[netfilter-cvslog] r4133 - in trunk/patch-o-matic-ng/patchlets: .
nfnetlink_queue nfnetlink_queue/linux-2.6
nfnetlink_queue/linux-2.6/include
nfnetlink_queue/linux-2.6/include/linux
nfnetlink_queue/linux-2.6/include/linux/netfilter
nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv4
nfnetlink_queue/linux-2.6/net nfnetlink_queue/linux-2.6/net/ipv4
nfnetlink_queue/linux-2.6/net/ipv4/netfilter
nfnetlink_queue/linux-2.6/net/ipv6
nfnetlink_queue/linux-2.6/net/ipv6/netfilter
nfnetlink_queue/linux-2.6/net/netfilter
laforge at netfilter.org
laforge at netfilter.org
Tue Jul 19 23:29:03 CEST 2005
Author: laforge at netfilter.org
Date: 2005-07-19 23:28:54 +0200 (Tue, 19 Jul 2005)
New Revision: 4133
Added:
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/info
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6.patch
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter/nfnetlink_queue.h
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv4/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv4/ipt_NFQUEUE.h
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv6/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/Makefile.ladd
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/ipt_NFQUEUE.c
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/Makefile.ladd
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/ip6t_NFQUEUE.c
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Kconfig.ladd
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Makefile.ladd
trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/nfnetlink_queue.c
Log:
nf_queue: A generalized layer3 independent queue handler, transporting
packets/verdicts via nfnetlink. Configuration via nfnetlink. Includes
demultiplexing support for up to 65535 different queue listeners in userspace.
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/info
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/info 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/info 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,6 @@
+Title: nfnetlink_queue
+Author: Harald Welte <laforge at netfilter.org>
+Status: Testing
+Repository: extra
+Requires: linux >= 2.6.0
+Depends: nfnetlink
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter/nfnetlink_queue.h
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter/nfnetlink_queue.h 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter/nfnetlink_queue.h 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,84 @@
+#ifndef _NFNETLINK_QUEUE_H
+#define _NFNETLINK_QUEUE_H
+
+#include <linux/netfilter/nfnetlink.h>
+
+enum nfqnl_msg_types {
+ NFQNL_MSG_PACKET, /* packet from kernel to userspace */
+ NFQNL_MSG_VERDICT, /* verdict from userspace to kernel */
+ NFQNL_MSG_CONFIG, /* connect to a particular queue */
+
+ NFQNL_MSG_MAX
+};
+
+struct nfqnl_msg_packet_hdr {
+ u_int32_t packet_id; /* unique ID of packet in queue */
+ u_int16_t hw_protocol; /* hw protocol (network order) */
+ u_int8_t hook; /* netfilter hook */
+} __attribute__ ((packed));
+
+struct nfqnl_msg_packet_hw {
+ u_int16_t hw_addrlen;
+ u_int16_t _pad;
+ u_int8_t hw_addr[8];
+} __attribute__ ((packed));
+
+struct nfqnl_msg_packet_timestamp {
+ u_int64_t sec;
+ u_int64_t usec;
+} __attribute__ ((packed));
+
+enum nfqnl_attr_type {
+ NFQA_UNSPEC,
+ NFQA_PACKET_HDR,
+ NFQA_VERDICT_HDR, /* nfqnl_msg_verdict_hrd */
+ NFQA_MARK, /* u_int32_t nfmark */
+ NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
+ NFQA_IFINDEX_INDEV, /* u_int32_t ifindex */
+ NFQA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
+ NFQA_HWADDR, /* nfqnl_msg_packet_hw */
+ NFQA_PAYLOAD, /* opaque data payload */
+
+ __NFQA_MAX
+};
+#define NFQA_MAX (__NFQA_MAX - 1)
+
+struct nfqnl_msg_verdict_hdr {
+ u_int32_t verdict;
+ u_int32_t id;
+} __attribute__ ((packed));
+
+
+enum nfqnl_msg_config_cmds {
+ NFQNL_CFG_CMD_NONE,
+ NFQNL_CFG_CMD_BIND,
+ NFQNL_CFG_CMD_UNBIND,
+ NFQNL_CFG_CMD_PF_BIND,
+ NFQNL_CFG_CMD_PF_UNBIND,
+};
+
+struct nfqnl_msg_config_cmd {
+ u_int8_t command; /* nfqnl_msg_config_cmds */
+ u_int8_t _pad;
+ u_int16_t pf; /* AF_xxx for PF_[UN]BIND */
+} __attribute__ ((packed));
+
+enum nfqnl_config_mode {
+ NFQNL_COPY_NONE,
+ NFQNL_COPY_META,
+ NFQNL_COPY_PACKET,
+};
+
+struct nfqnl_msg_config_params {
+ u_int32_t copy_range;
+ u_int8_t copy_mode; /* enum nfqnl_config_mode */
+} __attribute__ ((packed));
+
+
+enum nfqnl_attr_config {
+ NFQA_CFG_CMD, /* nfqnl_msg_config_cmd */
+ NFQA_CFG_PARAMS, /* nfqnl_msg_config_params */
+ __NFQA_CFG_MAX
+};
+
+#endif /* _NFNETLINK_QUEUE_H */
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv4/ipt_NFQUEUE.h
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv4/ipt_NFQUEUE.h 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/include/linux/netfilter_ipv4/ipt_NFQUEUE.h 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,16 @@
+/* iptables module for using NFQUEUE mechanism
+ *
+ * (C) 2005 Harald Welte <laforge at netfilter.org>
+ *
+ * This software is distributed under GNU GPL v2, 1991
+ *
+*/
+#ifndef _IPT_NFQ_TARGET_H
+#define _IPT_NFQ_TARGET_H
+
+/* target info */
+struct ipt_NFQ_info {
+ u_int16_t queuenum;
+};
+
+#endif /* _IPT_DSCP_TARGET_H */
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/Makefile.ladd
