net/netfilter/nft_queue.c

   1 /*
   2  * Copyright (c) 2013 Eric Leblond <eric@regit.org>
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * Development of this code partly funded by OISF
   9  * (http://www.openinfosecfoundation.org/)
  10  */
  11
  12 #include <linux/kernel.h>
  13 #include <linux/init.h>
  14 #include <linux/module.h>
  15 #include <linux/netlink.h>
  16 #include <linux/jhash.h>
  17 #include <linux/netfilter.h>
  18 #include <linux/netfilter/nf_tables.h>
  19 #include <net/netfilter/nf_tables.h>
  20 #include <net/netfilter/nf_queue.h>
  21
  22 static u32 jhash_initval __read_mostly;
  23
  24 struct nft_queue {
  25         u16     queuenum;
  26         u16     queues_total;
  27         u16     flags;
  28 };
  29
  30 static void nft_queue_eval(const struct nft_expr *expr,
  31                            struct nft_regs *regs,
  32                            const struct nft_pktinfo *pkt)
  33 {
  34         struct nft_queue *priv = nft_expr_priv(expr);
  35         u32 queue = priv->queuenum;
  36         u32 ret;
  37
  38         if (priv->queues_total > 1) {
  39                 if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
  40                         int cpu = smp_processor_id();
  41
  42                         queue = priv->queuenum + cpu % priv->queues_total;
  43                 } else {
  44                         queue = nfqueue_hash(pkt->skb, queue,
  45                                              priv->queues_total, pkt->pf,
  46                                              jhash_initval);
  47                 }
  48         }
  49
  50         ret = NF_QUEUE_NR(queue);
  51         if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
  52                 ret |= NF_VERDICT_FLAG_QUEUE_BYPASS;
  53
  54         regs->verdict.code = ret;
  55 }
  56
  57 static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
  58         [NFTA_QUEUE_NUM]        = { .type = NLA_U16 },
  59         [NFTA_QUEUE_TOTAL]      = { .type = NLA_U16 },
  60         [NFTA_QUEUE_FLAGS]      = { .type = NLA_U16 },
  61 };
  62
  63 static int nft_queue_init(const struct nft_ctx *ctx,
  64                            const struct nft_expr *expr,
  65                            const struct nlattr * const tb[])
  66 {
  67         struct nft_queue *priv = nft_expr_priv(expr);
  68
  69         if (tb[NFTA_QUEUE_NUM] == NULL)
  70                 return -EINVAL;
  71
  72         init_hashrandom(&jhash_initval);
  73         priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));
  74
  75         if (tb[NFTA_QUEUE_TOTAL] != NULL)
  76                 priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
  77         if (tb[NFTA_QUEUE_FLAGS] != NULL) {
  78                 priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
  79                 if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
  80                         return -EINVAL;
  81         }
  82         return 0;
  83 }
  84
  85 static int nft_queue_dump(struct sk_buff *skb, const struct nft_expr *expr)
  86 {
  87         const struct nft_queue *priv = nft_expr_priv(expr);
  88
  89         if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) ||
  90             nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) ||
  91             nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
  92                 goto nla_put_failure;
  93
  94         return 0;
  95
  96 nla_put_failure:
  97         return -1;
  98 }
  99
 100 static struct nft_expr_type nft_queue_type;
 101 static const struct nft_expr_ops nft_queue_ops = {
 102         .type           = &nft_queue_type,
 103         .size           = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
 104         .eval           = nft_queue_eval,
 105         .init           = nft_queue_init,
 106         .dump           = nft_queue_dump,
 107 };
 108
 109 static struct nft_expr_type nft_queue_type __read_mostly = {
 110         .name           = "queue",
 111         .ops            = &nft_queue_ops,
 112         .policy         = nft_queue_policy,
 113         .maxattr        = NFTA_QUEUE_MAX,
 114         .owner          = THIS_MODULE,
 115 };
 116
 117 static int __init nft_queue_module_init(void)
 118 {
 119         return nft_register_expr(&nft_queue_type);
 120 }
 121
 122 static void __exit nft_queue_module_exit(void)
 123 {
 124         nft_unregister_expr(&nft_queue_type);
 125 }
 126
 127 module_init(nft_queue_module_init);
 128 module_exit(nft_queue_module_exit);
 129
 130 MODULE_LICENSE("GPL");
 131 MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
 132 MODULE_ALIAS_NFT_EXPR("queue");