1/* iptables module for using new netfilter netlink queue 2 * 3 * (C) 2005 by Harald Welte <laforge@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 */ 10 11#include <linux/module.h> 12#include <linux/skbuff.h> 13 14#include <linux/ip.h> 15#include <linux/ipv6.h> 16#include <linux/jhash.h> 17 18#include <linux/netfilter.h> 19#include <linux/netfilter_arp.h> 20#include <linux/netfilter/x_tables.h> 21#include <linux/netfilter/xt_NFQUEUE.h> 22 23MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 24MODULE_DESCRIPTION("Xtables: packet forwarding to netlink"); 25MODULE_LICENSE("GPL"); 26MODULE_ALIAS("ipt_NFQUEUE"); 27MODULE_ALIAS("ip6t_NFQUEUE"); 28MODULE_ALIAS("arpt_NFQUEUE"); 29 30static u32 jhash_initval __read_mostly; 31static bool rnd_inited __read_mostly; 32 33static unsigned int 34nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par) 35{ 36 const struct xt_NFQ_info *tinfo = par->targinfo; 37 38 return NF_QUEUE_NR(tinfo->queuenum); 39} 40 41static u32 hash_v4(const struct sk_buff *skb) 42{ 43 const struct iphdr *iph = ip_hdr(skb); 44 __be32 ipaddr; 45 46 /* packets in either direction go into same queue */ 47 ipaddr = iph->saddr ^ iph->daddr; 48 49 return jhash_2words((__force u32)ipaddr, iph->protocol, jhash_initval); 50} 51 52#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE) 53static u32 hash_v6(const struct sk_buff *skb) 54{ 55 const struct ipv6hdr *ip6h = ipv6_hdr(skb); 56 __be32 addr[4]; 57 58 addr[0] = ip6h->saddr.s6_addr32[0] ^ ip6h->daddr.s6_addr32[0]; 59 addr[1] = ip6h->saddr.s6_addr32[1] ^ ip6h->daddr.s6_addr32[1]; 60 addr[2] = ip6h->saddr.s6_addr32[2] ^ ip6h->daddr.s6_addr32[2]; 61 addr[3] = ip6h->saddr.s6_addr32[3] ^ ip6h->daddr.s6_addr32[3]; 62 63 return jhash2((__force u32 *)addr, ARRAY_SIZE(addr), jhash_initval); 64} 65#endif 66 67static unsigned int 68nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par) 69{ 70 const struct xt_NFQ_info_v1 *info = par->targinfo; 71 u32 queue = info->queuenum; 72 73 if (info->queues_total > 1) { 74 if (par->family == NFPROTO_IPV4) 75 queue = hash_v4(skb) % info->queues_total + queue; 76#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE) 77 else if (par->family == NFPROTO_IPV6) 78 queue = hash_v6(skb) % info->queues_total + queue; 79#endif 80 } 81 return NF_QUEUE_NR(queue); 82} 83 84static unsigned int 85nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par) 86 { 87 const struct xt_NFQ_info_v2 *info = par->targinfo; 88 unsigned int ret = nfqueue_tg_v1(skb, par); 89 90 if (info->bypass) 91 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS; 92 return ret; 93} 94 95static int nfqueue_tg_check(const struct xt_tgchk_param *par) 96{ 97 const struct xt_NFQ_info_v2 *info = par->targinfo; 98 u32 maxid; 99 100 if (unlikely(!rnd_inited)) { 101 get_random_bytes(&jhash_initval, sizeof(jhash_initval)); 102 rnd_inited = true; 103 } 104 if (info->queues_total == 0) { 105 pr_err("NFQUEUE: number of total queues is 0\n"); 106 return -EINVAL; 107 } 108 maxid = info->queues_total - 1 + info->queuenum; 109 if (maxid > 0xffff) { 110 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n", 111 info->queues_total, maxid); 112 return -ERANGE; 113 } 114 if (par->target->revision == 2 && info->bypass > 1) 115 return false; 116 return 0; 117} 118 119static struct xt_target nfqueue_tg_reg[] __read_mostly = { 120 { 121 .name = "NFQUEUE", 122 .family = NFPROTO_UNSPEC, 123 .target = nfqueue_tg, 124 .targetsize = sizeof(struct xt_NFQ_info), 125 .me = THIS_MODULE, 126 }, 127 { 128 .name = "NFQUEUE", 129 .revision = 1, 130 .family = NFPROTO_UNSPEC, 131 .checkentry = nfqueue_tg_check, 132 .target = nfqueue_tg_v1, 133 .targetsize = sizeof(struct xt_NFQ_info_v1), 134 .me = THIS_MODULE, 135 }, 136 { 137 .name = "NFQUEUE", 138 .revision = 2, 139 .family = NFPROTO_UNSPEC, 140 .checkentry = nfqueue_tg_check, 141 .target = nfqueue_tg_v2, 142 .targetsize = sizeof(struct xt_NFQ_info_v2), 143 .me = THIS_MODULE, 144 }, 145}; 146 147static int __init nfqueue_tg_init(void) 148{ 149 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); 150} 151 152static void __exit nfqueue_tg_exit(void) 153{ 154 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); 155} 156 157module_init(nfqueue_tg_init); 158module_exit(nfqueue_tg_exit); 159