response_t set_queue_len(int len, ETERM *tuplep, q_data_t **q_data, thread_data_t *data) { int q_num, cq_idx; ETERM *arg; response_t r; if(erl_size(tuplep) > 2) { arg = erl_element(3, tuplep); q_num = ERL_INT_VALUE(arg); erl_free_term(arg); syslog(LOG_NOTICE,"[%d] q_num: %d, len: %d\n\r", data->idx, q_num, len); if((cq_idx = get_queue_idx(q_num, q_data)) >= 0) { if(nfq_set_queue_maxlen(q_data[cq_idx]->qh, len) >= 0) { r.cs = erl_mk_atom("ok"); r.rsp = erl_mk_atom("ok"); } else { r.cs = erl_mk_atom("error"); r.rsp = erl_mk_estring("failed to set queue max length", strlen("failed to set queue max length")); } } else { r.cs = erl_mk_atom("error"); r.rsp = erl_mk_estring("no such queue", strlen("no such queue")); } } else { r.cs = erl_mk_atom("error"); r.rsp = erl_mk_estring("argument missing", strlen("argument missing")); } return r; }
int createQueue(struct nfq_handle *h, int queue_num, int (*callback)(struct nfq_q_handle *, struct nfgenmsg *, struct nfq_data *, void *)) { // get code from nfqnl_test.c struct nfq_q_handle *qh; int fd = 0; int rv = 0; printf("binding this socket to queue %d\n", queue_num); qh = nfq_create_queue(h, queue_num, callback, NULL); if (!qh) { fprintf(stderr, "error during nfq_create_queue()\n"); exit(1); } printf("setting copy_packet mode Boo Yeah!!\n"); if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) { fprintf(stderr, "can't set packet_copy mode\n"); exit(1); } printf("Packet Mode Set\n"); fd = nfq_fd(h); if(nfq_set_queue_maxlen(qh, 100) < 0 ) { fprintf(stderr,"---\nCannot set queue max len \n---"); } return fd; }
int queue_set_queue_maxlen(struct queue *self, int maxlen) { int ret; ret = nfq_set_queue_maxlen(self->_qh, maxlen); if (ret < 0) { throw_exception("error during nfq_set_queue_maxlen()\n"); } return ret; }
int divert_open(int port, divert_cb cb) { unsigned int bufsize = 1024 * 1024 * 1; unsigned int rc; char *m; int fd, flags; _h = nfq_open(); if (!_h) err(1, "nfq_open()"); rc = nfnl_rcvbufsiz(nfq_nfnlh(_h), bufsize); if (rc != bufsize) xprintf(XP_DEBUG, "Buffer size %u wanted %u\n", rc, bufsize); /* reset in case of previous crash */ if (nfq_unbind_pf(_h, AF_INET) < 0) err(1, "nfq_unbind_pf()"); if (nfq_bind_pf(_h, AF_INET) < 0) err(1, "nfq_bind_pf()"); _q = nfq_create_queue(_h, port, packet_input, cb); if (!_q) err(1, "nfq_create_queue()"); if (nfq_set_mode(_q, NFQNL_COPY_PACKET, 0xffff) < 0) err(1, "nfq_set_mode()"); if (nfq_set_queue_maxlen(_q, 10000) < 0) err(1, "nfq_set_queue_maxlen()"); xprintf(XP_DEFAULT, "Divert packets using iptables -j NFQUEUE --queue-num %d\n", port); m = driver_param(0); if (m) { _mark = strtoul(m, NULL, 16); xprintf(XP_DEFAULT, "Also, add -m mark --mark 0x0/0x%x\n", _mark); } fd = nfq_fd(_h); flags = fcntl(fd, F_GETFL); if (flags == -1) err(1, "fcntl()"); if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) err(1, "fcntl()"); open_raw(); return fd; }
