1 /* iptables module for using new netfilter netlink queue
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/jhash.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_arp.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter/xt_NFQUEUE.h>
23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24 MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25 MODULE_LICENSE("GPL");
26 MODULE_ALIAS("ipt_NFQUEUE");
27 MODULE_ALIAS("ip6t_NFQUEUE");
28 MODULE_ALIAS("arpt_NFQUEUE");
30 static u32 jhash_initval __read_mostly;
31 static bool rnd_inited __read_mostly;
34 nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par)
36 const struct xt_NFQ_info *tinfo = par->targinfo;
38 return NF_QUEUE_NR(tinfo->queuenum);
41 static u32 hash_v4(const struct sk_buff *skb)
43 const struct iphdr *iph = ip_hdr(skb);
45 /* packets in either direction go into same queue */
46 if (iph->saddr < iph->daddr)
47 return jhash_3words((__force u32)iph->saddr,
48 (__force u32)iph->daddr, iph->protocol, jhash_initval);
50 return jhash_3words((__force u32)iph->daddr,
51 (__force u32)iph->saddr, iph->protocol, jhash_initval);
54 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
55 static u32 hash_v6(const struct sk_buff *skb)
57 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
60 if (ip6h->saddr.s6_addr32[3] < ip6h->daddr.s6_addr32[3]) {
61 a = (__force u32) ip6h->saddr.s6_addr32[3];
62 b = (__force u32) ip6h->daddr.s6_addr32[3];
64 b = (__force u32) ip6h->saddr.s6_addr32[3];
65 a = (__force u32) ip6h->daddr.s6_addr32[3];
68 if (ip6h->saddr.s6_addr32[1] < ip6h->daddr.s6_addr32[1])
69 c = (__force u32) ip6h->saddr.s6_addr32[1];
71 c = (__force u32) ip6h->daddr.s6_addr32[1];
73 return jhash_3words(a, b, c, jhash_initval);
78 nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
80 const struct xt_NFQ_info_v1 *info = par->targinfo;
81 u32 queue = info->queuenum;
83 if (info->queues_total > 1) {
84 if (par->family == NFPROTO_IPV4)
85 queue = (((u64) hash_v4(skb) * info->queues_total) >>
87 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
88 else if (par->family == NFPROTO_IPV6)
89 queue = (((u64) hash_v6(skb) * info->queues_total) >>
93 return NF_QUEUE_NR(queue);
97 nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
99 const struct xt_NFQ_info_v2 *info = par->targinfo;
100 unsigned int ret = nfqueue_tg_v1(skb, par);
103 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
107 static int nfqueue_tg_check(const struct xt_tgchk_param *par)
109 const struct xt_NFQ_info_v2 *info = par->targinfo;
112 if (unlikely(!rnd_inited)) {
113 get_random_bytes(&jhash_initval, sizeof(jhash_initval));
116 if (info->queues_total == 0) {
117 pr_err("NFQUEUE: number of total queues is 0\n");
120 maxid = info->queues_total - 1 + info->queuenum;
121 if (maxid > 0xffff) {
122 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
123 info->queues_total, maxid);
126 if (par->target->revision == 2 && info->bypass > 1)
131 static struct xt_target nfqueue_tg_reg[] __read_mostly = {
134 .family = NFPROTO_UNSPEC,
135 .target = nfqueue_tg,
136 .targetsize = sizeof(struct xt_NFQ_info),
142 .family = NFPROTO_UNSPEC,
143 .checkentry = nfqueue_tg_check,
144 .target = nfqueue_tg_v1,
145 .targetsize = sizeof(struct xt_NFQ_info_v1),
151 .family = NFPROTO_UNSPEC,
152 .checkentry = nfqueue_tg_check,
153 .target = nfqueue_tg_v2,
154 .targetsize = sizeof(struct xt_NFQ_info_v2),
159 static int __init nfqueue_tg_init(void)
161 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
164 static void __exit nfqueue_tg_exit(void)
166 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
169 module_init(nfqueue_tg_init);
170 module_exit(nfqueue_tg_exit);