LXR linux/net/netfilter/nft

   1/*
   2 * Copyright (c) 2013 Eric Leblond <eric@regit.org>
   3 *
   4 * This program is free software; you can redistribute it and/or modify
   5 * it under the terms of the GNU General Public License version 2 as
   6 * published by the Free Software Foundation.
   7 *
   8 * Development of this code partly funded by OISF
   9 * (http://www.openinfosecfoundation.org/)
  10 */
  11
  12#include <linux/kernel.h>
  13#include <linux/init.h>
  14#include <linux/module.h>
  15#include <linux/netlink.h>
  16#include <linux/jhash.h>
  17#include <linux/netfilter.h>
  18#include <linux/netfilter/nf_tables.h>
  19#include <net/netfilter/nf_tables.h>
  20#include <net/netfilter/nf_queue.h>
  21
  22static u32 jhash_initval __read_mostly;
  23
  24struct nft_queue {
  25        u16     queuenum;
  26        u16     queues_total;
  27        u16     flags;
  28};
  29
  30static void nft_queue_eval(const struct nft_expr *expr,
  31                           struct nft_regs *regs,
  32                           const struct nft_pktinfo *pkt)
  33{
  34        struct nft_queue *priv = nft_expr_priv(expr);
  35        u32 queue = priv->queuenum;
  36        u32 ret;
  37
  38        if (priv->queues_total > 1) {
  39                if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
  40                        int cpu = smp_processor_id();
  41
  42                        queue = priv->queuenum + cpu % priv->queues_total;
  43                } else {
  44                        queue = nfqueue_hash(pkt->skb, queue,
  45                                             priv->queues_total, pkt->pf,
  46                                             jhash_initval);
  47                }
  48        }
  49
  50        ret = NF_QUEUE_NR(queue);
  51        if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
  52                ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
  53
  54        regs->verdict.code = ret;
  55}
  56
  57static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
  58        [NFTA_QUEUE_NUM]        = { .type = NLA_U16 },
  59        [NFTA_QUEUE_TOTAL]      = { .type = NLA_U16 },
  60        [NFTA_QUEUE_FLAGS]      = { .type = NLA_U16 },
  61};
  62
  63static int nft_queue_init(const struct nft_ctx *ctx,
  64                           const struct nft_expr *expr,
  65                           const struct nlattr * const tb[])
  66{
  67        struct nft_queue *priv = nft_expr_priv(expr);
  68
  69        if (tb[NFTA_QUEUE_NUM] == NULL)
  70                return -EINVAL;
  71
  72        init_hashrandom(&jhash_initval);
  73        priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
  74
  75        if (tb[NFTA_QUEUE_TOTAL] != NULL)
  76                priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
  77        if (tb[NFTA_QUEUE_FLAGS] != NULL) {
  78                priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
  79                if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
  80                        return -EINVAL;
  81        }
  82        return 0;
  83}
  84
  85static int nft_queue_dump(struct sk_buff *skb, const struct nft_expr *expr)
  86{
  87        const struct nft_queue *priv = nft_expr_priv(expr);
  88
  89        if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) ||
  90            nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) ||
  91            nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
  92                goto nla_put_failure;
  93
  94        return 0;
  95
  96nla_put_failure:
  97        return -1;
  98}
  99
 100static struct nft_expr_type nft_queue_type;
 101static const struct nft_expr_ops nft_queue_ops = {
 102        .type           = &nft_queue_type,
 103        .size           = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
 104        .eval           = nft_queue_eval,
 105        .init           = nft_queue_init,
 106        .dump           = nft_queue_dump,
 107};
 108
 109static struct nft_expr_type nft_queue_type __read_mostly = {
 110        .name           = "queue",
 111        .ops            = &nft_queue_ops,
 112        .policy         = nft_queue_policy,
 113        .maxattr        = NFTA_QUEUE_MAX,
 114        .owner          = THIS_MODULE,
 115};
 116
 117static int __init nft_queue_module_init(void)
 118{
 119        return nft_register_expr(&nft_queue_type);
 120}
 121
 122static void __exit nft_queue_module_exit(void)
 123{
 124        nft_unregister_expr(&nft_queue_type);
 125}
 126
 127module_init(nft_queue_module_init);
 128module_exit(nft_queue_module_exit);
 129
 130MODULE_LICENSE("GPL");
 131MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
 132MODULE_ALIAS_NFT_EXPR("queue");
 133