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/Makefile.ladd 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/Makefile.ladd 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
+obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ipt_NFQUEUE.o
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/ipt_NFQUEUE.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/ipt_NFQUEUE.c 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv4/netfilter/ipt_NFQUEUE.c 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,70 @@
+/* iptables module for using new netfilter netlink queue
+ *
+ * (C) 2005 by Harald Welte <laforge at netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv4/ipt_NFQUEUE.h>
+
+MODULE_AUTHOR("Harald Welte <laforge at netfilter.org>");
+MODULE_DESCRIPTION("iptables NFQUEUE target");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+target(struct sk_buff **pskb,
+ const struct net_device *in,
+ const struct net_device *out,
+ unsigned int hooknum,
+ const void *targinfo,
+ void *userinfo)
+{
+ const struct ipt_NFQ_info *tinfo = targinfo;
+
+ return NF_QUEUE_NR(tinfo->queuenum);
+}
+
+static int
+checkentry(const char *tablename,
+ const struct ipt_entry *e,
+ void *targinfo,
+ unsigned int targinfosize,
+ unsigned int hook_mask)
+{
+ if (targinfosize != IPT_ALIGN(sizeof(struct ipt_NFQ_info))) {
+ printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
+ targinfosize,
+ IPT_ALIGN(sizeof(struct ipt_NFQ_info)));
+ return 0;
+ }
+
+ return 1;
+}
+
+static struct ipt_target ipt_NFQ_reg = {
+ .name = "NFQUEUE",
+ .target = target,
+ .checkentry = checkentry,
+ .me = THIS_MODULE,
+};
+
+static int __init init(void)
+{
+ return ipt_register_target(&ipt_NFQ_reg);
+}
+
+static void __exit fini(void)
+{
+ ipt_unregister_target(&ipt_NFQ_reg);
+}
+
+module_init(init);
+module_exit(fini);
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/Makefile.ladd
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/Makefile.ladd 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/Makefile.ladd 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,2 @@
+obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
+obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ip6t_NFQUEUE.o
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/ip6t_NFQUEUE.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/ip6t_NFQUEUE.c 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/ipv6/netfilter/ip6t_NFQUEUE.c 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,70 @@
+/* ip6tables module for using new netfilter netlink queue
+ *
+ * (C) 2005 by Harald Welte <laforge at netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/skbuff.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/netfilter_ipv4/ipt_NFQUEUE.h>
+
+MODULE_AUTHOR("Harald Welte <laforge at netfilter.org>");
+MODULE_DESCRIPTION("ip6tables NFQUEUE target");
+MODULE_LICENSE("GPL");
+
+static unsigned int
+target(struct sk_buff **pskb,
+ const struct net_device *in,
+ const struct net_device *out,
+ unsigned int hooknum,
+ const void *targinfo,
+ void *userinfo)
+{
+ const struct ipt_NFQ_info *tinfo = targinfo;
+
+ return NF_QUEUE_NR(tinfo->queuenum);
+}
+
+static int
+checkentry(const char *tablename,
+ const struct ip6t_entry *e,
+ void *targinfo,
+ unsigned int targinfosize,
+ unsigned int hook_mask)
+{
+ if (targinfosize != IP6T_ALIGN(sizeof(struct ipt_NFQ_info))) {
+ printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
+ targinfosize,
+ IP6T_ALIGN(sizeof(struct ipt_NFQ_info)));
+ return 0;
+ }
+
+ return 1;
+}
+
+static struct ip6t_target ipt_NFQ_reg = {
+ .name = "NFQUEUE",
+ .target = target,
+ .checkentry = checkentry,
+ .me = THIS_MODULE,
+};
+
+static int __init init(void)
+{
+ return ip6t_register_target(&ipt_NFQ_reg);
+}
+
+static void __exit fini(void)
+{
+ ip6t_unregister_target(&ipt_NFQ_reg);
+}
+
+module_init(init);
+module_exit(fini);
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Kconfig.ladd
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Kconfig.ladd 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Kconfig.ladd 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,7 @@
+config NETFILTER_NETLINK_QUEUE
+ tristate "Netfilter NFQUEUE over NFNETLINK interface"
+ depends on NETFILTER_NETLINK
+ help
+ If this option isenabled, the kernel will include support
+ for queueing packets via NFNETLINK.
+
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Makefile.ladd
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Makefile.ladd 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/Makefile.ladd 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,2 @@
+obj-$(CONFIG_NETFILTER_NETLINK) += nfnetlink.o
+obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += nfnetlink_queue.o
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/nfnetlink_queue.c
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/nfnetlink_queue.c 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6/net/netfilter/nfnetlink_queue.c 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,933 @@
+/*
+ * This is a module which is used for queueing packets and communicating with
+ * userspace via nfetlink.
