[deliverable/linux.git] / net / netfilter / nft_queue.c

/*
 * Copyright (c) 2013 Eric Leblond <eric@regit.org>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Development of this code partly funded by OISF
 * (http://www.openinfosecfoundation.org/)
 */

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/netlink.h>
#include <linux/jhash.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
#include <net/netfilter/nf_queue.h>

static u32 jhash_initval __read_mostly;

struct nft_queue {
	u16	queuenum;
	u16	queues_total;
	u16	flags;
};

static void nft_queue_eval(const struct nft_expr *expr,
			   struct nft_regs *regs,
			   const struct nft_pktinfo *pkt)
{
	struct nft_queue *priv = nft_expr_priv(expr);
	u32 queue = priv->queuenum;
	u32 ret;

	if (priv->queues_total > 1) {
		if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
			int cpu = smp_processor_id();

			queue = priv->queuenum + cpu % priv->queues_total;
		} else {
			queue = nfqueue_hash(pkt->skb, queue,
					     priv->queues_total, pkt->pf,
					     jhash_initval);
		}
	}

	ret = NF_QUEUE_NR(queue);
	if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
		ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;

	regs->verdict.code = ret;
}

static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
	[NFTA_QUEUE_NUM]	= { .type = NLA_U16 },
	[NFTA_QUEUE_TOTAL]	= { .type = NLA_U16 },
	[NFTA_QUEUE_FLAGS]	= { .type = NLA_U16 },
};

static int nft_queue_init(const struct nft_ctx *ctx,
			   const struct nft_expr *expr,
			   const struct nlattr * const tb[])
{
	struct nft_queue *priv = nft_expr_priv(expr);

	if (tb[NFTA_QUEUE_NUM] == NULL)
		return -EINVAL;

	init_hashrandom(&jhash_initval);
	priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));

	if (tb[NFTA_QUEUE_TOTAL] != NULL)
		priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
	if (tb[NFTA_QUEUE_FLAGS] != NULL) {
		priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
		if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
			return -EINVAL;
	}
	return 0;
}

static int nft_queue_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
	const struct nft_queue *priv = nft_expr_priv(expr);

	if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) ||
	    nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) ||
	    nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
		goto nla_put_failure;

	return 0;

nla_put_failure:
	return -1;
}

static struct nft_expr_type nft_queue_type;
static const struct nft_expr_ops nft_queue_ops = {
	.type		= &nft_queue_type,
	.size		= NFT_EXPR_SIZE(sizeof(struct nft_queue)),
	.eval		= nft_queue_eval,
	.init		= nft_queue_init,
	.dump		= nft_queue_dump,
};

static struct nft_expr_type nft_queue_type __read_mostly = {
	.name		= "queue",
	.ops		= &nft_queue_ops,
	.policy		= nft_queue_policy,
	.maxattr	= NFTA_QUEUE_MAX,
	.owner		= THIS_MODULE,
};

static int __init nft_queue_module_init(void)
{
	return nft_register_expr(&nft_queue_type);
}

static void __exit nft_queue_module_exit(void)
{
	nft_unregister_expr(&nft_queue_type);
}