int tc_nfq_socket_init(struct nfq_handle **h, struct nfq_q_handle **qh, nfq_callback *cb, int max_queue_len) { int fd; tc_log_info(LOG_NOTICE, 0, "opening library handle"); *h = nfq_open(); if (!(*h)) { tc_log_info(LOG_ERR, errno, "error during nfq_open()"); return TC_INVALID_SOCKET; } tc_log_info(LOG_NOTICE, 0, "unbinding existing nf_queue handler for AF_INET (if any)"); if (nfq_unbind_pf((*h), AF_INET) < 0) { tc_log_info(LOG_ERR, errno, "error during nfq_unbind_pf()"); return TC_INVALID_SOCKET; } tc_log_info(LOG_NOTICE, 0, "binding nfnetlink_queue as nf_queue handler for AF_INET"); if (nfq_bind_pf((*h), AF_INET) < 0) { tc_log_info(LOG_ERR, errno, "error during nfq_bind_pf()"); return TC_INVALID_SOCKET; } tc_log_info(LOG_NOTICE, 0, "binding this socket to queue"); *qh = nfq_create_queue((*h), 0, cb, NULL); if (!(*qh)) { tc_log_info(LOG_ERR, errno, "error during nfq_create_queue()"); return TC_INVALID_SOCKET; } tc_log_info(LOG_NOTICE, 0, "setting copy_packet mode"); if (nfq_set_mode((*qh), NFQNL_COPY_PACKET, RESP_MAX_USEFUL_SIZE) < 0) { tc_log_info(LOG_ERR, errno, "can't set packet_copy mode"); return TC_INVALID_SOCKET; } if (max_queue_len > 0) { if (nfq_set_queue_maxlen((*qh), (uint32_t) max_queue_len) < 0) { tc_log_info(LOG_ERR, errno, "can't set queue max length:%d", max_queue_len); tc_log_info(LOG_WARN, 0, "unable to set queue maxlen"); tc_log_info(LOG_WARN, 0, "your kernel probably doesn't support it"); } } fd = nfq_fd(*h); nfnl_rcvbufsiz(nfq_nfnlh(*h), 16777216); return fd; }
void disruptor_nfq_bind() { /* Bind the program to a specific queue */ if(!d_nfq.qid){ d_nfq.qid=10; /* Default queue id */ } log_info("binding intercept socket to queue [%d]", d_nfq.qid); d_nfq.qh = nfq_create_queue(d_nfq.h, d_nfq.qid, &disruptor_nfq_call_back, (void *)stream); if (!d_nfq.qh) { log_error("error during nfq_create_queue()"); exit(1); } log_debug("setting copy_packet mode"); if (nfq_set_mode(d_nfq.qh, NFQNL_COPY_PACKET, 0xffff) < 0) { log_error("can't set packet_copy mode"); exit(1); } if(nfq_set_queue_maxlen(d_nfq.qh, (uint32_t)DISRUPTOR_MAX_Q_LEN) < 0){ log_error("error setting maximum queue size to [%d]", DISRUPTOR_MAX_Q_LEN); exit(1); } }
TmEcode NFQInitThread(NFQThreadVars *nfq_t, uint32_t queue_maxlen) { #ifndef OS_WIN32 struct timeval tv; int opt; #endif NFQQueueVars *nfq_q = NFQGetQueue(nfq_t->nfq_index); if (nfq_q == NULL) { SCLogError(SC_ERR_NFQ_OPEN, "no queue for given index"); return TM_ECODE_FAILED; } SCLogDebug("opening library handle"); nfq_q->h = nfq_open(); if (!nfq_q->h) { SCLogError(SC_ERR_NFQ_OPEN, "nfq_open() failed"); return TM_ECODE_FAILED; } if (nfq_g.unbind == 0) { /* VJ: on my Ubuntu Hardy system this fails the first time it's * run. Ignoring the error seems to have no bad effects. */ SCLogDebug("unbinding existing nf_queue handler for AF_INET (if any)"); if (nfq_unbind_pf(nfq_q->h, AF_INET) < 0) { SCLogError(SC_ERR_NFQ_UNBIND, "nfq_unbind_pf() for AF_INET failed"); exit(EXIT_FAILURE); } if (nfq_unbind_pf(nfq_q->h, AF_INET6) < 0) { SCLogError(SC_ERR_NFQ_UNBIND, "nfq_unbind_pf() for AF_INET6 failed"); exit(EXIT_FAILURE); } nfq_g.unbind = 1; SCLogDebug("binding nfnetlink_queue as nf_queue handler for AF_INET and AF_INET6"); if (nfq_bind_pf(nfq_q->h, AF_INET) < 0) { SCLogError(SC_ERR_NFQ_BIND, "nfq_bind_pf() for AF_INET failed"); exit(EXIT_FAILURE); } if (nfq_bind_pf(nfq_q->h, AF_INET6) < 0) { SCLogError(SC_ERR_NFQ_BIND, "nfq_bind_pf() for AF_INET6 failed"); exit(EXIT_FAILURE); } } SCLogInfo("binding this thread %d to queue '%" PRIu32 "'", nfq_t->nfq_index, nfq_q->queue_num); /* pass the thread memory as a void ptr so the * callback function has access