+ *
+ * (C) 2005 by Harald Welte <laforge at netfilter.org>
+ *
+ * Based on the old ipv4-only ip_queue.c:
+ * (C) 2000-2002 James Morris <jmorris at intercode.com.au>
+ * (C) 2003-2005 Netfilter Core Team <coreteam at netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+#include <linux/module.h>
+#include <linux/skbuff.h>
+#include <linux/init.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+#include <linux/notifier.h>
+#include <linux/netdevice.h>
+#include <linux/netfilter.h>
+#include <linux/netfilter_ipv4.h>
+#include <linux/netfilter_ipv6.h>
+#include <linux/netlink.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_queue.h>
+#include <linux/spinlock.h>
+#include <linux/sysctl.h>
+#include <linux/proc_fs.h>
+#include <linux/security.h>
+#include <linux/list.h>
+#include <net/sock.h>
+#include <net/route.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+
+#include <asm/atomic.h>
+
+#define NFQNL_QMAX_DEFAULT 1024
+
+struct ipq_rt_info {
+ __u8 tos;
+ __u32 daddr;
+ __u32 saddr;
+};
+
+struct ip6q_rt_info {
+ struct in6_addr daddr;
+ struct in6_addr saddr;
+};
+
+struct nfqnl_queue_entry {
+ struct list_head list;
+ struct nf_info *info;
+ struct sk_buff *skb;
+ unsigned int id;
+
+ union {
+ struct {
+ struct ipq_rt_info rt_info;
+ } ipv4;
+ struct {
+ struct ip6q_rt_info rt_info;
+ } ipv6;
+ } u;
+};
+
+struct nfqnl_instance {
+ struct hlist_node hlist; /* global list of queues */
+
+ unsigned int queue_maxlen;
+ unsigned int peer_pid;
+ unsigned int copy_range;
+ unsigned int queue_total;
+ unsigned int queue_dropped;
+ unsigned int queue_user_dropped;
+
+ atomic_t id_sequence; /* 'sequence' of pkt ids */
+
+ u_int16_t queue_num; /* number of this queue */
+ u_int8_t copy_mode;
+
+ spinlock_t lock;
+
+ struct list_head queue_list; /* packets in queue */
+};
+
+typedef int (*nfqnl_cmpfn)(struct nfqnl_queue_entry *, unsigned long);
+
+static DEFINE_RWLOCK(instances_lock);
+//static DECLARE_MUTEX(ipqnl_sem);
+
+u_int64_t htonll(u_int64_t in)
+{
+ u_int64_t out;
+ int i;
+
+ for (i = 0; i < sizeof(u_int64_t); i++)
+ ((u_int8_t *)&out)[sizeof(u_int64_t)-1] = ((u_int8_t *)&in)[i];
+
+ return out;
+}
+
+#define INSTANCE_BUCKETS 16
+static struct hlist_head instance_table[INSTANCE_BUCKETS];
+
+static inline u_int8_t instance_hashfn(u_int16_t queue_num)
+{
+ return ((queue_num >> 8) | queue_num) % INSTANCE_BUCKETS;
+}
+
+static struct nfqnl_instance *
+__instance_lookup(u_int16_t queue_num)
+{
+ struct hlist_head *head;
+ struct hlist_node *pos;
+ struct nfqnl_instance *inst;
+
+ head = &instance_table[instance_hashfn(queue_num)];
+ hlist_for_each_entry(inst, pos, head, hlist) {
+ if (inst->queue_num == queue_num)
+ return inst;
+ }
+ return NULL;
+}
+
+static struct nfqnl_instance *
+instance_lookup(u_int16_t queue_num)
+{
+ struct nfqnl_instance *inst;
+
+ read_lock_bh(&instances_lock);
+ inst = __instance_lookup(queue_num);
+ read_unlock_bh(&instances_lock);
+
+ return inst;
+}
+
+static struct nfqnl_instance *
+instance_create(u_int16_t queue_num, u_int32_t pid)
+{
+ struct nfqnl_instance *inst;
+
+ write_lock_bh(&instances_lock);
+ if (__instance_lookup(queue_num)) {
+ inst = NULL;
+ goto out_unlock;
+ }
+
+ inst = kmalloc(sizeof(*inst), GFP_ATOMIC);
+ if (!inst)
+ goto out_unlock;
+
+ memset(inst, 0, sizeof(*inst));
+ inst->queue_num = queue_num;
+ inst->peer_pid = pid;
+ inst->queue_maxlen = NFQNL_QMAX_DEFAULT;
+ inst->copy_range = 0xfffff;
+ inst->copy_mode = NFQNL_COPY_NONE;
+ atomic_set(&inst->id_sequence, 0);
+ inst->lock = SPIN_LOCK_UNLOCKED;
+
+ if (!try_module_get(THIS_MODULE))
+ goto out_free;
+
+ hlist_add_head(&inst->hlist,
+ &instance_table[instance_hashfn(queue_num)]);
+
+ write_unlock_bh(&instances_lock);
+ return inst;
+
+out_free:
+ kfree(inst);
+out_unlock:
+ write_unlock_bh(&instances_lock);
+ return NULL;
+}
+
+static void nfqnl_flush(struct nfqnl_instance *queue, int verdict);
+
+static void
+_instance_destroy2(struct nfqnl_instance *inst, int lock)
+{
+ /* first pull it out of the global list */
+ if (lock)
+ write_lock_bh(&instances_lock);
+
+ hlist_del(&inst->hlist);
+
+ if (lock);
+ write_unlock_bh(&instances_lock);
+
+ /* then flush all pending skbs from the queue */
+ nfqnl_flush(inst, NF_DROP);
+
+ /* and finally free the data structure */
+ kfree(inst);
+
+ module_put(THIS_MODULE);
+}
+
+static inline void
+__instance_destroy(struct nfqnl_instance *inst)
+{
+ _instance_destroy2(inst, 0);
+}
+
+static inline void
+instance_destroy(struct nfqnl_instance *inst)
+{
+ _instance_destroy2(inst, 1);
+}
+
+
+
+static void
+issue_verdict(struct nfqnl_queue_entry *entry, int verdict)
+{
+ /* TCP input path (and probably other bits) assume to be called
+ * from softirq context, not from syscall, like issue_verdict is
+ * called. TCP input path deadlocks with locks taken from timer
+ * softirq, e.g. We therefore emulate this by local_bh_disable() */
+
+ local_bh_disable();
+ nf_reinject(entry->skb, entry->info, verdict);
+ local_bh_enable();
+
+ kfree(entry);
+}
+
+static inline void
+__enqueue_entry(struct nfqnl_instance *queue,
+ struct nfqnl_queue_entry *entry)
+{
+ list_add(&entry->list, &queue->queue_list);
+ queue->queue_total++;
+}
+
+/*
+ * Find and return a queued entry matched by cmpfn, or return the last
+ * entry if cmpfn is NULL.
