1 /* iptables module for using new netfilter netlink queue
3 * (C) 2005 by Harald Welte <laforge@netfilter.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
11 #include <linux/module.h>
12 #include <linux/skbuff.h>
15 #include <linux/ipv6.h>
16 #include <linux/jhash.h>
18 #include <linux/netfilter.h>
19 #include <linux/netfilter_arp.h>
20 #include <linux/netfilter/x_tables.h>
21 #include <linux/netfilter/xt_NFQUEUE.h>
23 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
24 MODULE_DESCRIPTION("Xtables: packet forwarding to netlink");
25 MODULE_LICENSE("GPL");
26 MODULE_ALIAS("ipt_NFQUEUE");
27 MODULE_ALIAS("ip6t_NFQUEUE");
28 MODULE_ALIAS("arpt_NFQUEUE");
30 static u32 jhash_initval __read_mostly
;
31 static bool rnd_inited __read_mostly
;
34 nfqueue_tg(struct sk_buff
*skb
, const struct xt_target_param
*par
)
36 const struct xt_NFQ_info
*tinfo
= par
->targinfo
;
38 return NF_QUEUE_NR(tinfo
->queuenum
);
41 static u32
hash_v4(const struct sk_buff
*skb
)
43 const struct iphdr
*iph
= ip_hdr(skb
);
46 /* packets in either direction go into same queue */
47 ipaddr
= iph
->saddr
^ iph
->daddr
;
49 return jhash_2words((__force u32
)ipaddr
, iph
->protocol
, jhash_initval
);
52 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
53 static u32
hash_v6(const struct sk_buff
*skb
)
55 const struct ipv6hdr
*ip6h
= ipv6_hdr(skb
);
58 addr
[0] = ip6h
->saddr
.s6_addr32
[0] ^ ip6h
->daddr
.s6_addr32
[0];
59 addr
[1] = ip6h
->saddr
.s6_addr32
[1] ^ ip6h
->daddr
.s6_addr32
[1];
60 addr
[2] = ip6h
->saddr
.s6_addr32
[2] ^ ip6h
->daddr
.s6_addr32
[2];
61 addr
[3] = ip6h
->saddr
.s6_addr32
[3] ^ ip6h
->daddr
.s6_addr32
[3];
63 return jhash2((__force u32
*)addr
, ARRAY_SIZE(addr
), jhash_initval
);
68 nfqueue_tg_v1(struct sk_buff
*skb
, const struct xt_target_param
*par
)
70 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
71 u32 queue
= info
->queuenum
;
73 if (info
->queues_total
> 1) {
74 if (par
->family
== NFPROTO_IPV4
)
75 queue
= hash_v4(skb
) % info
->queues_total
+ queue
;
76 #if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
77 else if (par
->family
== NFPROTO_IPV6
)
78 queue
= hash_v6(skb
) % info
->queues_total
+ queue
;
81 return NF_QUEUE_NR(queue
);
84 static bool nfqueue_tg_v1_check(const struct xt_tgchk_param
*par
)
86 const struct xt_NFQ_info_v1
*info
= par
->targinfo
;
89 if (unlikely(!rnd_inited
)) {
90 get_random_bytes(&jhash_initval
, sizeof(jhash_initval
));
93 if (info
->queues_total
== 0) {
94 pr_err("NFQUEUE: number of total queues is 0\n");
97 maxid
= info
->queues_total
- 1 + info
->queuenum
;
99 pr_err("NFQUEUE: number of queues (%u) out of range (got %u)\n",
100 info
->queues_total
, maxid
);
106 static struct xt_target nfqueue_tg_reg
[] __read_mostly
= {
109 .family
= NFPROTO_UNSPEC
,
110 .target
= nfqueue_tg
,
111 .targetsize
= sizeof(struct xt_NFQ_info
),
117 .family
= NFPROTO_UNSPEC
,
118 .checkentry
= nfqueue_tg_v1_check
,
119 .target
= nfqueue_tg_v1
,
120 .targetsize
= sizeof(struct xt_NFQ_info_v1
),
125 static int __init
nfqueue_tg_init(void)
127 return xt_register_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
130 static void __exit
nfqueue_tg_exit(void)
132 xt_unregister_targets(nfqueue_tg_reg
, ARRAY_SIZE(nfqueue_tg_reg
));
135 module_init(nfqueue_tg_init
);
136 module_exit(nfqueue_tg_exit
);