netfilter: nft: add queue module (0aff078d) · Commits · 戴 / test

include/uapi/linux/netfilter/nf_tables.h

+20 −0

Original line number	Diff line number	Diff line
		@@ -657,6 +657,26 @@ enum nft_log_attributes {
		};
		#define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)

		/**
		* enum nft_queue_attributes - nf_tables queue expression netlink attributes
		*
		* @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
		* @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
		* @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
		*/
		enum nft_queue_attributes {
		NFTA_QUEUE_UNSPEC,
		NFTA_QUEUE_NUM,
		NFTA_QUEUE_TOTAL,
		NFTA_QUEUE_FLAGS,
		__NFTA_QUEUE_MAX
		};
		#define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1)

		#define NFT_QUEUE_FLAG_BYPASS 0x01 /* for compatibility with v2 */
		#define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */
		#define NFT_QUEUE_FLAG_MASK 0x03

		/**
		* enum nft_reject_types - nf_tables reject expression reject types
		*

net/netfilter/Kconfig

+9 −0

Original line number	Diff line number	Diff line
		@@ -456,6 +456,15 @@ config NFT_NAT
		depends on NF_NAT
		tristate "Netfilter nf_tables nat module"

		config NFT_QUEUE
		depends on NF_TABLES
		depends on NETFILTER_XTABLES
		depends on NETFILTER_NETLINK_QUEUE
		tristate "Netfilter nf_tables queue module"
		help
		This is required if you intend to use the userspace queueing
		infrastructure (also known as NFQUEUE) from nftables.

		config NFT_COMPAT
		depends on NF_TABLES
		depends on NETFILTER_XTABLES

net/netfilter/Makefile

+1 −0

Original line number	Diff line number	Diff line
		@@ -76,6 +76,7 @@ obj-$(CONFIG_NFT_META) += nft_meta.o
		obj-$(CONFIG_NFT_CT) += nft_ct.o
		obj-$(CONFIG_NFT_LIMIT) += nft_limit.o
		obj-$(CONFIG_NFT_NAT) += nft_nat.o
		obj-$(CONFIG_NFT_QUEUE) += nft_queue.o
		#nf_tables-objs += nft_meta_target.o
		obj-$(CONFIG_NFT_RBTREE) += nft_rbtree.o
		obj-$(CONFIG_NFT_HASH) += nft_hash.o

net/netfilter/nft_queue.c

0 → 100644

+134 −0

Original line number	Diff line number	Diff line
		/*
		* Copyright (c) 2013 Eric Leblond <eric@regit.org>
		*
		* This program is free software; you can redistribute it and/or modify
		* it under the terms of the GNU General Public License version 2 as
		* published by the Free Software Foundation.
		*
		* Development of this code partly funded by OISF
		* (http://www.openinfosecfoundation.org/)
		*/

		#include <linux/kernel.h>
		#include <linux/init.h>
		#include <linux/module.h>
		#include <linux/netlink.h>
		#include <linux/jhash.h>
		#include <linux/netfilter.h>
		#include <linux/netfilter/nf_tables.h>
		#include <net/netfilter/nf_tables.h>
		#include <net/netfilter/nf_queue.h>

		static u32 jhash_initval __read_mostly;

		struct nft_queue {
		u16 queuenum;
		u16 queues_total;
		u16 flags;
		u8 family;
		};

		static void nft_queue_eval(const struct nft_expr *expr,
		struct nft_data data[NFT_REG_MAX + 1],
		const struct nft_pktinfo *pkt)
		{
		struct nft_queue *priv = nft_expr_priv(expr);
		u32 queue = priv->queuenum;
		u32 ret;

		if (priv->queues_total > 1) {
		if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) {
		int cpu = smp_processor_id();

		queue = priv->queuenum + cpu % priv->queues_total;
		} else {
		queue = nfqueue_hash(pkt->skb, queue,
		priv->queues_total, priv->family,
		jhash_initval);
		}
		}

		ret = NF_QUEUE_NR(queue);
		if (priv->flags & NFT_QUEUE_FLAG_BYPASS)
		ret \|= NF_VERDICT_FLAG_QUEUE_BYPASS;

		data[NFT_REG_VERDICT].verdict = ret;
		}

		static const struct nla_policy nft_queue_policy[NFTA_QUEUE_MAX + 1] = {
		[NFTA_QUEUE_NUM] = { .type = NLA_U16 },
		[NFTA_QUEUE_TOTAL] = { .type = NLA_U16 },
		[NFTA_QUEUE_FLAGS] = { .type = NLA_U16 },
		};

		static int nft_queue_init(const struct nft_ctx *ctx,
		const struct nft_expr *expr,
		const struct nlattr * const tb[])
		{
		struct nft_queue *priv = nft_expr_priv(expr);

		if (tb[NFTA_QUEUE_NUM] == NULL)
		return -EINVAL;

		init_hashrandom(&jhash_initval);
		priv->family = ctx->afi->family;
		priv->queuenum = ntohs(nla_get_be16(tb[NFTA_QUEUE_NUM]));

		if (tb[NFTA_QUEUE_TOTAL] != NULL)
		priv->queues_total = ntohs(nla_get_be16(tb[NFTA_QUEUE_TOTAL]));
		if (tb[NFTA_QUEUE_FLAGS] != NULL) {
		priv->flags = ntohs(nla_get_be16(tb[NFTA_QUEUE_FLAGS]));
		if (priv->flags & ~NFT_QUEUE_FLAG_MASK)
		return -EINVAL;
		}
		return 0;
		}

		static int nft_queue_dump(struct sk_buff skb, const struct nft_expr expr)
		{
		const struct nft_queue *priv = nft_expr_priv(expr);

		if (nla_put_be16(skb, NFTA_QUEUE_NUM, htons(priv->queuenum)) \|\|
		nla_put_be16(skb, NFTA_QUEUE_TOTAL, htons(priv->queues_total)) \|\|
		nla_put_be16(skb, NFTA_QUEUE_FLAGS, htons(priv->flags)))
		goto nla_put_failure;

		return 0;

		nla_put_failure:
		return -1;
		}

		static struct nft_expr_type nft_queue_type;
		static const struct nft_expr_ops nft_queue_ops = {
		.type = &nft_queue_type,
		.size = NFT_EXPR_SIZE(sizeof(struct nft_queue)),
		.eval = nft_queue_eval,
		.init = nft_queue_init,
		.dump = nft_queue_dump,
		};

		static struct nft_expr_type nft_queue_type __read_mostly = {
		.name = "queue",
		.ops = &nft_queue_ops,
		.policy = nft_queue_policy,
		.maxattr = NFTA_QUEUE_MAX,
		.owner = THIS_MODULE,
		};

		static int __init nft_queue_module_init(void)
		{
		return nft_register_expr(&nft_queue_type);
		}

		static void __exit nft_queue_module_exit(void)
		{
		nft_unregister_expr(&nft_queue_type);
		}

		module_init(nft_queue_module_init);
		module_exit(nft_queue_module_exit);

		MODULE_LICENSE("GPL");
		MODULE_AUTHOR("Eric Leblond <eric@regit.org>");
		MODULE_ALIAS_NFT_EXPR("queue");

Admin message