+ */
+static inline struct nfqnl_queue_entry *
+__find_entry(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn,
+ unsigned long data)
+{
+ struct list_head *p;
+
+ list_for_each_prev(p, &queue->queue_list) {
+ struct nfqnl_queue_entry *entry = (struct nfqnl_queue_entry *)p;
+
+ if (!cmpfn || cmpfn(entry, data))
+ return entry;
+ }
+ return NULL;
+}
+
+static inline void
+__dequeue_entry(struct nfqnl_instance *q, struct nfqnl_queue_entry *entry)
+{
+ list_del(&entry->list);
+ q->queue_total--;
+}
+
+static inline struct nfqnl_queue_entry *
+__find_dequeue_entry(struct nfqnl_instance *queue,
+ nfqnl_cmpfn cmpfn, unsigned long data)
+{
+ struct nfqnl_queue_entry *entry;
+
+ entry = __find_entry(queue, cmpfn, data);
+ if (entry == NULL)
+ return NULL;
+
+ __dequeue_entry(queue, entry);
+ return entry;
+}
+
+
+static inline void
+__nfqnl_flush(struct nfqnl_instance *queue, int verdict)
+{
+ struct nfqnl_queue_entry *entry;
+
+ while ((entry = __find_dequeue_entry(queue, NULL, 0)))
+ issue_verdict(entry, verdict);
+}
+
+static inline int
+__nfqnl_set_mode(struct nfqnl_instance *queue,
+ unsigned char mode, unsigned int range)
+{
+ int status = 0;
+
+ switch (mode) {
+ case NFQNL_COPY_NONE:
+ case NFQNL_COPY_META:
+ queue->copy_mode = mode;
+ queue->copy_range = 0;
+ break;
+
+ case NFQNL_COPY_PACKET:
+ queue->copy_mode = mode;
+ /* we're using struct nfattr which has 16bit nfa_len */
+ if (range > 0xffff)
+ queue->copy_range = 0xffff;
+ else
+ queue->copy_range = range;
+ break;
+
+ default:
+ status = -EINVAL;
+
+ }
+ return status;
+}
+
+static struct nfqnl_queue_entry *
+find_dequeue_entry(struct nfqnl_instance *queue,
+ nfqnl_cmpfn cmpfn, unsigned long data)
+{
+ struct nfqnl_queue_entry *entry;
+
+ spin_lock_bh(&queue->lock);
+ entry = __find_dequeue_entry(queue, cmpfn, data);
+ spin_unlock_bh(&queue->lock);
+
+ return entry;
+}
+
+static void
+nfqnl_flush(struct nfqnl_instance *queue, int verdict)
+{
+ spin_lock_bh(&queue->lock);
+ __nfqnl_flush(queue, verdict);
+ spin_unlock_bh(&queue->lock);
+}
+
+static struct sk_buff *
+nfqnl_build_packet_message(struct nfqnl_instance *queue,
+ struct nfqnl_queue_entry *entry, int *errp)
+{
+ unsigned char *old_tail;
+ size_t size;
+ size_t data_len = 0;
+ struct sk_buff *skb;
+ struct nfqnl_msg_packet_hdr pmsg;
+ struct nlmsghdr *nlh;
+ struct nfgenmsg *nfmsg;
+ unsigned int tmp_uint;
+
+ /* all macros expand to constant values at compile time */
+ size = NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hdr))
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* ifindex */
+ + NLMSG_SPACE(sizeof(u_int32_t)) /* mark */
+ + NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_hw))
+ + NLMSG_SPACE(sizeof(struct nfqnl_msg_packet_timestamp));
+
+ spin_lock_bh(&queue->lock);
+
+ switch (queue->copy_mode) {
+ case NFQNL_COPY_META:
+ case NFQNL_COPY_NONE:
+ data_len = 0;
+ break;
+
+ case NFQNL_COPY_PACKET:
+ if (queue->copy_range == 0
+ || queue->copy_range > entry->skb->len)
+ data_len = entry->skb->len;
+ else
+ data_len = queue->copy_range;
+
+ size += NLMSG_SPACE(data_len);
+ break;
+
+ default:
+ *errp = -EINVAL;
+ spin_unlock_bh(&queue->lock);
+ return NULL;
+ }
+
+ spin_unlock_bh(&queue->lock);
+
+ skb = alloc_skb(size, GFP_ATOMIC);
+ if (!skb)
+ goto nlmsg_failure;
+
+ old_tail= skb->tail;
+ nlh = NLMSG_PUT(skb, 0, 0,
+ NFNL_SUBSYS_QUEUE << 8 | NFQNL_MSG_PACKET,
+ sizeof(struct nfgenmsg));
+ nfmsg = NLMSG_DATA(nlh);
+ nfmsg->nfgen_family = entry->info->pf;
+ nfmsg->version = NFNETLINK_V1;
+ nfmsg->res_id = htons(queue->queue_num);
+
+ pmsg.packet_id = htonl(entry->id);
+ pmsg.hw_protocol = htons(entry->skb->protocol);
+ pmsg.hook = entry->info->hook;
+
+ NFA_PUT(skb, NFQA_PACKET_HDR, sizeof(pmsg), &pmsg);
+
+ if (entry->info->indev) {
+ tmp_uint = htonl(entry->info->indev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
+ }
+
+ if (entry->info->outdev) {
+ tmp_uint = htonl(entry->info->outdev->ifindex);
+ NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
+ }
+
+ if (entry->skb->nfmark) {
+ tmp_uint = htonl(entry->skb->nfmark);
+ NFA_PUT(skb, NFQA_MARK, sizeof(u_int32_t), &tmp_uint);
+ }
+
+ if (entry->info->indev && entry->skb->dev
+ && entry->skb->dev->hard_header_parse) {
+ struct nfqnl_msg_packet_hw phw;
+
+ phw.hw_addrlen =
