netfilter: xt_NFQUEUE: introduce CPU fanout

[linux.git] / net / netfilter / xt_NFQUEUE.c

diff --git a/net/netfilter/xt_NFQUEUE.c b/net/netfilter/xt_NFQUEUE.c
index 817f9e9f2b16c70930df5e51d62f5fd606e76f69..a287ef262d4149848157ce8136e7a03bb49085b5 100644 (file)
--- a/net/netfilter/xt_NFQUEUE.c
+++ b/net/netfilter/xt_NFQUEUE.c
@@ -108,7 +108,7 @@ nfqueue_tg_v2(struct sk_buff *skb, const struct xt_action_param *par)
 
 static int nfqueue_tg_check(const struct xt_tgchk_param *par)
 {
-       const struct xt_NFQ_info_v2 *info = par->targinfo;
+       const struct xt_NFQ_info_v3 *info = par->targinfo;
        u32 maxid;
 
        if (unlikely(!rnd_inited)) {
@@ -125,11 +125,39 @@ static int nfqueue_tg_check(const struct xt_tgchk_param *par)
                       info->queues_total, maxid);
                return -ERANGE;
        }
-       if (par->target->revision == 2 && info->bypass > 1)
+       if (par->target->revision == 2 && info->flags > 1)
+               return -EINVAL;
+       if (par->target->revision == 3 && info->flags & ~NFQ_FLAG_MASK)
                return -EINVAL;
+
        return 0;
 }
 
+static unsigned int
+nfqueue_tg_v3(struct sk_buff *skb, const struct xt_action_param *par)
+{
+       const struct xt_NFQ_info_v3 *info = par->targinfo;
+       u32 queue = info->queuenum;
+
+       if (info->queues_total > 1) {
+               if (info->flags & NFQ_FLAG_CPU_FANOUT) {
+                       int cpu = smp_processor_id();
+
+                       queue = info->queuenum + cpu % info->queues_total;
+               } else {
+                       if (par->family == NFPROTO_IPV4)
+                               queue = (((u64) hash_v4(skb) * info->queues_total) >>
+                                                32) + queue;
+#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
+                       else if (par->family == NFPROTO_IPV6)
+                               queue = (((u64) hash_v6(skb) * info->queues_total) >>
+                                                32) + queue;
+#endif
+               }
+       }
+       return NF_QUEUE_NR(queue);
+}
+
 static struct xt_target nfqueue_tg_reg[] __read_mostly = {
        {
                .name           = "NFQUEUE",
@@ -156,6 +184,15 @@ static struct xt_target nfqueue_tg_reg[] __read_mostly = {
                .targetsize     = sizeof(struct xt_NFQ_info_v2),
                .me             = THIS_MODULE,
        },
+       {
+               .name           = "NFQUEUE",
+               .revision       = 3,
+               .family         = NFPROTO_UNSPEC,
+               .checkentry     = nfqueue_tg_check,
+               .target         = nfqueue_tg_v3,
+               .targetsize     = sizeof(struct xt_NFQ_info_v3),
+               .me             = THIS_MODULE,
+       },
 };
 
 static int __init nfqueue_tg_init(void)