to it. */ nfq_q->qh = nfq_create_queue(nfq_q->h, nfq_q->queue_num, &NFQCallBack, (void *)nfq_t); if (nfq_q->qh == NULL) { SCLogError(SC_ERR_NFQ_CREATE_QUEUE, "nfq_create_queue failed"); return TM_ECODE_FAILED; } SCLogDebug("setting copy_packet mode"); /* 05DC = 1500 */ //if (nfq_set_mode(nfq_t->qh, NFQNL_COPY_PACKET, 0x05DC) < 0) { if (nfq_set_mode(nfq_q->qh, NFQNL_COPY_PACKET, 0xFFFF) < 0) { SCLogError(SC_ERR_NFQ_SET_MODE, "can't set packet_copy mode"); return TM_ECODE_FAILED; } #ifdef HAVE_NFQ_MAXLEN if (queue_maxlen > 0) { SCLogInfo("setting queue length to %" PRId32 "", queue_maxlen); /* non-fatal if it fails */ if (nfq_set_queue_maxlen(nfq_q->qh, queue_maxlen) < 0) { SCLogWarning(SC_ERR_NFQ_MAXLEN, "can't set queue maxlen: your kernel probably " "doesn't support setting the queue length"); } } #endif /* HAVE_NFQ_MAXLEN */ #ifndef OS_WIN32 /* set netlink buffer size to a decent value */ nfnl_rcvbufsiz(nfq_nfnlh(nfq_q->h), queue_maxlen * 1500); SCLogInfo("setting nfnl bufsize to %" PRId32 "", queue_maxlen * 1500); nfq_q->nh = nfq_nfnlh(nfq_q->h); nfq_q->fd = nfnl_fd(nfq_q->nh); NFQMutexInit(nfq_q); /* Set some netlink specific option on the socket to increase performance */ opt = 1; #ifdef NETLINK_BROADCAST_SEND_ERROR setsockopt(nfq_q->fd, SOL_NETLINK, NETLINK_BROADCAST_SEND_ERROR, &opt, sizeof(int)); #endif /* Don't send error about no buffer space available but drop the packets instead */ #ifdef NETLINK_NO_ENOBUFS setsockopt(nfq_q->fd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(int)); #endif #ifdef HAVE_NFQ_SET_QUEUE_FLAGS if (nfq_config.flags & NFQ_FLAG_FAIL_OPEN) { uint32_t flags = NFQA_CFG_F_FAIL_OPEN; uint32_t mask = NFQA_CFG_F_FAIL_OPEN; int r = nfq_set_queue_flags(nfq_q->qh, mask, flags); if (r == -1) { SCLogWarning(SC_ERR_NFQ_SET_MODE, "can't set fail-open mode: %s", strerror(errno)); } else { SCLogInfo("fail-open mode should be set on queue"); } } #endif /* set a timeout to the socket so we can check for a signal * in case we don't get packets for a longer period. */ tv.tv_sec = 1; tv.tv_usec = 0; if(setsockopt(nfq_q->fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) == -1) { SCLogWarning(SC_ERR_NFQ_SETSOCKOPT, "can't set socket timeout: %s", strerror(errno)); } SCLogDebug("nfq_q->h %p, nfq_q->nh %p, nfq_q->qh %p, nfq_q->fd %" PRId32 "", nfq_q->h, nfq_q->nh, nfq_q->qh, nfq_q->fd); #else /* OS_WIN32 */ NFQMutexInit(nfq_q); nfq_q->ovr.hEvent = CreateEvent(NULL, FALSE, FALSE, NULL); nfq_q->fd = nfq_fd(nfq_q->h); SCLogDebug("nfq_q->h %p, nfq_q->qh %p, nfq_q->fd %p", nfq_q->h, nfq_q->qh, nfq_q->fd); #endif /* OS_WIN32 */ return TM_ECODE_OK; }
static struct packet_module_state *init_state(int thread_id) { static const u_int16_t proto_family[] = { AF_INET, AF_INET6 }; int i; struct packet_module_state *state = malloc(sizeof(struct packet_module_state)); if (!state) { return NULL; } /* Setup nfqueue connection */ state->handle = nfq_open(); if (!state->handle) { message(HAKA_LOG_ERROR, MODULE_NAME, L"unable to open nfqueue handle"); cleanup_state(state); return NULL; } for (i=0; i<sizeof(proto_family)/sizeof(proto_family[0]); ++i) { if (nfq_unbind_pf(state->handle, proto_family[i]) < 0) { message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot unbind queue"); cleanup_state(state); return