+ entry->skb->dev->hard_header_parse(entry->skb,
+ &phw.hw_addr);
+ phw.hw_addrlen = htons(phw.hw_addrlen);
+ NFA_PUT(skb, NFQA_HWADDR, sizeof(phw), &phw);
+ }
+
+ if (entry->skb->stamp.tv_sec) {
+ struct nfqnl_msg_packet_timestamp ts;
+
+ ts.sec = htonll(entry->skb->stamp.tv_sec);
+ ts.usec = htonll(entry->skb->stamp.tv_usec);
+
+ NFA_PUT(skb, NFQA_TIMESTAMP, sizeof(ts), &ts);
+ }
+
+ if (data_len) {
+ struct nfattr *nfa;
+ int size = NFA_LENGTH(data_len);
+
+ if (skb_tailroom(skb) < (int)NFA_SPACE(data_len)) {
+ printk(KERN_WARNING "nf_queue: no tailroom!\n");
+ goto nlmsg_failure;
+ }
+
+ nfa = (struct nfattr *)skb_put(skb, NFA_ALIGN(size));
+ nfa->nfa_type = NFQA_PAYLOAD;
+ nfa->nfa_len = size;
+
+ if (skb_copy_bits(entry->skb, 0, NFA_DATA(nfa), data_len))
+ BUG();
+ }
+
+ nlh->nlmsg_len = skb->tail - old_tail;
+ return skb;
+
+nlmsg_failure:
+nfattr_failure:
+ if (skb)
+ kfree_skb(skb);
+ *errp = -EINVAL;
+ printk(KERN_ERR "ip_queue: error creating packet message\n");
+ return NULL;
+}
+
+static int
+nfqnl_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
+ unsigned int queuenum, void *data)
+{
+ int status = -EINVAL;
+ struct sk_buff *nskb;
+ struct nfqnl_instance *queue;
+ struct nfqnl_queue_entry *entry;
+
+ queue = instance_lookup(queuenum);
+ if (!queue)
+ return -EINVAL;
+
+ if (queue->copy_mode == NFQNL_COPY_NONE)
+ return -EAGAIN;
+
+ entry = kmalloc(sizeof(*entry), GFP_ATOMIC);
+ if (entry == NULL) {
+ printk(KERN_ERR "nf_queue: OOM in nfqnl_enqueue_packet()\n");
+ return -ENOMEM;
+ }
+
+ entry->info = info;
+ entry->skb = skb;
+ entry->id = atomic_inc_return(&queue->id_sequence);
+
+ switch (entry->info->pf) {
+ case PF_INET:
+ if (entry->info->hook == NF_IP_LOCAL_OUT) {
+ struct iphdr *iph = skb->nh.iph;
+
+ entry->u.ipv4.rt_info.tos = iph->tos;
+ entry->u.ipv4.rt_info.daddr = iph->daddr;
+ entry->u.ipv4.rt_info.saddr = iph->saddr;
+ }
+ break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+ case PF_INET6:
+ if (entry->info->hook == NF_IP6_LOCAL_OUT) {
+ struct ipv6hdr *iph = skb->nh.ipv6h;
+
+ entry->u.ipv6.rt_info.daddr = iph->daddr;
+ entry->u.ipv6.rt_info.saddr = iph->saddr;
+ }
+ break;
+#endif
+ }
+
+ nskb = nfqnl_build_packet_message(queue, entry, &status);
+ if (nskb == NULL)
+ goto err_out_free;
+
+ spin_lock_bh(&queue->lock);
+
+ if (!queue->peer_pid)
+ goto err_out_free_nskb;
+
+ if (queue->queue_total >= queue->queue_maxlen) {
+ queue->queue_dropped++;
+ status = -ENOSPC;
+ if (net_ratelimit())
+ printk(KERN_WARNING "ip_queue: full at %d entries, "
+ "dropping packets(s). Dropped: %d\n",
+ queue->queue_total, queue->queue_dropped);
+ goto err_out_free_nskb;
+ }
+
+ /* nfnetlink_unicast will either free the nskb or add it to a socket */
+ status = nfnetlink_unicast(nskb, queue->peer_pid, MSG_DONTWAIT);
+ if (status < 0) {
+ queue->queue_user_dropped++;
+ goto err_out_unlock;
+ }
+
+ __enqueue_entry(queue, entry);
+
+ spin_unlock_bh(&queue->lock);
+ return status;
+
+err_out_free_nskb:
+ kfree_skb(nskb);
+
+err_out_unlock:
+ spin_unlock_bh(&queue->lock);
+
+err_out_free:
+ kfree(entry);
+ return status;
+}
+
+static int
+nfqnl_mangle(void *data, int data_len, struct nfqnl_queue_entry *e)
+{
+ int diff;
+ int min_len;
+ union {
+ struct iphdr user_iph;
+ struct ipv6hdr usr_ip6h;
+ } *u;
+
+ u = data;
+
+ switch (e->info->pf) {
+ case PF_INET:
+ min_len = sizeof(struct iphdr);
+ break;
+ case PF_INET6:
+ min_len = sizeof(struct ipv6hdr);
+ break;
+ default:
+ min_len = 0;
+ break;
+ }
+
+ if (data_len < min_len)
+ return 0;
+
+ diff = data_len - e->skb->len;
+ if (diff < 0)
+ skb_trim(e->skb, data_len);
+ else if (diff > 0) {
+ if (data_len > 0xFFFF)
+ return -EINVAL;
+ if (diff > skb_tailroom(e->skb)) {
+ struct sk_buff *newskb;
+
+ newskb = skb_copy_expand(e->skb,
+ skb_headroom(e->skb),
+ diff,
+ GFP_ATOMIC);
+ if (newskb == NULL) {
+ printk(KERN_WARNING "ip_queue: OOM "
+ "in mangle, dropping packet\n");
+ return -ENOMEM;
+ }
+ if (e->skb->sk)
+ skb_set_owner_w(newskb, e->skb->sk);
+ kfree_skb(e->skb);
+ e->skb = newskb;
+ }
+ skb_put(e->skb, diff);
+ }
+ if (!skb_ip_make_writable(&e->skb, data_len))
+ return -ENOMEM;
+ memcpy(e->skb->data, data, data_len);
+
+ /*
+ * Extra routing may needed on local out, as the QUEUE target never
+ * returns control to the table.
