blob: a9aca80a32aeb4c9b92757a20710960b094aa7aa [file] [log] [blame]
Harald Welte2e4e6a12006-01-12 13:30:04 -08001/* iptables module for using new netfilter netlink queue
2 *
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
4 *
5 * This program is free software; you can redistribute it and/or modify
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08006 * it under the terms of the GNU General Public License version 2 as
Harald Welte2e4e6a12006-01-12 13:30:04 -08007 * published by the Free Software Foundation.
YOSHIFUJI Hideaki601e68e2007-02-12 11:15:49 -08008 *
Harald Welte2e4e6a12006-01-12 13:30:04 -08009 */
10
Florian Westphale016c5e2018-02-09 15:52:02 +010011#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12
Harald Welte2e4e6a12006-01-12 13:30:04 -080013#include <linux/module.h>
14#include <linux/skbuff.h>
15
16#include <linux/netfilter.h>
17#include <linux/netfilter_arp.h>
18#include <linux/netfilter/x_tables.h>
19#include <linux/netfilter/xt_NFQUEUE.h>
20
Eric Leblond97a2d412013-12-06 00:24:12 +010021#include <net/netfilter/nf_queue.h>
22
Harald Welte2e4e6a12006-01-12 13:30:04 -080023MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
Jan Engelhardt2ae15b62008-01-14 23:42:28 -080024MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
Harald Welte2e4e6a12006-01-12 13:30:04 -080025MODULE_LICENSE("GPL");
26MODULE_ALIAS("ipt_NFQUEUE");
27MODULE_ALIAS("ip6t_NFQUEUE");
28MODULE_ALIAS("arpt_NFQUEUE");
29
Florian Westphal10662aa2009-06-05 13:24:24 +020030static u32 jhash_initval __read_mostly;
31
Harald Welte2e4e6a12006-01-12 13:30:04 -080032static unsigned int
Jan Engelhardt4b560b42009-07-05 19:43:26 +020033nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par)
Harald Welte2e4e6a12006-01-12 13:30:04 -080034{
Jan Engelhardt7eb35582008-10-08 11:35:19 +020035 const struct xt_NFQ_info *tinfo = par->targinfo;
Harald Welte2e4e6a12006-01-12 13:30:04 -080036
37 return NF_QUEUE_NR(tinfo->queuenum);
38}
39
Florian Westphal10662aa2009-06-05 13:24:24 +020040static unsigned int
Jan Engelhardt4b560b42009-07-05 19:43:26 +020041nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
Florian Westphal10662aa2009-06-05 13:24:24 +020042{
43 const struct xt_NFQ_info_v1 *info = par->targinfo;
44 u32 queue = info->queuenum;
45
Eric Leblond97a2d412013-12-06 00:24:12 +010046 if (info->queues_total > 1) {
47 queue = nfqueue_hash(skb, queue, info->queues_total,
Pablo Neira Ayuso613dbd92016-11-03 10:56:21 +010048 xt_family(par), jhash_initval);
Eric Leblond97a2d412013-12-06 00:24:12 +010049 }
Florian Westphal10662aa2009-06-05 13:24:24 +020050 return NF_QUEUE_NR(queue);
51}
Florian Westphal10662aa2009-06-05 13:24:24 +020052
Florian Westphal94b27cc2011-01-18 16:08:30 +010053static unsigned int
54nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
Florian Westphal10662aa2009-06-05 13:24:24 +020055{
Florian Westphal94b27cc2011-01-18 16:08:30 +010056 const struct xt_NFQ_info_v2 *info = par->targinfo;
57 unsigned int ret = nfqueue_tg_v1(skb, par);
58
59 if (info->bypass)
60 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
61 return ret;
62}
63
64static int nfqueue_tg_check(const struct xt_tgchk_param *par)
65{
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +000066 const struct xt_NFQ_info_v3 *info = par->targinfo;
Florian Westphal10662aa2009-06-05 13:24:24 +020067 u32 maxid;
68
Eric Leblond97a2d412013-12-06 00:24:12 +010069 init_hashrandom(&jhash_initval);
70
Florian Westphal10662aa2009-06-05 13:24:24 +020071 if (info->queues_total == 0) {
Florian Westphale016c5e2018-02-09 15:52:02 +010072 pr_info_ratelimited("number of total queues is 0\n");
Jan Engelhardtd6b00a52010-03-25 16:34:45 +010073 return -EINVAL;
Florian Westphal10662aa2009-06-05 13:24:24 +020074 }
75 maxid = info->queues_total - 1 + info->queuenum;
76 if (maxid > 0xffff) {
Florian Westphale016c5e2018-02-09 15:52:02 +010077 pr_info_ratelimited("number of queues (%u) out of range (got %u)\n",
78 info->queues_total, maxid);