NULL; } if (nfq_bind_pf(state->handle, proto_family[i]) < 0) { message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot bind queue"); cleanup_state(state); return NULL; } state->send_fd = open_send_socket(false); if (state->send_fd < 0) { cleanup_state(state); return NULL; } state->send_mark_fd = open_send_socket(true); if (state->send_fd < 0) { cleanup_state(state); return NULL; } } state->queue = nfq_create_queue(state->handle, thread_id, &packet_callback, state); if (!state->queue) { message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot create queue"); cleanup_state(state); return NULL; } if (nfq_set_mode(state->queue, NFQNL_COPY_PACKET, PACKET_BUFFER_SIZE) < 0) { message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot set mode to copy packet"); cleanup_state(state); return NULL; } state->fd = nfq_fd(state->handle); /* Change nfq queue len and netfilter receive size */ if (nfq_set_queue_maxlen(state->queue, nfqueue_len) < 0) { message(HAKA_LOG_WARNING, MODULE_NAME, L"cannot change netfilter queue len"); } nfnl_rcvbufsiz(nfq_nfnlh(state->handle), nfqueue_len * 1500); return state; }
static int nfq_daq_initialize ( const DAQ_Config_t* cfg, void** handle, char* errBuf, size_t errMax) { if(cfg->name && *(cfg->name)) { snprintf(errBuf, errMax, "The nfq DAQ module does not support interface or readback mode!"); return DAQ_ERROR_INVAL; } // setup internal stuff NfqImpl *impl = calloc(1, sizeof(*impl)); if ( !impl ) { snprintf(errBuf, errMax, "%s: failed to allocate nfq context\n", __FUNCTION__); return DAQ_ERROR_NOMEM; } if ( nfq_daq_get_setup(impl, cfg, errBuf, errMax) != DAQ_SUCCESS ) { nfq_daq_shutdown(impl); return DAQ_ERROR; } if ( (impl->buf = malloc(MSG_BUF_SIZE)) == NULL ) { snprintf(errBuf, errMax, "%s: failed to allocate nfq buffer\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR_NOMEM; } // setup input stuff // 1. get a new q handle if ( !(impl->nf_handle = nfq_open()) ) { snprintf(errBuf, errMax, "%s: failed to get handle for nfq\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR; } // 2. now use the new q handle to rip the rug out from other // nfq users / handles? actually that doesn't seem to // happen which is good, but then why is this *supposed* // to be necessary? especially since we haven't bound to // a qid yet, and that is exclusive anyway. if ( (IP4(impl) && nfq_unbind_pf(impl->nf_handle, PF_INET) < 0) || (IP6(impl) && nfq_unbind_pf(impl->nf_handle, PF_INET6) < 0) ) { snprintf(errBuf, errMax, "%s: failed to unbind protocols for nfq\n", __FUNCTION__); //nfq_daq_shutdown(impl); //return DAQ_ERROR; } // 3. select protocols for the q handle // this is necessary but insufficient because we still // must configure iptables externally, eg: // // iptables -A OUTPUT -p icmp -j NFQUEUE [--queue-num <#>] // (# defaults to 0). // // :( iptables rules should be managed automatically to avoid // queueing packets to nowhere or waiting for packets that // will never come. (ie this bind should take the -p, -s, // etc args you can pass to iptables and create the dang // rule!) if ( (IP4(impl) && nfq_bind_pf(impl->nf_handle, PF_INET) < 0) || (IP6(impl) && nfq_bind_pf(impl->nf_handle, PF_INET6) < 0) ) { snprintf(errBuf, errMax, "%s: failed to bind protocols for nfq\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR; } // 4. bind to/allocate the specified nfqueue instance // (this is the puppy specified via iptables as in // above example.) // // ** there can be at most 1 nf_queue per qid if ( !