+ */
+ switch (e->info->pf) {
+ case PF_INET:
+ if (e->info->hook == NF_IP_LOCAL_OUT) {
+ struct iphdr *iph = e->skb->nh.iph;
+
+ if (!(iph->tos == e->u.ipv4.rt_info.tos
+ && iph->daddr == e->u.ipv4.rt_info.daddr
+ && iph->saddr == e->u.ipv4.rt_info.saddr))
+ return ip_route_me_harder(&e->skb);
+ }
+ break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+ case PF_INET6:
+ if (e->info->hook == NF_IP6_LOCAL_OUT) {
+ struct ipv6hdr *iph = e->skb->nh.ipv6h;
+ if (!ipv6_addr_equal(&iph->daddr,
+ &e->u.ipv6.rt_info.daddr) ||
+ !ipv6_addr_equal(&iph->saddr,
+ &e->u.ipv6.rt_info.saddr))
+ return ip6_route_me_harder(e->skb);
+ }
+ break;
+#endif
+ }
+ return 0;
+}
+
+static inline int
+id_cmp(struct nfqnl_queue_entry *e, unsigned long id)
+{
+ return (id == e->id);
+}
+
+static int
+nfqnl_set_mode(struct nfqnl_instance *queue,
+ unsigned char mode, unsigned int range)
+{
+ int status;
+
+ spin_lock_bh(&queue->lock);
+ status = __nfqnl_set_mode(queue, mode, range);
+ spin_unlock_bh(&queue->lock);
+
+ return status;
+}
+
+static int
+dev_cmp(struct nfqnl_queue_entry *entry, unsigned long ifindex)
+{
+ if (entry->info->indev)
+ if (entry->info->indev->ifindex == ifindex)
+ return 1;
+
+ if (entry->info->outdev)
+ if (entry->info->outdev->ifindex == ifindex)
+ return 1;
+
+ return 0;
+}
+
+/* drop all packets with either indev or outdev == ifindex from all queue
+ * instances */
+static void
+nfqnl_dev_drop(int ifindex)
+{
+ int i;
+
+ /* this only looks like we have to hold the readlock for a way too long
+ * time, issue_verdict(), nf_reinject(), ... - but we always only
+ * issue NF_DROP, which is processed directly in nf_reinject() */
+ read_lock_bh(&instances_lock);
+
+ for (i = 0; i < INSTANCE_BUCKETS; i++) {
+ struct hlist_node *tmp;
+ struct nfqnl_instance *inst;
+ struct hlist_head *head = &instance_table[i];
+
+ hlist_for_each_entry(inst, tmp, head, hlist) {
+ struct nfqnl_queue_entry *entry;
+ while ((entry = find_dequeue_entry(inst, dev_cmp,
+ ifindex)) != NULL)
+ issue_verdict(entry, NF_DROP);
+ }
+ }
+
+ read_unlock_bh(&instances_lock);
+}
+
+#define RCV_SKB_FAIL(err) do { netlink_ack(skb, nlh, (err)); return; } while (0)
+
+static int
+nfqnl_rcv_dev_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+{
+ struct net_device *dev = ptr;
+
+ /* Drop any packets associated with the downed device */
+ if (event == NETDEV_DOWN)
+ nfqnl_dev_drop(dev->ifindex);
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block nfqnl_dev_notifier = {
+ .notifier_call = nfqnl_rcv_dev_event,
+};
+
+static int
+nfqnl_rcv_nl_event(struct notifier_block *this,
+ unsigned long event, void *ptr)
+{
+ struct netlink_notify *n = ptr;
+
+ if (event == NETLINK_URELEASE &&
+ n->protocol == NETLINK_NETFILTER && n->pid) {
+ int i;
+
+ /* destroy all instances for this pid */
+ write_lock_bh(&instances_lock);
+ for (i = 0; i < INSTANCE_BUCKETS; i++) {
+ struct hlist_node *tmp, *t2;
+ struct nfqnl_instance *inst;
+ struct hlist_head *head = &instance_table[i];
+
+ hlist_for_each_entry_safe(inst, tmp, t2, head, hlist) {
+ if (n->pid == inst->peer_pid)
+ __instance_destroy(inst);
+ }
+ }
+ write_unlock_bh(&instances_lock);
+ }
+ return NOTIFY_DONE;
+}
+
+static struct notifier_block nfqnl_rtnl_notifier = {
+ .notifier_call = nfqnl_rcv_nl_event,
+};
+
+static int
+nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb,
+ struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
+{
+ struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
+ u_int16_t queue_num = ntohs(nfmsg->res_id);
+
+ struct nfqnl_msg_verdict_hdr *vhdr;
+ struct nfqnl_instance *queue;
+ unsigned int verdict;
+ struct nfqnl_queue_entry *entry;
+
+ queue = instance_lookup(queue_num);
+ if (!queue)
+ return -ENODEV;
+
+ if (queue->peer_pid != NETLINK_CB(skb).pid)
+ return -EPERM;
+
+ if (!nfqa[NFQA_VERDICT_HDR])
+ return -EINVAL;
+
+ vhdr = NFA_DATA(nfqa[NFQA_VERDICT_HDR-1]);
+ verdict = ntohl(vhdr->verdict);
+
+ if ((verdict & NF_VERDICT_MASK) > NF_MAX_VERDICT)
+ return -EINVAL;
+
+ entry = find_dequeue_entry(queue, id_cmp, ntohl(vhdr->id));
+ if (entry == NULL)
+ return -ENOENT;
+
+ if (nfqa[NFQA_PAYLOAD]) {
+ if (nfqnl_mangle(NFA_DATA(nfqa[NFQA_PAYLOAD]),
