1
2
3
4
5
6
7
8
9
10
11#include <linux/module.h>
12#include <linux/skbuff.h>
13
14#include <linux/ip.h>
15#include <linux/ipv6.h>
16#include <linux/jhash.h>
17
18#include <linux/netfilter.h>
19#include <linux/netfilter_arp.h>
20#include <linux/netfilter/x_tables.h>
21#include <linux/netfilter/xt_NFQUEUE.h>
22
23MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25MODULE_LICENSE("GPL");
26MODULE_ALIAS("ipt_NFQUEUE");
27MODULE_ALIAS("ip6t_NFQUEUE");
28MODULE_ALIAS("arpt_NFQUEUE");
29
30static u32 jhash_initval __read_mostly;
31static bool rnd_inited __read_mostly;
32
33static unsigned int
34nfqueue_tg(struct sk_buff *skb, const struct xt_action_param *par)
35{
36 const struct xt_NFQ_info *tinfo = par->targinfo;
37
38 return NF_QUEUE_NR(tinfo->queuenum);
39}
40
41static u32 hash_v4(const struct sk_buff *skb)
42{
43 const struct iphdr *iph = ip_hdr(skb);
44
45
46 if (iph->saddr < iph->daddr)
47 return jhash_3words((__force u32)iph->saddr,
48 (__force u32)iph->daddr, iph->protocol, jhash_initval);
49
50 return jhash_3words((__force u32)iph->daddr,
51 (__force u32)iph->saddr, iph->protocol, jhash_initval);
52}
53
54#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
55static u32 hash_v6(const struct sk_buff *skb)
56{
57 const struct ipv6hdr *ip6h = ipv6_hdr(skb);
58 u32 a, b, c;
59
60 if (ip6h->saddr.s6_addr32[3] < ip6h->daddr.s6_addr32[3]) {
61 a = (__force u32) ip6h->saddr.s6_addr32[3];
62 b = (__force u32) ip6h->daddr.s6_addr32[3];
63 } else {
64 b = (__force u32) ip6h->saddr.s6_addr32[3];
65 a = (__force u32) ip6h->daddr.s6_addr32[3];
66 }
67
68 if (ip6h->saddr.s6_addr32[1] < ip6h->daddr.s6_addr32[1])
69 c = (__force u32) ip6h->saddr.s6_addr32[1];
70 else
71 c = (__force u32) ip6h->daddr.s6_addr32[1];
72
73 return jhash_3words(a, b, c, jhash_initval);
74}
75#endif
76
77static unsigned int
78nfqueue_tg_v1(struct sk_buff *skb, const struct xt_action_param *par)
79{
80 const struct xt_NFQ_info_v1 *info = par->targinfo;
81 u32 queue = info->queuenum;
82
83 if (info->queues_total > 1) {
84 if (par->family == NFPROTO_IPV4)
85 queue = (((u64) hash_v4(skb) * info->queues_total) >>
86 32) + queue;
87#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
88 else if (par->family == NFPROTO_IPV6)
89 queue = (((u64) hash_v6(skb) * info->queues_total) >>
90 32) + queue;
91#endif
92 }
93 return NF_QUEUE_NR(queue);
94}
95
96static unsigned int
97nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
98{
99 const struct xt_NFQ_info_v2 *info = par->targinfo;
100 unsigned int ret = nfqueue_tg_v1(skb, par);
101
102 if (info->bypass)
103 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
104 return ret;
105}
106
107static int nfqueue_tg_check(const struct xt_tgchk_param *par)
108{
109 const struct xt_NFQ_info_v2 *info = par->targinfo;
110 u32 maxid;
111
112 if (unlikely(!rnd_inited)) {
113 get_random_bytes(&jhash_initval, sizeof(jhash_initval));
114 rnd_inited = true;
115 }
116 if (info->queues_total == 0) {
117 pr_err("NFQUEUE: number of total queues is 0\n");
118 return -EINVAL;
119 }
120 maxid = info->queues_total - 1 + info->queuenum;
121 if (maxid > 0xffff) {
122 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
123 info->queues_total, maxid);
124 return -ERANGE;
125 }
126 if (par->target->revision == 2 && info->bypass > 1)
127 return -EINVAL;
128 return 0;
129}
130
131static struct xt_target nfqueue_tg_reg[] __read_mostly = {
132 {
133 .name = "NFQUEUE",
134 .family = NFPROTO_UNSPEC,
135 .target = nfqueue_tg,
136 .targetsize = sizeof(struct xt_NFQ_info),
137 .me = THIS_MODULE,
138 },
139 {
140 .name = "NFQUEUE",
141 .revision = 1,
142 .family = NFPROTO_UNSPEC,
143 .checkentry = nfqueue_tg_check,
144 .target = nfqueue_tg_v1,
145 .targetsize = sizeof(struct xt_NFQ_info_v1),
146 .me = THIS_MODULE,
147 },
148 {
149 .name = "NFQUEUE",
150 .revision = 2,
151 .family = NFPROTO_UNSPEC,
152 .checkentry = nfqueue_tg_check,
153 .target = nfqueue_tg_v2,
154 .targetsize = sizeof(struct xt_NFQ_info_v2),
155 .me = THIS_MODULE,
156 },
157};
158
159static int __init nfqueue_tg_init(void)
160{
161 return xt_register_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
162}
163
164static void __exit nfqueue_tg_exit(void)
165{
166 xt_unregister_targets(nfqueue_tg_reg, ARRAY_SIZE(nfqueue_tg_reg));
167}
168
169module_init(nfqueue_tg_init);
170module_exit(nfqueue_tg_exit);
171