(impl->nf_queue = nfq_create_queue( impl->nf_handle, impl->qid, daq_nfq_callback, impl)) ) { snprintf(errBuf, errMax, "%s: nf queue creation failed\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR; } // 5. configure copying for maximum overhead if ( nfq_set_mode(impl->nf_queue, NFQNL_COPY_PACKET, IP_MAXPACKET) < 0 ) { snprintf(errBuf, errMax, "%s: unable to set packet copy mode\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR; } // 6. set queue length (optional) if ( impl->qlen > 0 && nfq_set_queue_maxlen(impl->nf_queue, impl->qlen)) { snprintf(errBuf, errMax, "%s: unable to set queue length\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR; } // 7. get the q socket descriptor // (after getting not 1 but 2 handles!) impl->sock = nfq_fd(impl->nf_handle); // setup output stuff // we've got 2 handles and a socket descriptor but, incredibly, // no way to inject? if ( impl->device && strcasecmp(impl->device, "ip") ) { impl->link = eth_open(impl->device); if ( !impl->link ) { snprintf(errBuf, errMax, "%s: can't open %s!\n", __FUNCTION__, impl->device); nfq_daq_shutdown(impl); return DAQ_ERROR; } } else { impl->net = ip_open(); if ( !impl->net ) { snprintf(errBuf, errMax, "%s: can't open ip!\n", __FUNCTION__); nfq_daq_shutdown(impl); return DAQ_ERROR; } } impl->state = DAQ_STATE_INITIALIZED; *handle = impl; return DAQ_SUCCESS; }
/** * Open a netlink connection and returns file descriptor */ int packetsrv_open(void *data) { int ret; log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_DEBUG, "Opening netfilter queue socket"); log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_DEBUG, "[!] Don't forget to load kernel modules nfnetlink and nfnetlink_queue (using modprobe command)"); /* opening library handle */ h = nfq_open(); if (!h) { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Error during nfq_open()"); return -1; } /* unbinding existing nf_queue handler for AF_INET (if any) */ /* ignoring return, see http://www.spinics.net/lists/netfilter/msg42063.html */ nfq_unbind_pf(h, AF_INET); /* binding nfnetlink_queue as nf_queue handler for AF_INET */ if (nfq_bind_pf(h, AF_INET) < 0) { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Error during nfq_bind_pf()"); return -1; } if (!nufw_no_ipv6) { /* unbinding existing nf_queue handler for AF_INET6 (if any) */ nfq_unbind_pf(h, AF_INET6); /* binding nfnetlink_queue as nf_queue handler for AF_INET6 */ if (nfq_bind_pf(h, AF_INET6) < 0) { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Error during nfq_bind_pf()"); log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "Maybe you need to compile NF_NETLINK* kernel options as modules (not built in the kernel!)"); return -1; } } ret = nfnl_rcvbufsiz(nfq_nfnlh(h), 10 * 65536); log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "rcv buf size set to %d (%d asked)", ret, 10 * 65536); /* binding this socket to queue number ::nfqueue_num * and install our packet handler */ log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_DEBUG, "[+] Binding