Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7af4cc3f authored by Harald Welte's avatar Harald Welte Committed by David S. Miller
Browse files

[NETFILTER]: Add "nfnetlink_queue" netfilter queue handler over nfnetlink 



- Add new nfnetlink_queue module
- Add new ipt_NFQUEUE and ip6t_NFQUEUE modules to access queue numbers 1-65535
- Mark ip_queue and ip6_queue Kconfig options as OBSOLETE
- Update feature-removal-schedule to remove ip[6]_queue in December

Signed-off-by: default avatarHarald Welte <laforge@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0ab43f84

Documentation/feature-removal-schedule.txt

+12 −0
Original line number Diff line number Diff line
@@ -135,3 +135,15 @@ Why: With the 16-bit PCMCIA subsystem now behaving (almost) like a 
	pcmciautils package available at

	http://kernel.org/pub/linux/utils/kernel/pcmcia/

Who:	Dominik Brodowski <linux@brodo.de>



---------------------------



What:	ip_queue and ip6_queue (old ipv4-only and ipv6-only netfilter queue)

When:	December 2005

Why:	This interface has been obsoleted by the new layer3-independent

	"nfnetlink_queue".  The Kernel interface is compatible, so the old

	ip[6]tables "QUEUE" targets still work and will transparently handle

	all packets into nfnetlink queue number 0.  Userspace users will have

	to link against API-compatible library on top of libnfnetlink_queue 

	instead of the current 'libipq'.

Who:	Harald Welte <laforge@netfilter.org>

include/linux/netfilter/nfnetlink_queue.h

0 → 100644
+85 −0
Original line number Diff line number Diff line 
#ifndef _NFNETLINK_QUEUE_H

#define _NFNETLINK_QUEUE_H



#include <linux/netfilter/nfnetlink.h>



enum nfqnl_msg_types {

	NFQNL_MSG_PACKET,		/* packet from kernel to userspace */

	NFQNL_MSG_VERDICT,		/* verdict from userspace to kernel */

	NFQNL_MSG_CONFIG,		/* connect to a particular queue */



	NFQNL_MSG_MAX

};



struct nfqnl_msg_packet_hdr {

	u_int32_t	packet_id;	/* unique ID of packet in queue */

	u_int16_t	hw_protocol;	/* hw protocol (network order) */

	u_int8_t	hook;		/* netfilter hook */

} __attribute__ ((packed));



struct nfqnl_msg_packet_hw {

	u_int16_t	hw_addrlen;

	u_int16_t	_pad;

	u_int8_t	hw_addr[8];

} __attribute__ ((packed));



struct nfqnl_msg_packet_timestamp {

	u_int64_t	sec;

	u_int64_t	usec;

} __attribute__ ((packed));



enum nfqnl_attr_type {

	NFQA_UNSPEC,

	NFQA_PACKET_HDR,

	NFQA_VERDICT_HDR,		/* nfqnl_msg_verdict_hrd */

	NFQA_MARK,			/* u_int32_t nfmark */

	NFQA_TIMESTAMP,			/* nfqnl_msg_packet_timestamp */

	NFQA_IFINDEX_INDEV,		/* u_int32_t ifindex */

	NFQA_IFINDEX_OUTDEV,		/* u_int32_t ifindex */

	NFQA_HWADDR,			/* nfqnl_msg_packet_hw */

	NFQA_PAYLOAD,			/* opaque data payload */



	__NFQA_MAX

};

#define NFQA_MAX (__NFQA_MAX - 1)



struct nfqnl_msg_verdict_hdr {

	u_int32_t verdict;

	u_int32_t id;

} __attribute__ ((packed));





enum nfqnl_msg_config_cmds {

	NFQNL_CFG_CMD_NONE,

	NFQNL_CFG_CMD_BIND,

	NFQNL_CFG_CMD_UNBIND,

	NFQNL_CFG_CMD_PF_BIND,

	NFQNL_CFG_CMD_PF_UNBIND,

};



struct nfqnl_msg_config_cmd {

	u_int8_t	command;	/* nfqnl_msg_config_cmds */

	u_int8_t	_pad;

	u_int16_t	pf;		/* AF_xxx for PF_[UN]BIND */

} __attribute__ ((packed));



enum nfqnl_config_mode {

	NFQNL_COPY_NONE,

	NFQNL_COPY_META,

	NFQNL_COPY_PACKET,

};



struct nfqnl_msg_config_params {

	u_int32_t	copy_range;

	u_int8_t	copy_mode;	/* enum nfqnl_config_mode */

} __attribute__ ((packed));





enum nfqnl_attr_config {

	NFQA_CFG_UNSPEC,

	NFQA_CFG_CMD,			/* nfqnl_msg_config_cmd */

	NFQA_CFG_PARAMS,		/* nfqnl_msg_config_params */

	__NFQA_CFG_MAX

};



#endif /* _NFNETLINK_QUEUE_H */

include/linux/netfilter_ipv4/ipt_NFQUEUE.h

0 → 100644
+16 −0
Original line number Diff line number Diff line 
/* iptables module for using NFQUEUE mechanism

 *

 * (C) 2005 Harald Welte <laforge@netfilter.org>

 *

 * This software is distributed under GNU GPL v2, 1991

 * 

*/

#ifndef _IPT_NFQ_TARGET_H

#define _IPT_NFQ_TARGET_H



/* target info */

struct ipt_NFQ_info {

	u_int16_t queuenum;

};



#endif /* _IPT_DSCP_TARGET_H */

net/ipv4/netfilter/Kconfig

+5 −1
Original line number Diff line number Diff line
@@ -110,11 +110,15 @@ config IP_NF_AMANDA 
	  To compile it as a module, choose M here.  If unsure, say Y.



config IP_NF_QUEUE

	tristate "Userspace queueing via NETLINK"

	tristate "IP Userspace queueing via NETLINK (OBSOLETE)"

	help

	  Netfilter has the ability to queue packets to user space: the

	  netlink device can be used to access them using this driver.



	  This option enables the old IPv4-only "ip_queue" implementation

	  which has been obsoleted by the new "nfnetlink_queue" code (see

	  CONFIG_NETFILTER_NETLINK_QUEUE).



	  To compile it as a module, choose M here.  If unsure, say N.



config IP_NF_IPTABLES

net/ipv4/netfilter/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -91,3 +91,4 @@ obj-$(CONFIG_IP_NF_ARP_MANGLE) += arpt_mangle.o 
obj-$(CONFIG_IP_NF_ARPFILTER) += arptable_filter.o



obj-$(CONFIG_IP_NF_QUEUE) += ip_queue.o

obj-$(CONFIG_NETFILTER_NETLINK_QUEUE) += ipt_NFQUEUE.o