Skip to content

Commit 7af4cc3

Browse files
laf0rgeDavid S. Miller
laf0rge
authored and
David S. Miller
committed
[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink
- Add new nfnetlink_queue module - Add new ipt_NFQUEUE and ip6t_NFQUEUE modules to access queue numbers 1-65535 - Mark ip_queue and ip6_queue Kconfig options as OBSOLETE - Update feature-removal-schedule to remove ip[6]_queue in December Signed-off-by: Harald Welte <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 0ab43f8 commit 7af4cc3

File tree

12 files changed

+1153
-5
lines changed

12 files changed

+1153
-5
lines changed

‎Documentation/feature-removal-schedule.txt

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,3 +135,15 @@ Why: With the 16-bit PCMCIA subsystem now behaving (almost) like a
135135
pcmciautils package available at
136136
http://kernel.org/pub/linux/utils/kernel/pcmcia/
137137
Who: Dominik Brodowski <[email protected]>
138+
139+
---------------------------
140+
141+
What: ip_queue and ip6_queue (old ipv4-only and ipv6-only netfilter queue)
142+
When: December 2005
143+
Why: This interface has been obsoleted by the new layer3-independent
144+
"nfnetlink_queue". The Kernel interface is compatible, so the old
145+
ip[6]tables "QUEUE" targets still work and will transparently handle
146+
all packets into nfnetlink queue number 0. Userspace users will have
147+
to link against API-compatible library on top of libnfnetlink_queue
148+
instead of the current 'libipq'.
149+
Who: Harald Welte <[email protected]>

‎include/linux/netfilter/nfnetlink_queue.h

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
#ifndef _NFNETLINK_QUEUE_H
2+
#define _NFNETLINK_QUEUE_H
3+
4+
#include <linux/netfilter/nfnetlink.h>
5+
6+
enum nfqnl_msg_types {
7+
NFQNL_MSG_PACKET, /* packet from kernel to userspace */
8+
NFQNL_MSG_VERDICT, /* verdict from userspace to kernel */
9+
NFQNL_MSG_CONFIG, /* connect to a particular queue */
10+
11+
NFQNL_MSG_MAX
12+
};
13+
14+
struct nfqnl_msg_packet_hdr {
15+
u_int32_t packet_id; /* unique ID of packet in queue */
16+
u_int16_t hw_protocol; /* hw protocol (network order) */
17+
u_int8_t hook; /* netfilter hook */
18+
} __attribute__ ((packed));
19+
20+
struct nfqnl_msg_packet_hw {
21+
u_int16_t hw_addrlen;
22+
u_int16_t _pad;
23+
u_int8_t hw_addr[8];
24+
} __attribute__ ((packed));
25+
26+
struct nfqnl_msg_packet_timestamp {
27+
u_int64_t sec;
28+
u_int64_t usec;
29+
} __attribute__ ((packed));
30+
31+
enum nfqnl_attr_type {
32+
NFQA_UNSPEC,
33+
NFQA_PACKET_HDR,
34+
NFQA_VERDICT_HDR, /* nfqnl_msg_verdict_hrd */
35+
NFQA_MARK, /* u_int32_t nfmark */
36+
NFQA_TIMESTAMP, /* nfqnl_msg_packet_timestamp */
37+
NFQA_IFINDEX_INDEV, /* u_int32_t ifindex */
38+
NFQA_IFINDEX_OUTDEV, /* u_int32_t ifindex */
39+
NFQA_HWADDR, /* nfqnl_msg_packet_hw */
40+
NFQA_PAYLOAD, /* opaque data payload */
41+
42+
__NFQA_MAX
43+
};
44+
#define NFQA_MAX (__NFQA_MAX - 1)
45+
46+
struct nfqnl_msg_verdict_hdr {
47+
u_int32_t verdict;
48+
u_int32_t id;
49+
} __attribute__ ((packed));
50+
51+
52+
enum nfqnl_msg_config_cmds {
53+
NFQNL_CFG_CMD_NONE,
54+
NFQNL_CFG_CMD_BIND,
55+
NFQNL_CFG_CMD_UNBIND,
56+
NFQNL_CFG_CMD_PF_BIND,
57+
NFQNL_CFG_CMD_PF_UNBIND,
58+
};
59+
60+
struct nfqnl_msg_config_cmd {
61+
u_int8_t command; /* nfqnl_msg_config_cmds */
62+
u_int8_t _pad;
63+
u_int16_t pf; /* AF_xxx for PF_[UN]BIND */
64+
} __attribute__ ((packed));
65+
66+
enum nfqnl_config_mode {
67+
NFQNL_COPY_NONE,
68+
NFQNL_COPY_META,
69+
NFQNL_COPY_PACKET,
70+
};
71+
72+
struct nfqnl_msg_config_params {
73+
u_int32_t copy_range;
74+
u_int8_t copy_mode; /* enum nfqnl_config_mode */
75+
} __attribute__ ((packed));
76+
77+
78+
enum nfqnl_attr_config {
79+
NFQA_CFG_UNSPEC,
80+
NFQA_CFG_CMD, /* nfqnl_msg_config_cmd */
81+
NFQA_CFG_PARAMS, /* nfqnl_msg_config_params */
82+
__NFQA_CFG_MAX
83+
};
84+
85+
#endif /* _NFNETLINK_QUEUE_H */