Jan Engelhardt4a5a5c72010-03-19 17:32:59 +010079 return -ERANGE;
Florian Westphal10662aa2009-06-05 13:24:24 +020080 }
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +000081 if (par->target->revision == 2 && info->flags > 1)
Florian Westphal94b27cc2011-01-18 16:08:30 +010082 return -EINVAL;
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +000083 if (par->target->revision == 3 && info->flags & ~NFQ_FLAG_MASK)
84 return -EINVAL;
85
Jan Engelhardtd6b00a52010-03-25 16:34:45 +010086 return 0;
Florian Westphal10662aa2009-06-05 13:24:24 +020087}
88
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +000089static unsigned int
90nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
91{
92 const struct xt_NFQ_info_v3 *info = par->targinfo;
93 u32 queue = info->queuenum;
Holger Eitzenbergerd9547772013-10-28 14:42:33 +010094 int ret;
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +000095
96 if (info->queues_total > 1) {
97 if (info->flags & NFQ_FLAG_CPU_FANOUT) {
98 int cpu = smp_processor_id();
99
100 queue = info->queuenum + cpu % info->queues_total;
Eric Leblond97a2d412013-12-06 00:24:12 +0100101 } else {
102 queue = nfqueue_hash(skb, queue, info->queues_total,
Pablo Neira Ayuso613dbd92016-11-03 10:56:21 +0100103 xt_family(par), jhash_initval);
Eric Leblond97a2d412013-12-06 00:24:12 +0100104 }
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +0000105 }
holger@eitzenberger.org5c334482013-03-23 10:04:04 +0000106
Holger Eitzenbergerd9547772013-10-28 14:42:33 +0100107 ret = NF_QUEUE_NR(queue);
108 if (info->flags & NFQ_FLAG_BYPASS)
109 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
110
111 return ret;
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +0000112}
113
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800114static struct xt_target nfqueue_tg_reg[] __read_mostly = {
Patrick McHardy4470bbc2006-08-22 00:34:04 -0700115 {
116 .name = "NFQUEUE",
Florian Westphal61f5abc2009-06-05 13:18:07 +0200117 .family = NFPROTO_UNSPEC,
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800118 .target = nfqueue_tg,
Patrick McHardy4470bbc2006-08-22 00:34:04 -0700119 .targetsize = sizeof(struct xt_NFQ_info),
120 .me = THIS_MODULE,
121 },
Florian Westphal10662aa2009-06-05 13:24:24 +0200122 {
123 .name = "NFQUEUE",
124 .revision = 1,
Jan Engelhardtf76a47c2009-06-05 15:22:15 +0200125 .family = NFPROTO_UNSPEC,
Florian Westphal94b27cc2011-01-18 16:08:30 +0100126 .checkentry = nfqueue_tg_check,
Jan Engelhardtf76a47c2009-06-05 15:22:15 +0200127 .target = nfqueue_tg_v1,
Florian Westphal10662aa2009-06-05 13:24:24 +0200128 .targetsize = sizeof(struct xt_NFQ_info_v1),
129 .me = THIS_MODULE,
130 },
Florian Westphal94b27cc2011-01-18 16:08:30 +0100131 {
132 .name = "NFQUEUE",
133 .revision = 2,
134 .family = NFPROTO_UNSPEC,
135 .checkentry = nfqueue_tg_check,
136 .target = nfqueue_tg_v2,
137 .targetsize = sizeof(struct xt_NFQ_info_v2),
138 .me = THIS_MODULE,
139 },
holger@eitzenberger.org8746ddc2013-03-23 10:04:03 +0000140 {
141 .name = "NFQUEUE",
142 .revision = 3,
143 .family = NFPROTO_UNSPEC,
144 .checkentry = nfqueue_tg_check,
145 .target = nfqueue_tg_v3,
146 .targetsize = sizeof(struct xt_NFQ_info_v3),
147 .me = THIS_MODULE,
148 },
Harald Welte2e4e6a12006-01-12 13:30:04 -0800149};
150
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800151static int __init nfqueue_tg_init(void)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800152{
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800153 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800154}
155
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800156static void __exit nfqueue_tg_exit(void)
Harald Welte2e4e6a12006-01-12 13:30:04 -0800157{
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800158 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
Harald Welte2e4e6a12006-01-12 13:30:04 -0800159}
160
Jan Engelhardtd3c5ee62007-12-04 23:24:03 -0800161module_init(nfqueue_tg_init);
162module_exit(nfqueue_tg_exit);