net/netfilter/nft_queue.c

   1 /*
   2  * Copyright (c) 2013 Eric Leblond <eric@regit.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code partly funded by OISF
   9  * (http://www.openinfosecfoundation.org/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/netlink.h>
  16 #include <linux/jhash.h>
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_tables.h>
  20 #include <net/netfilter/nf_queue.h>
  21
  22 static u32 jhash_initval __read_mostly;
  23
  24 struct nft_queue {
  25         u16     queuenum;
  26         u16     queues_total;
  27         u16     flags;
  28 };
  29
  30 static void nft_queue_eval(const struct nft_expr *expr,
  31                            struct nft_regs *regs,
  32                            const struct nft_pktinfo *pkt)
  33 {
  34         struct nft_queue *priv = nft_expr_priv(expr);
  35         u32 queue = priv->queuenum;
  36         u32 ret;
  37
  38         if (priv->queues_total > 1) {
  39                 if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
  40                         int cpu = smp_processor_id();
  41
  42                         queue = priv->queuenum + cpu % priv->queues_total;
  43                 } else {
  44                         queue = nfqueue_hash(pkt->skb, queue,
  45                                              priv->queues_total, pkt->pf,
  46                                              jhash_initval);
  47                 }
  48         }
  49
  50         ret = NF_QUEUE_NR(queue);
  51         if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
  52                 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
  53
  54         regs->verdict.code = ret;
  55 }
  56
  57 static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
  58         [NFTA_QUEUE_NUM]        = { .type = NLA_U16 },
  59         [NFTA_QUEUE_TOTAL]      = { .type = NLA_U16 },
  60         [NFTA_QUEUE_FLAGS]      = { .type = NLA_U16 },
  61 };
  62
  63 static int nft_queue_init(const struct nft_ctx *ctx,
  64                            const struct nft_expr *expr,
  65                            const struct nlattr * const tb[])
  66 {
  67         struct nft_queue *priv = nft_expr_priv(expr);
  68         u32 maxid;
  69
  70         if (tb[NFTA_QUEUE_NUM] == NULL)
  71                 return -EINVAL;
  72
  73         init_hashrandom(&jhash_initval);
  74         priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
  75
  76         if (tb[NFTA_QUEUE_TOTAL] != NULL)
  77                 priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
  78         else
  79                 priv->queues_total = 1;
  80
  81         if (priv->queues_total == 0)
  82                 return -EINVAL;
  83
  84         maxid = priv->queues_total - 1 + priv->queuenum;
  85         if (maxid > U16_MAX)
  86                 return -ERANGE;
  87
  88         if (tb[NFTA_QUEUE_FLAGS] != NULL) {
  89                 priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
  90                 if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
  91                         return -EINVAL;
  92         }
  93         return 0;
  94 }
  95
  96 static int nft_queue_dump(struct sk_buff *skb, const struct nft_expr *expr)
  97 {
  98         const struct nft_queue *priv = nft_expr_priv(expr);
  99
 100         if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) ||
 101             nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) ||
 102             nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
 103                 goto nla_put_failure;
 104
 105         return 0;
 106
 107 nla_put_failure:
 108         return -1;
 109 }
 110
 111 static struct nft_expr_type nft_queue_type;
 112 static const struct nft_expr_ops nft_queue_ops = {
 113         .type           = &nft_queue_type,
 114         .size           = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
 115         .eval           = nft_queue_eval,
 116         .init           = nft_queue_init,
 117         .dump           = nft_queue_dump,
 118 };
 119
 120 static struct nft_expr_type nft_queue_type __read_mostly = {
 121         .name           = "queue",
 122         .ops            = &nft_queue_ops,
 123         .policy         = nft_queue_policy,
 124         .maxattr        = NFTA_QUEUE_MAX,
 125         .owner          = THIS_MODULE,
 126 };
 127
 128 static int __init nft_queue_module_init(void)
 129 {
 130         return nft_register_expr(&nft_queue_type);
 131 }
 132
 133 static void __exit nft_queue_module_exit(void)
 134 {
 135         nft_unregister_expr(&nft_queue_type);
 136 }
 137
 138 module_init(nft_queue_module_init);
 139 module_exit(nft_queue_module_exit);
 140
 141 MODULE_LICENSE("GPL");
 142 MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
 143 MODULE_ALIAS_NFT_EXPR("queue");