94b27cc361
If an skb is to be NF_QUEUE'd, but no program has opened the queue, the packet is dropped. This adds a v2 target revision of xt_NFQUEUE that allows packets to continue through the ruleset instead. Because the actual queueing happens outside of the target context, the 'bypass' flag has to be communicated back to the netfilter core. Unfortunately the only choice to do this without adding a new function argument is to use the target function return value (i.e. the verdict). In the NF_QUEUE case, the upper 16bit already contain the queue number to use. The previous patch reduced NF_VERDICT_MASK to 0xff, i.e. we now have extra room for a new flag. If a hook issued a NF_QUEUE verdict, then the netfilter core will continue packet processing if the queueing hook returns -ESRCH (== "this queue does not exist") and the new NF_VERDICT_FLAG_QUEUE_BYPASS flag is set in the verdict value. Note: If the queue exists, but userspace does not consume packets fast enough, the skb will still be dropped. Signed-off-by: Florian Westphal <fwestphal@astaro.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
30 lines
478 B
C
30 lines
478 B
C
/* iptables module for using NFQUEUE mechanism
|
|
*
|
|
* (C) 2005 Harald Welte <laforge@netfilter.org>
|
|
*
|
|
* This software is distributed under GNU GPL v2, 1991
|
|
*
|
|
*/
|
|
#ifndef _XT_NFQ_TARGET_H
|
|
#define _XT_NFQ_TARGET_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
/* target info */
|
|
struct xt_NFQ_info {
|
|
__u16 queuenum;
|
|
};
|
|
|
|
struct xt_NFQ_info_v1 {
|
|
__u16 queuenum;
|
|
__u16 queues_total;
|
|
};
|
|
|
|
struct xt_NFQ_info_v2 {
|
|
__u16 queuenum;
|
|
__u16 queues_total;
|
|
__u16 bypass;
|
|
};
|
|
|
|
#endif /* _XT_NFQ_TARGET_H */
|