‎include/linux/netfilter_ipv4/ipt_NFQUEUE.h

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
/* iptables module for using NFQUEUE mechanism
2+
*
3+
* (C) 2005 Harald Welte <[email protected]>
4+
*
5+
* This software is distributed under GNU GPL v2, 1991
6+
*
7+
*/
8+
#ifndef _IPT_NFQ_TARGET_H
9+
#define _IPT_NFQ_TARGET_H
10+
11+
/* target info */
12+
struct ipt_NFQ_info {
13+
u_int16_t queuenum;
14+
};
15+
16+
#endif /* _IPT_DSCP_TARGET_H */

‎net/ipv4/netfilter/Kconfig

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,11 +110,15 @@ config IP_NF_AMANDA
110110
To compile it as a module, choose M here. If unsure, say Y.
111111

112112
config IP_NF_QUEUE
113-
tristate "Userspace queueing via NETLINK"
113+
tristate "IP Userspace queueing via NETLINK (OBSOLETE)"
114114
help
115115
Netfilter has the ability to queue packets to user space: the
116116
netlink device can be used to access them using this driver.
117117

118+
This option enables the old IPv4-only "ip_queue" implementation
119+
which has been obsoleted by the new "nfnetlink_queue" code (see
120+
CONFIG_NETFILTER_NETLINK_QUEUE).
121+
118122
To compile it as a module, choose M here. If unsure, say N.
119123

120124
config IP_NF_IPTABLES

‎net/ipv4/netfilter/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,3 +91,4 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o
9191
obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o
9292

9393
obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o
94+
obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ipt_NFQUEUE.o

‎net/ipv4/netfilter/ipt_NFQUEUE.c

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/* iptables module for using new netfilter netlink queue
2+
*
3+
* (C) 2005 by Harald Welte <[email protected]>
4+
*
5+
* This program is free software; you can redistribute it and/or modify
6+
* it under the terms of the GNU General Public License version 2 as
7+
* published by the Free Software Foundation.
8+
*
9+
*/
10+
11+
#include <linux/module.h>
12+
#include <linux/skbuff.h>
13+
14+
#include <linux/netfilter.h>
15+
#include <linux/netfilter_ipv4/ip_tables.h>
16+
#include <linux/netfilter_ipv4/ipt_NFQUEUE.h>
17+
18+
MODULE_AUTHOR("Harald Welte <[email protected]>");
19+
MODULE_DESCRIPTION("iptables NFQUEUE target");
20+
MODULE_LICENSE("GPL");
21+
22+
static unsigned int
23+
target(struct sk_buff **pskb,
24+
const struct net_device *in,
25+
const struct net_device *out,
26+
unsigned int hooknum,
27+
const void *targinfo,
28+
void *userinfo)
29+
{
30+
const struct ipt_NFQ_info *tinfo = targinfo;
31+
32+
return NF_QUEUE_NR(tinfo->queuenum);
33+
}
34+
35+
static int
36+
checkentry(const char *tablename,
37+
const struct ipt_entry *e,
38+
void *targinfo,
39+
unsigned int targinfosize,
40+
unsigned int hook_mask)
41+
{
42+
if (targinfosize != IPT_ALIGN(sizeof(struct ipt_NFQ_info))) {
43+
printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
44+
targinfosize,
45+
IPT_ALIGN(sizeof(struct ipt_NFQ_info)));
46+
return 0;
47+
}
48+
49+
return 1;
50+
}
51+
52+
static struct ipt_target ipt_NFQ_reg = {
53+
.name = "NFQUEUE",
54+
.target = target,
55+
.checkentry = checkentry,
56+
.me = THIS_MODULE,
57+
};
58+
59+
static int __init init(void)
60+
{
61+
return ipt_register_target(&ipt_NFQ_reg);
62+
}
63+
64+
static void __exit fini(void)
65+
{
66+
ipt_unregister_target(&ipt_NFQ_reg);
67+
}
68+
69+
module_init(init);
70+
module_exit(fini);