+ NFA_PAYLOAD(nfqa[NFQA_PAYLOAD]), entry) < 0)
+ verdict = NF_DROP;
+ }
+
+ if (nfqa[NFQA_MARK])
+ skb->nfmark = ntohl(*(u_int32_t *)NFA_DATA(nfqa[NFQA_MARK]));
+
+ issue_verdict(entry, verdict);
+ return 0;
+}
+
+static int
+nfqnl_recv_unsupp(struct sock *ctnl, struct sk_buff *skb,
+ struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
+{
+ return -ENOTSUPP;
+}
+
+static int
+nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
+ struct nlmsghdr *nlh, struct nfattr *nfqa[], int *errp)
+{
+ struct nfgenmsg *nfmsg = NLMSG_DATA(nlh);
+ u_int16_t queue_num = ntohs(nfmsg->res_id);
+ struct nfqnl_instance *queue;
+
+ queue = instance_lookup(queue_num);
+ if (nfqa[NFQA_CFG_CMD]) {
+ struct nfqnl_msg_config_cmd *cmd;
+ cmd = NFA_DATA(nfqa[NFQA_CFG_CMD]);
+
+ switch (cmd->command) {
+ case NFQNL_CFG_CMD_BIND:
+ if (queue)
+ return -EBUSY;
+
+ queue = instance_create(queue_num, NETLINK_CB(skb).pid);
+ if (!queue)
+ return -EINVAL;
+ break;
+ case NFQNL_CFG_CMD_UNBIND:
+ if (!queue)
+ return -ENODEV;
+
+ if (queue->peer_pid != NETLINK_CB(skb).pid)
+ return -EPERM;
+
+ instance_destroy(queue);
+ break;
+ case NFQNL_CFG_CMD_PF_BIND:
+ return nf_register_queue_handler(ntohs(cmd->pf),
+ nfqnl_enqueue_packet,
+ NULL);
+
+ break;
+ case NFQNL_CFG_CMD_PF_UNBIND:
+ /* This is a bug and a feature. We can unregister
+ * other handlers(!) */
+ return nf_unregister_queue_handler(ntohs(cmd->pf));
+ break;
+ default:
+ return -EINVAL;
+ }
+ } else {
+ if (!queue)
+ return -ENOENT;
+
+ if (queue->peer_pid != NETLINK_CB(skb).pid)
+ return -EPERM;
+ }
+
+ if (nfqa[NFQA_CFG_PARAMS]) {
+ struct nfqnl_msg_config_params *params;
+ params = NFA_DATA(nfqa[NFQA_CFG_PARAMS]);
+
+ nfqnl_set_mode(queue, params->copy_mode,
+ ntohl(params->copy_range));
+ }
+
+ return 0;
+}
+
+static struct nfnl_callback nfqnl_cb[NFQNL_MSG_MAX] = {
+ [NFQNL_MSG_PACKET] = { .call = nfqnl_recv_unsupp,
+ .cap_required = CAP_NET_ADMIN },
+ [NFQNL_MSG_VERDICT] = { .call = nfqnl_recv_verdict,
+ .cap_required = CAP_NET_ADMIN },
+ [NFQNL_MSG_CONFIG] = { .call = nfqnl_recv_config,
+ .cap_required = CAP_NET_ADMIN },
+};
+
+static struct nfnetlink_subsystem nfqnl_subsys = {
+ .name = "nf_queue",
+ .subsys_id = NFNL_SUBSYS_QUEUE,
+ .cb_count = NFQNL_MSG_MAX,
+ .attr_count = NFQA_MAX,
+ .cb = nfqnl_cb,
+};
+
+static int
+init_or_cleanup(int init)
+{
+ int status = -ENOMEM;
+
+ if (!init)
+ goto cleanup;
+
+ netlink_register_notifier(&nfqnl_rtnl_notifier);
+ status = nfnetlink_subsys_register(&nfqnl_subsys);
+ if (status < 0) {
+ printk(KERN_ERR "nf_queue: failed to create netlink socket\n");
+ goto cleanup_netlink_notifier;
+ }
+
+ register_netdevice_notifier(&nfqnl_dev_notifier);
+ return status;
+
+cleanup:
+ nf_unregister_queue_handlers(nfqnl_enqueue_packet);
+
+cleanup_netlink_notifier:
+ netlink_unregister_notifier(&nfqnl_rtnl_notifier);
+ return status;
+}
+
+static int __init init(void)
+{
+
+ return init_or_cleanup(1);
+}
+
+static void __exit fini(void)
+{
+ init_or_cleanup(0);
+}
+
+MODULE_DESCRIPTION("netfilter packet queue handler");
+MODULE_AUTHOR("Harald Welte <laforge at netfilter.org>");
+MODULE_LICENSE("GPL");
+
+module_init(init);
+module_exit(fini);
Added: trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6.patch
===================================================================
--- trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6.patch 2005-07-19 21:16:45 UTC (rev 4132)
+++ trunk/patch-o-matic-ng/patchlets/nfnetlink_queue/linux-2.6.patch 2005-07-19 21:28:54 UTC (rev 4133)
@@ -0,0 +1,171 @@
+diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
+--- a/include/linux/netfilter.h
++++ b/include/linux/netfilter.h
+@@ -21,6 +21,16 @@
+ #define NF_STOP 5
+ #define NF_MAX_VERDICT NF_STOP
+
++/* we overload the higher bits for encoding auxiliary data such as the queue
++ * number. Not nice, but better than additional function arguments. */
++#define NF_VERDICT_MASK 0x000000ff
++#define NF_VERDICT_BITS 8
++
++#define NF_VERDICT_QMASK 0xffff0000
++#define NF_VERDICT_QBITS 16
++
++#define NF_QUEUE_NR(x) ((x << NF_VERDICT_QBITS) & NF_VERDICT_QMASK || NF_QUEUE)
++
+ /* only for userspace compatibility */
+ #ifndef __KERNEL__
+ /* Generic cache responses from hook functions.
