1 /* iptables module for using new netfilter netlink queue 2 * 3 * (C) 2005 by Harald Welte <laforge@netfilter.org> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 */ 10 11 #include <linux/module.h> 12 #include <linux/skbuff.h> 13 14 #include <linux/ip.h> 15 #include <linux/ipv6.h> 16 #include <linux/jhash.h> 17 18 #include <linux/netfilter.h> 19 #include <linux/netfilter_arp.h> 20 #include <linux/netfilter/x_tables.h> 21 #include <linux/netfilter/xt_NFQUEUE.h> 22 23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>"); 24 MODULE_DESCRIPTION("Xtables: packet forwarding to netlink"); 25 MODULE_LICENSE("GPL"); 26 MODULE_ALIAS("ipt_NFQUEUE"); 27 MODULE_ALIAS("ip6t_NFQUEUE"); 28 MODULE_ALIAS("arpt_NFQUEUE"); 29 30 static u32 jhash_initval __read_mostly; 31 static bool rnd_inited __read_mostly; 32 33 static unsigned int 34 nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par) 35 { 36 const struct xt_NFQ_info *tinfo = par->targinfo; 37 38 return NF_QUEUE_NR(tinfo->queuenum); 39 } 40 41 static u32 hash_v4(const struct sk_buff *skb) 42 { 43 const struct iphdr *iph = ip_hdr(skb); 44 45 /* packets in either direction go into same queue */ 46 if (iph->saddr < iph->daddr) 47 return jhash_3words((__force u32)iph->saddr, 48 (__force u32)iph->daddr, iph->protocol, jhash_initval); 49 50 return jhash_3words((__force u32)iph->daddr, 51 (__force u32)iph->saddr, iph->protocol, jhash_initval); 52 } 53 54 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 55 static u32 hash_v6(const struct sk_buff *skb) 56 { 57 const struct ipv6hdr *ip6h = ipv6_hdr(skb); 58 u32 a, b, c; 59 60 if (ip6h->saddr.s6_addr32[3] < ip6h->daddr.s6_addr32[3]) { 61 a = (__force u32) ip6h->saddr.s6_addr32[3]; 62 b = (__force u32) ip6h->daddr.s6_addr32[3]; 63 } else { 64 b = (__force u32) ip6h->saddr.s6_addr32[3]; 65 a = (__force u32) ip6h->daddr.s6_addr32[3]; 66 } 67 68 if (ip6h->saddr.s6_addr32[1] < ip6h->daddr.s6_addr32[1]) 69 c = (__force u32) ip6h->saddr.s6_addr32[1]; 70 else 71 c = (__force u32) ip6h->daddr.s6_addr32[1]; 72 73 return jhash_3words(a, b, c, jhash_initval); 74 } 75 #endif 76 77 static unsigned int 78 nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par) 79 { 80 const struct xt_NFQ_info_v1 *info = par->targinfo; 81 u32 queue = info->queuenum; 82 83 if (info->queues_total > 1) { 84 if (par->family == NFPROTO_IPV4) 85 queue = (((u64) hash_v4(skb) * info->queues_total) >> 86 32) + queue; 87 #if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 88 else if (par->family == NFPROTO_IPV6) 89 queue = (((u64) hash_v6(skb) * info->queues_total) >> 90 32) + queue; 91 #endif 92 } 93 return NF_QUEUE_NR(queue); 94 } 95 96 static unsigned int 97 nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par) 98 { 99 const struct xt_NFQ_info_v2 *info = par->targinfo; 100 unsigned int ret = nfqueue_tg_v1(skb, par); 101 102 if (info->bypass) 103 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS; 104 return ret; 105 } 106 107 static int nfqueue_tg_check(const struct xt_tgchk_param *par) 108 { 109 const struct xt_NFQ_info_v2 *info = par->targinfo; 110 u32 maxid; 111 112 if (unlikely(!rnd_inited)) { 113 get_random_bytes(&jhash_initval, sizeof(jhash_initval)); 114 rnd_inited = true; 115 } 116 if (info->queues_total == 0) { 117 pr_err("NFQUEUE: number of total queues is 0\n"); 118 return -EINVAL; 119 } 120 maxid = info->queues_total - 1 + info->queuenum; 121 if (maxid > 0xffff) { 122 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n", 123 info->queues_total, maxid); 124 return -ERANGE; 125 } 126 if (par->target->revision == 2 && info->bypass > 1) 127 return -EINVAL; 128 return 0; 129 } 130 131 static struct xt_target nfqueue_tg_reg[] __read_mostly = { 132 { 133 .name = "NFQUEUE", 134 .family = NFPROTO_UNSPEC, 135 .target = nfqueue_tg, 136 .targetsize = sizeof(struct xt_NFQ_info), 137 .me = THIS_MODULE, 138 }, 139 { 140 .name = "NFQUEUE", 141 .revision = 1, 142 .family = NFPROTO_UNSPEC, 143 .checkentry = nfqueue_tg_check, 144 .target = nfqueue_tg_v1, 145 .targetsize = sizeof(struct xt_NFQ_info_v1), 146 .me = THIS_MODULE, 147 }, 148 { 149 .name = "NFQUEUE", 150 .revision = 2, 151 .family = NFPROTO_UNSPEC, 152 .checkentry = nfqueue_tg_check, 153 .target = nfqueue_tg_v2, 154 .targetsize = sizeof(struct xt_NFQ_info_v2), 155 .me = THIS_MODULE, 156 }, 157 }; 158 159 static int __init nfqueue_tg_init(void) 160 { 161 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); 162 } 163 164 static void __exit nfqueue_tg_exit(void) 165 { 166 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg)); 167 } 168 169 module_init(nfqueue_tg_init); 170 module_exit(nfqueue_tg_exit); 171