to netfilter queue %d", nfqueue_num); hndl = nfq_create_queue(h, nfqueue_num, (nfq_callback *) & treat_packet, data); if (!hndl) { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Error during nfq_create_queue() (queue %d busy ?)", nfqueue_num); return -1; } /* setting copy_packet mode */ if (nfq_set_mode(hndl, NFQNL_COPY_PACKET, 0xffff) < 0) { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Can't set packet_copy mode"); return -1; } #ifdef HAVE_NFQ_SET_QUEUE_MAXLEN /* setting queue length */ if (queue_maxlen) { if (nfq_set_queue_maxlen(hndl, queue_maxlen) < 0) { if (nufw_set_mark) { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Can't set queue length, and mark will be set, leaving !"); exit(EXIT_FAILURE); } else { log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL, "[!] Can't set queue length, continuing anyway"); } } } #endif return nfq_fd(h); }
int main(int argc, char **argv) { struct nfq_handle *h; struct nfq_q_handle *qh; fd_set sockets; int fd; int rv; char buf[MAX_PACKET_SIZE] __attribute__ ((aligned)); int s, sock_out, len, t; struct sockaddr_un local, remote; if ((s = socket(AF_UNIX, SOCK_DGRAM, 0)) == -1) { perror("socket"); exit(1); } local.sun_family = AF_UNIX; strcpy(local.sun_path, SOCK_PATH_S); unlink(local.sun_path); len = strlen(local.sun_path) + sizeof(local.sun_family); if (bind(s, (struct sockaddr *)&local, len) == -1) { perror("bind"); exit(1); } remote.sun_family = AF_UNIX; strcpy(remote.sun_path, SOCK_PATH); // unlink(remote.sun_path); if (connect(s, (struct sockaddr*)&remote, sizeof(remote))) { perror("connect"); exit(1); } /* if (listen(s, 5) == -1) { perror("listen"); exit(1); } */ for(;;) { printf("opening library handle\n"); h = nfq_open(); if (!h) { fprintf(stderr, "error during nfq_open()\n"); exit(1); } printf("unbinding existing nf_queue handler for AF_INET (if any)\n"); if (nfq_unbind_pf(h, AF_INET) < 0) { fprintf(stderr, "error during nfq_unbind_pf()\n"); exit(1); } printf("binding nfnetlink_queue as nf_queue handler for AF_INET\n"); if (nfq_bind_pf(h, AF_INET) < 0) { fprintf(stderr, "error during nfq_bind_pf()\n"); exit(1); } printf("binding this socket to queue '0'\n"); qh = nfq_create_queue(h, 0, &cb, &s); if (!qh) { fprintf(stderr, "error during nfq_create_queue()\n"); exit(1); } printf("setting copy_packet mode\n"); if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) { fprintf(stderr, "can't set packet_copy mode\n"); exit(1); } if (nfq_set_queue_maxlen(qh, 1024) < 0) { perror("length"); } fd = nfq_fd(h); t = sizeof(remote); /* if ((sock_out = accept(s, (struct sockaddr *)&remote, &t)) == -1) { perror("accept"); exit(1); } */ for (;;) { int nready; int i; FD_ZERO(&sockets); FD_SET(fd, &sockets); FD_SET(s, &sockets); int maxfd = MAX(fd, s); nready = select(maxfd + 1, &sockets, NULL, NULL, NULL); if (nready == -1) { perror("select"); exit(1); } for(i=maxfd; i>= 0 && nready>0; i--) { if(FD_ISSET(i, &sockets)) { nready--; if (i == fd) { if ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0) { nfq_handle_packet(h, buf, rv); continue; } /* if your application is too slow to digest the packets that * are sent from kernel-space, the socket buffer that we use * to enqueue packets may fill up returning ENOBUFS. Depending * on your application, this error may be ignored. Please, see * the doxygen documentation of this library on how to improve * this situation. */ if (rv < 0 && errno == ENOBUFS) { printf("losing packets!