue_tg_exit(void)
144 xt_unregister_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
147 module_init(nfqueue_tg_init
);
148 module_exit(nfqueue_tg_exit
);