+@@ -179,10 +189,12 @@ int nf_getsockopt(struct sock *sk, int p
+
+ /* Packet queuing */
+ typedef int (*nf_queue_outfn_t)(struct sk_buff *skb,
+- struct nf_info *info, void *data);
++ struct nf_info *info,
++ unsigned int queuenum, void *data);
+ extern int nf_register_queue_handler(int pf,
+ nf_queue_outfn_t outfn, void *data);
+ extern int nf_unregister_queue_handler(int pf);
++extern void nf_unregister_queue_handlers(nf_queue_outfn_t outfn);
+ extern void nf_reinject(struct sk_buff *skb,
+ struct nf_info *info,
+ unsigned int verdict);
+diff --git a/net/core/netfilter.c b/net/core/netfilter.c
+--- a/net/core/netfilter.c
++++ b/net/core/netfilter.c
+@@ -223,7 +223,8 @@ static unsigned int nf_iterate(struct li
+ verdict = elem->hook(hook, skb, indev, outdev, okfn);
+ if (verdict != NF_ACCEPT) {
+ #ifdef CONFIG_NETFILTER_DEBUG
+- if (unlikely(verdict > NF_MAX_VERDICT)) {
++ if (unlikely((verdict & NF_VERDICT_MASK)
++ > NF_MAX_VERDICT)) {
+ NFDEBUG("Evil return from %p(%u).\n",
+ elem->hook, hook);
+ continue;
+@@ -241,6 +242,9 @@ int nf_register_queue_handler(int pf, nf
+ {
+ int ret;
+
++ if (pf >= NPROTO)
++ return -EINVAL;
++
+ write_lock_bh(&queue_handler_lock);
+ if (queue_handler[pf].outfn)
+ ret = -EBUSY;
+@@ -257,6 +261,9 @@ int nf_register_queue_handler(int pf, nf
+ /* The caller must flush their queue before this */
+ int nf_unregister_queue_handler(int pf)
+ {
++ if (pf >= NPROTO)
++ return -EINVAL;
++
+ write_lock_bh(&queue_handler_lock);
+ queue_handler[pf].outfn = NULL;
+ queue_handler[pf].data = NULL;
+@@ -265,6 +272,20 @@ int nf_unregister_queue_handler(int pf)
+ return 0;
+ }
+
++void nf_unregister_queue_handlers(nf_queue_outfn_t outfn)
++{
++ int i;
++
++ write_lock_bh(&queue_handler_Lock);
++ for (i = 0; i < NPROTO; i++) {
++ if (queue_handler[pf].outfn == outfn) {
++ queue_handler[pf].outfn = NULL;
++ queue_handler[pf].data = NULL;
++ }
++ }
++ write_unlock_bh(&queue_handler_lock);
++}
++
+ /*
+ * Any packet that leaves via this function must come back
+ * through nf_reinject().
+@@ -274,7 +295,8 @@ static int nf_queue(struct sk_buff *skb,
+ int pf, unsigned int hook,
+ struct net_device *indev,
+ struct net_device *outdev,
+- int (*okfn)(struct sk_buff *))
++ int (*okfn)(struct sk_buff *),
++ unsigned int queuenum)
+ {
+ int status;
+ struct nf_info *info;
+@@ -324,7 +346,8 @@ static int nf_queue(struct sk_buff *skb,
+ }
+ #endif
+
+- status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data);
++ status = queue_handler[pf].outfn(skb, info, queue_handler[pf].data,
++ queuenum);
+ read_unlock(&queue_handler_lock);
+
+ if (status < 0) {
+@@ -368,9 +391,10 @@ next_hook:
+ } else if (verdict == NF_DROP) {
+ kfree_skb(*pskb);
+ ret = -EPERM;
+- } else if (verdict == NF_QUEUE) {
++ } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
+ NFDEBUG("nf_hook: Verdict = QUEUE.\n");
+- if (!nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn))
++ if (!nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn,
++ verdict >> NF_VERDICT_BITS))
+ goto next_hook;
+ }
+ unlock:
+@@ -427,14 +451,15 @@ void nf_reinject(struct sk_buff *skb, st
+ info->okfn, INT_MIN);
+ }
+
+- switch (verdict) {
++ switch (verdict & NF_VERDICT_MASK) {
+ case NF_ACCEPT:
+ info->okfn(skb);
+ break;
+
+ case NF_QUEUE:
+ if (!nf_queue(skb, elem, info->pf, info->hook,
+- info->indev, info->outdev, info->okfn))
++ info->indev, info->outdev, info->okfn,
++ verdict >> NF_VERDICT_BITS))
+ goto next_hook;
+ break;
+ }
+@@ -645,4 +670,5 @@ EXPORT_SYMBOL(nf_reinject);
+ EXPORT_SYMBOL(nf_setsockopt);
+ EXPORT_SYMBOL(nf_unregister_hook);
+ EXPORT_SYMBOL(nf_unregister_queue_handler);
++EXPORT_SYMBOL(nf_unregister_queue_handlers);
+ EXPORT_SYMBOL(nf_unregister_sockopt);
+diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
+--- a/net/ipv4/netfilter/ip_queue.c
++++ b/net/ipv4/netfilter/ip_queue.c
+@@ -281,7 +281,8 @@ nlmsg_failure:
+ }
+
+ static int
+-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
++ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
++ unsigned int queuenum, void *data)
+ {
+ int status = -EINVAL;
+ struct sk_buff *nskb;
+diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
+--- a/net/ipv6/netfilter/ip6_queue.c
++++ b/net/ipv6/netfilter/ip6_queue.c
+@@ -276,7 +276,8 @@ nlmsg_failure:
+ }
+
+ static int
+-ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info, void *data)
++ipq_enqueue_packet(struct sk_buff *skb, struct nf_info *info,
++ unsigned int queuenum, void *data)
+ {
+ int status = -EINVAL;
+ struct sk_buff *nskb;
More information about the netfilter-cvslog
mailing list