\n"); continue; } perror("recv failed"); break; } if (i == s) { if ((rv = recv(s, buf, sizeof(buf), 0)) >= 0) { set_verdict(qh, (verdict_msg*)buf); continue; } } } } } } printf("unbinding from queue 0\n"); nfq_destroy_queue(qh); printf("closing library handle\n"); nfq_close(h); close(s); exit(0); }
// loop to process a received packet at the queue // ---------------------------------------------- short int netlink_loop(unsigned short int queuenum) { int fd, rv; char buf[MAX_PKTSIZE]; struct queues_t *queue; pthread_mutex_lock(&mutexusock); queue = malloc(sizeof(struct queues_t)); // opening library handle queue->nfqh = nfq_open(); if (!queue->nfqh) error(ERR, 0, "Error during nfq_open()\n"); // unbinding existing nf_queue handler for AF_INET (if any) // an error with Kernel 2.6.23 or above --> commented 2 lines if (nfq_unbind_pf(queue->nfqh, AF_INET) < 0) error(ERR, 0, "Error during nfq_unbind_pf()\n"); // binds the given queue connection handle to process packets. if (nfq_bind_pf(queue->nfqh, AF_INET) < 0) error(ERR, 0, "Error during nfq_bind_pf()\n"); printf("NFQUEUE: binding to queue '%hd'\n", queuenum); // create queue queue->qh = nfq_create_queue(queue->nfqh, queuenum, &nfqueue_cb, NULL); if (!queue->qh) error(ERR, 0, "Error during nfq_create_queue()\n"); // sets the amount of data to be copied to userspace for each packet queued // to the given queue. if (nfq_set_mode(queue->qh, NFQNL_COPY_PACKET, MAX_PKTSIZE) < 0) error(ERR, 0, "Can't set packet_copy mode\n"); // Set kernel queue maximum length parameter if (nfq_set_queue_maxlen(queue->qh, MAX_QUEUE_LEN) < 0) error(ERR, 0, "Can't set max len of queue\n"); // returns the netlink handle associated with the given queue connection handle. // Possibly useful if you wish to perform other netlink communication // directly after opening a queue without opening a new netlink connection to do so queue->nh = nfq_nfnlh(queue->nfqh); queue->next = queues; queues = queue; pthread_mutex_unlock(&mutexusock); // returns a file descriptor for the netlink connection associated with the // given queue connection handle. The file descriptor can then be used for // receiving the queued packets for processing. fd = nfnl_fd(queue->nh); while ((rv = recv(fd, buf, sizeof(buf), 0)) && rv >= 0) { // triggers an associated callback for the given packet received from the queue. // Packets can be read from the queue using nfq_fd() and recv(). nfq_handle_packet(queue->nfqh, buf, rv); memset(buf, 0x0, sizeof(buf)); for (;;) { if ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0) { nfq_handle_packet(queue->nfqh, buf, rv); memset(buf, 0x0, sizeof(buf)); continue; } /* if the computer is slower than the network the buffer * may fill up. Depending on the application, this error * may be ignored */ if (errno == ENOBUFS) { printf("packet lost!!\n"); continue; } printf("NFQUEUE: recv failed: errno=%d (%s)\n", errno, strerror(errno)); } } // unbinding before exit printf("NFQUEUE: unbinding from queue '%hd'\n", queuenum); nfq_destroy_queue(queue->qh); nfq_close(queue->nfqh); return OK; }