module_init(nft_queue_module_init);
module_exit(nft_queue_module_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
MODULE_ALIAS_NFT_EXPR("queue");
Commit	Line	Data
0aff078d EL	1	/*
	2	* Copyright (c) 2013 Eric Leblond <eric@regit.org>
	3	*
	4	* This program is free software; you can redistribute it and/or modify
	5	* it under the terms of the GNU General Public License version 2 as
	6	* published by the Free Software Foundation.
	7	*
	8	* Development of this code partly funded by OISF
	9	* (http://www.openinfosecfoundation.org/)
	10	*/
	11
	12	#include <linux/kernel.h>
	13	#include <linux/init.h>
	14	#include <linux/module.h>
	15	#include <linux/netlink.h>
	16	#include <linux/jhash.h>
	17	#include <linux/netfilter.h>
	18	#include <linux/netfilter/nf_tables.h>
	19	#include <net/netfilter/nf_tables.h>
	20	#include <net/netfilter/nf_queue.h>
	21
	22	static u32 jhash_initval __read_mostly;
	23
	24	struct nft_queue {
	25	u16 queuenum;
	26	u16 queues_total;
	27	u16 flags;
0aff078d EL	28	};
	29
	30	static void nft_queue_eval(const struct nft_expr *expr,
a55e22e9	31	struct nft_regs *regs,
0aff078d EL	32	const struct nft_pktinfo *pkt)
	33	{
	34	struct nft_queue *priv = nft_expr_priv(expr);
	35	u32 queue = priv->queuenum;
	36	u32 ret;
	37
	38	if (priv->queues_total > 1) {
	39	if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
	40	int cpu = smp_processor_id();
	41
	42	queue = priv->queuenum + cpu % priv->queues_total;
	43	} else {
	44	queue = nfqueue_hash(pkt->skb, queue,
6aa187f2	45	priv->queues_total, pkt->pf,
0aff078d EL	46	jhash_initval);
	47	}
	48	}
	49
	50	ret = NF_QUEUE_NR(queue);
	51	if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
	52	ret \|= NF_VERDICT_FLAG_QUEUE_BYPASS;
	53
a55e22e9	54	regs->verdict.code = ret;
0aff078d EL	55	}
	56
	57	static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
	58	[NFTA_QUEUE_NUM] = { .type = NLA_U16 },
	59	[NFTA_QUEUE_TOTAL] = { .type = NLA_U16 },
	60	[NFTA_QUEUE_FLAGS] = { .type = NLA_U16 },
	61	};
	62
	63	static int nft_queue_init(const struct nft_ctx *ctx,
	64	const struct nft_expr *expr,
	65	const struct nlattr * const tb[])
	66	{
	67	struct nft_queue *priv = nft_expr_priv(expr);
	68
	69	if (tb[NFTA_QUEUE_NUM] == NULL)
	70	return -EINVAL;
	71
	72	init_hashrandom(&jhash_initval);
0aff078d EL	73	priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
	74
	75	if (tb[NFTA_QUEUE_TOTAL] != NULL)
	76	priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
	77	if (tb[NFTA_QUEUE_FLAGS] != NULL) {
	78	priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
	79	if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
	80	return -EINVAL;
	81	}
	82	return 0;
	83	}
	84
	85	static int nft_queue_dump(struct sk_buff skb, const struct nft_expr expr)
	86	{
	87	const struct nft_queue *priv = nft_expr_priv(expr);
	88
	89	if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) \|\|
	90	nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) \|\|
	91	nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
	92	goto nla_put_failure;
	93
	94	return 0;
	95
	96	nla_put_failure:
	97	return -1;
	98	}
	99
	100	static struct nft_expr_type nft_queue_type;
	101	static const struct nft_expr_ops nft_queue_ops = {
	102	.type = &nft_queue_type,
	103	.size = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
	104	.eval = nft_queue_eval,
	105	.init = nft_queue_init,
	106	.dump = nft_queue_dump,
	107	};
	108
	109	static struct nft_expr_type nft_queue_type __read_mostly = {
	110	.name = "queue",
	111	.ops = &nft_queue_ops,
	112	.policy = nft_queue_policy,
	113	.maxattr = NFTA_QUEUE_MAX,
	114	.owner = THIS_MODULE,
	115	};
	116
	117	static int __init nft_queue_module_init(void)
	118	{
	119	return nft_register_expr(&nft_queue_type);
	120	}
	121
	122	static void __exit nft_queue_module_exit(void)
	123	{
	124	nft_unregister_expr(&nft_queue_type);
	125	}
	126
	127	module_init(nft_queue_module_init);
	128	module_exit(nft_queue_module_exit);
	129
	130	MODULE_LICENSE("GPL");
	131	MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
	132	MODULE_ALIAS_NFT_EXPR("queue");