‎net/ipv6/netfilter/Kconfig

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,16 @@ menu "IPv6: Netfilter Configuration (EXPERIMENTAL)"
1010
# dep_tristate ' FTP protocol support' CONFIG_IP6_NF_FTP $CONFIG_IP6_NF_CONNTRACK
1111
#fi
1212
config IP6_NF_QUEUE
13-
tristate "Userspace queueing via NETLINK"
13+
tristate "IP6 Userspace queueing via NETLINK (OBSOLETE)"
1414
---help---
1515

1616
This option adds a queue handler to the kernel for IPv6
17-
packets which lets us to receive the filtered packets
18-
with QUEUE target using libiptc as we can do with
19-
the IPv4 now.
17+
packets which enables users to receive the filtered packets
18+
with QUEUE target using libipq.
19+
20+
THis option enables the old IPv6-only "ip6_queue" implementation
21+
which has been obsoleted by the new "nfnetlink_queue" code (see
22+
CONFIG_NETFILTER_NETLINK_QUEUE).
2023

2124
(C) Fernando Anton 2001
2225
IPv64 Project - Work based in IPv64 draft by Arturo Azcorra.

‎net/ipv6/netfilter/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,4 @@ obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
2424
obj-$(CONFIG_IP6_NF_TARGET_LOG) += ip6t_LOG.o
2525
obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
2626
obj-$(CONFIG_IP6_NF_MATCH_HL) += ip6t_hl.o
27+
obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ip6t_NFQUEUE.o

‎net/ipv6/netfilter/ip6t_NFQUEUE.c

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
/* ip6tables module for using new netfilter netlink queue
2+
*
3+
* (C) 2005 by Harald Welte <[email protected]>
4+
*
5+
* This program is free software; you can redistribute it and/or modify
6+
* it under the terms of the GNU General Public License version 2 as
7+
* published by the Free Software Foundation.
8+
*
9+
*/
10+
11+
#include <linux/module.h>
12+
#include <linux/skbuff.h>
13+
14+
#include <linux/netfilter.h>
15+
#include <linux/netfilter_ipv6/ip6_tables.h>
16+
#include <linux/netfilter_ipv4/ipt_NFQUEUE.h>
17+
18+
MODULE_AUTHOR("Harald Welte <[email protected]>");
19+
MODULE_DESCRIPTION("ip6tables NFQUEUE target");
20+
MODULE_LICENSE("GPL");
21+
22+
static unsigned int
23+
target(struct sk_buff **pskb,
24+
const struct net_device *in,
25+
const struct net_device *out,
26+
unsigned int hooknum,
27+
const void *targinfo,
28+
void *userinfo)
29+
{
30+
const struct ipt_NFQ_info *tinfo = targinfo;
31+
32+
return NF_QUEUE_NR(tinfo->queuenum);
33+
}
34+
35+
static int
36+
checkentry(const char *tablename,
37+
const struct ip6t_entry *e,
38+
void *targinfo,
39+
unsigned int targinfosize,
40+
unsigned int hook_mask)
41+
{
42+
if (targinfosize != IP6T_ALIGN(sizeof(struct ipt_NFQ_info))) {
43+
printk(KERN_WARNING "NFQUEUE: targinfosize %u != %Zu\n",
44+
targinfosize,
45+
IP6T_ALIGN(sizeof(struct ipt_NFQ_info)));
46+
return 0;
47+
}
48+
49+
return 1;
50+
}
51+
52+
static struct ip6t_target ipt_NFQ_reg = {
53+
.name = "NFQUEUE",
54+
.target = target,
55+
.checkentry = checkentry,
56+
.me = THIS_MODULE,
57+
};
58+
59+
static int __init init(void)
60+
{
61+
return ip6t_register_target(&ipt_NFQ_reg);
62+
}
63+
64+
static void __exit fini(void)
65+
{
66+
ip6t_unregister_target(&ipt_NFQ_reg);
67+
}
68+
69+
module_init(init);
70+
module_exit(fini);

‎net/netfilter/Kconfig

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,11 @@ config NETFILTER_NETLINK
33
help
44
If this option is enabled, the kernel will include support
55
for the new netfilter netlink interface.
6+
7+
config NETFILTER_NETLINK_QUEUE
8+
tristate "Netfilter NFQUEUE over NFNETLINK interface"
9+
depends on NETFILTER_NETLINK
10+
help
11+
If this option isenabled, the kernel will include support
12+
for queueing packets via NFNETLINK.
13+

0 commit comments

Comments
 (0)