1/* iptables module for using new netfilter netlink queue 2 * 3 * (C) 2005 by Harald Welte <laforge@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 */ 10 11#include <linux/module.h> 12#include <linux/skbuff.h> 13 14#include <linux/ip.h> 15#include <linux/ipv6.h> 16#include <linux/jhash.h> 17 18#include <linux/netfilter.h> 19#include <linux/netfilter_arp.h> 20#include <linux/netfilter/x_tables.h> 21#include <linux/netfilter/xt_NFQUEUE.h> 22 23MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 24MODULE_DESCRIPTION("Xtables: packet forwarding to netlink"); 25MODULE_LICENSE("GPL"); 26MODULE_ALIAS("ipt_NFQUEUE"); 27MODULE_ALIAS("ip6t_NFQUEUE"); 28MODULE_ALIAS("arpt_NFQUEUE"); 29 30static u32 jhash_initval __read_mostly; 31static bool rnd_inited __read_mostly; 32 33static unsigned int 34nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par) 35{ 36 const struct xt_NFQ_info *tinfo = par->targinfo; 37 38 return NF_QUEUE_NR(tinfo->queuenum); 39} 40 41static u32 hash_v4(const struct sk_buff *skb) 42{ 43 const struct iphdr *iph = ip_hdr(skb); 44 45 /* packets in either direction go into same queue */ 46 if ((__force u32)iph->saddr < (__force u32)iph->daddr) 47 return jhash_3words((__force u32)iph->saddr, 48 (__force u32)iph->daddr, iph->protocol, jhash_initval); 49 50 return jhash_3words((__force u32)iph->daddr, 51 (__force u32)iph->saddr, iph->protocol, jhash_initval); 52} 53 54#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 55static u32 hash_v6(const struct sk_buff *skb) 56{ 57 const struct ipv6hdr *ip6h = ipv6_hdr(skb); 58 u32 a, b, c; 59 60 if ((__force u32)ip6h->saddr.s6_addr32[3] < 61 (__force u32)ip6h->daddr.s6_addr32[3]) { 62 a = (__force u32) ip6h->saddr.s6_addr32[3]; 63 b = (__force u32) ip6h->daddr.s6_addr32[3]; 64 } else { 65 b = (__force u32) ip6h->saddr.s6_addr32[3]; 66 a = (__force u32) ip6h->daddr.s6_addr32[3]; 67 } 68 69 if ((__force u32)ip6h->saddr.s6_addr32[1] < 70 (__force u32)ip6h->daddr.s6_addr32[1]) 71 c = (__force u32) ip6h->saddr.s6_addr32[1]; 72 else 73 c = (__force u32) ip6h->daddr.s6_addr32[1]; 74 75 return jhash_3words(a, b, c, jhash_initval); 76} 77#endif 78 79static u32 80nfqueue_hash(const struct sk_buff *skb, const struct xt_action_param *par) 81{ 82 const struct xt_NFQ_info_v1 *info = par->targinfo; 83 u32 queue = info->queuenum; 84 85 if (par->family == NFPROTO_IPV4) 86 queue += ((u64) hash_v4(skb) * info->queues_total) >> 32; 87#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 88 else if (par->family == NFPROTO_IPV6) 89 queue += ((u64) hash_v6(skb) * info->queues_total) >> 32; 90#endif 91 92 return queue; 93} 94 95static unsigned int 96nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par) 97{ 98 const struct xt_NFQ_info_v1 *info = par->targinfo; 99 u32 queue = info->queuenum; 100 101 if (info->queues_total > 1) 102 queue = nfqueue_hash(skb, par); 103 104 return NF_QUEUE_NR(queue); 105} 106 107static unsigned int 108nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par) 109{ 110 const struct xt_NFQ_info_v2 *info = par->targinfo; 111 unsigned int ret = nfqueue_tg_v1(skb, par); 112 113 if (info->bypass) 114 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS; 115 return ret; 116} 117 118static int nfqueue_tg_check(const struct xt_tgchk_param *par) 119{ 120 const struct xt_NFQ_info_v3 *info = par->targinfo; 121 u32 maxid; 122 123 if (unlikely(!rnd_inited)) { 124 get_random_bytes(&jhash_initval, sizeof(jhash_initval)); 125 rnd_inited = true; 126 } 127 if (info->queues_total == 0) { 128 pr_err("NFQUEUE: number of total queues is 0\n"); 129 return -EINVAL; 130 } 131 maxid = info->queues_total - 1 + info->queuenum; 132 if (maxid > 0xffff) { 133 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n", 134 info->queues_total, maxid); 135 return -ERANGE; 136 } 137 if (par->target->revision == 2 && info->flags > 1) 138 return -EINVAL; 139 if (par->target->revision == 3 && info->flags & ~NFQ_FLAG_MASK) 140 return -EINVAL; 141 142 return 0; 143} 144 145static unsigned int 146nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par) 147{ 148 const struct xt_NFQ_info_v3 *info = par->targinfo; 149 u32 queue = info->queuenum; 150 151 if (info->queues_total > 1) { 152 if (info->flags & NFQ_FLAG_CPU_FANOUT) { 153 int cpu = smp_processor_id(); 154 155 queue = info->queuenum + cpu % info->queues_total; 156 } else 157 queue = nfqueue_hash(skb, par); 158 } 159 160 return NF_QUEUE_NR(queue); 161} 162 163static struct xt_target nfqueue_tg_reg[] __read_mostly = { 164 { 165 .name = "NFQUEUE", 166 .family = NFPROTO_UNSPEC, 167 .target = nfqueue_tg, 168 .targetsize = sizeof(struct xt_NFQ_info), 169 .me = THIS_MODULE, 170 }, 171 { 172 .name = "NFQUEUE", 173 .revision = 1, 174 .family = NFPROTO_UNSPEC, 175 .checkentry = nfqueue_tg_check, 176 .target = nfqueue_tg_v1, 177 .targetsize = sizeof(struct xt_NFQ_info_v1), 178 .me = THIS_MODULE, 179 }, 180 { 181 .name = "NFQUEUE", 182 .revision = 2, 183 .family = NFPROTO_UNSPEC, 184 .checkentry = nfqueue_tg_check, 185 .target = nfqueue_tg_v2, 186 .targetsize = sizeof(struct xt_NFQ_info_v2), 187 .me = THIS_MODULE, 188 }, 189 { 190 .name = "NFQUEUE", 191 .revision = 3, 192 .family = NFPROTO_UNSPEC, 193 .checkentry = nfqueue_tg_check, 194 .target = nfqueue_tg_v3, 195 .targetsize = sizeof(struct xt_NFQ_info_v3), 196 .me = THIS_MODULE, 197 }, 198}; 199 200static int __init nfqueue_tg_init(void) 201{ 202 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); 203} 204 205static void __exit nfqueue_tg_exit(void) 206{ 207 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); 208} 209 210module_init(nfqueue_tg_init); 211module_exit(nfqueue_tg_exit); 212