response_t set_queue_len(int len, ETERM *tuplep, q_data_t **q_data, thread_data_t *data) {
int q_num, cq_idx;
ETERM *arg;
response_t r;
if(erl_size(tuplep) > 2) {
arg = erl_element(3, tuplep);
q_num = ERL_INT_VALUE(arg);
erl_free_term(arg);
syslog(LOG_NOTICE,"[%d] q_num: %d, len: %d\n\r", data->idx, q_num, len);
if((cq_idx = get_queue_idx(q_num, q_data)) >= 0) {
if(nfq_set_queue_maxlen(q_data[cq_idx]->qh, len) >= 0) {
r.cs = erl_mk_atom("ok");
r.rsp = erl_mk_atom("ok");
} else {
r.cs = erl_mk_atom("error");
r.rsp = erl_mk_estring("failed to set queue max length", strlen("failed to set queue max length"));
}
} else {
r.cs = erl_mk_atom("error");
r.rsp = erl_mk_estring("no such queue", strlen("no such queue"));
}
} else {
r.cs = erl_mk_atom("error");
r.rsp = erl_mk_estring("argument missing", strlen("argument missing"));
}
return r;
}
int createQueue(struct nfq_handle *h, int queue_num, int
(*callback)(struct nfq_q_handle *, struct nfgenmsg *, struct nfq_data
*, void *)) {
// get code from nfqnl_test.c
struct nfq_q_handle *qh;
int fd = 0;
int rv = 0;
printf("binding this socket to queue %d\n", queue_num);
qh = nfq_create_queue(h, queue_num, callback, NULL);
if (!qh) {
fprintf(stderr, "error during nfq_create_queue()\n");
exit(1);
}
printf("setting copy_packet mode Boo Yeah!!\n");
if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
fprintf(stderr, "can't set packet_copy mode\n");
exit(1);
}
printf("Packet Mode Set\n");
fd = nfq_fd(h);
if(nfq_set_queue_maxlen(qh, 100) < 0 ) {
fprintf(stderr,"---\nCannot set queue max len \n---");
}
return fd;
}
int queue_set_queue_maxlen(struct queue *self, int maxlen)
{
int ret;
ret = nfq_set_queue_maxlen(self->_qh, maxlen);
if (ret < 0) {
throw_exception("error during nfq_set_queue_maxlen()\n");
}
return ret;
}
int divert_open(int port, divert_cb cb)
{
unsigned int bufsize = 1024 * 1024 * 1;
unsigned int rc;
char *m;
int fd, flags;
_h = nfq_open();
if (!_h)
err(1, "nfq_open()");
rc = nfnl_rcvbufsiz(nfq_nfnlh(_h), bufsize);
if (rc != bufsize)
xprintf(XP_DEBUG, "Buffer size %u wanted %u\n", rc, bufsize);
/* reset in case of previous crash */
if (nfq_unbind_pf(_h, AF_INET) < 0)
err(1, "nfq_unbind_pf()");
if (nfq_bind_pf(_h, AF_INET) < 0)
err(1, "nfq_bind_pf()");
_q = nfq_create_queue(_h, port, packet_input, cb);
if (!_q)
err(1, "nfq_create_queue()");
if (nfq_set_mode(_q, NFQNL_COPY_PACKET, 0xffff) < 0)
err(1, "nfq_set_mode()");
if (nfq_set_queue_maxlen(_q, 10000) < 0)
err(1, "nfq_set_queue_maxlen()");
xprintf(XP_DEFAULT,
"Divert packets using iptables -j NFQUEUE --queue-num %d\n",
port);
m = driver_param(0);
if (m) {
_mark = strtoul(m, NULL, 16);
xprintf(XP_DEFAULT, "Also, add -m mark --mark 0x0/0x%x\n",
_mark);
}
fd = nfq_fd(_h);
flags = fcntl(fd, F_GETFL);
if (flags == -1)
err(1, "fcntl()");
if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1)
err(1, "fcntl()");
open_raw();
return fd;
}
int
tc_nfq_socket_init(struct nfq_handle **h, struct nfq_q_handle **qh,
nfq_callback *cb, int max_queue_len)
{
int fd;
tc_log_info(LOG_NOTICE, 0, "opening library handle");
*h = nfq_open();
if (!(*h)) {
tc_log_info(LOG_ERR, errno, "error during nfq_open()");
return TC_INVALID_SOCKET;
}
tc_log_info(LOG_NOTICE, 0,
"unbinding existing nf_queue handler for AF_INET (if any)");
if (nfq_unbind_pf((*h), AF_INET) < 0) {
tc_log_info(LOG_ERR, errno, "error during nfq_unbind_pf()");
return TC_INVALID_SOCKET;
}
tc_log_info(LOG_NOTICE, 0,
"binding nfnetlink_queue as nf_queue handler for AF_INET");
if (nfq_bind_pf((*h), AF_INET) < 0) {
tc_log_info(LOG_ERR, errno, "error during nfq_bind_pf()");
return TC_INVALID_SOCKET;
}
tc_log_info(LOG_NOTICE, 0, "binding this socket to queue");
*qh = nfq_create_queue((*h), 0, cb, NULL);
if (!(*qh)) {
tc_log_info(LOG_ERR, errno, "error during nfq_create_queue()");
return TC_INVALID_SOCKET;
}
tc_log_info(LOG_NOTICE, 0, "setting copy_packet mode");
if (nfq_set_mode((*qh), NFQNL_COPY_PACKET, RESP_MAX_USEFUL_SIZE) < 0) {
tc_log_info(LOG_ERR, errno, "can't set packet_copy mode");
return TC_INVALID_SOCKET;
}
if (max_queue_len > 0) {
if (nfq_set_queue_maxlen((*qh), (uint32_t) max_queue_len) < 0) {
tc_log_info(LOG_ERR, errno, "can't set queue max length:%d",
max_queue_len);
tc_log_info(LOG_WARN, 0, "unable to set queue maxlen");
tc_log_info(LOG_WARN, 0, "your kernel probably doesn't support it");
}
}
fd = nfq_fd(*h);
nfnl_rcvbufsiz(nfq_nfnlh(*h), 16777216);
return fd;
}
void disruptor_nfq_bind() {
/* Bind the program to a specific queue */
if(!d_nfq.qid){
d_nfq.qid=10; /* Default queue id */
}
log_info("binding intercept socket to queue [%d]", d_nfq.qid);
d_nfq.qh = nfq_create_queue(d_nfq.h, d_nfq.qid, &disruptor_nfq_call_back, (void *)stream);
if (!d_nfq.qh) {
log_error("error during nfq_create_queue()");
exit(1);
}
log_debug("setting copy_packet mode");
if (nfq_set_mode(d_nfq.qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
log_error("can't set packet_copy mode");
exit(1);
}
if(nfq_set_queue_maxlen(d_nfq.qh, (uint32_t)DISRUPTOR_MAX_Q_LEN) < 0){
log_error("error setting maximum queue size to [%d]", DISRUPTOR_MAX_Q_LEN);
exit(1);
}
}
TmEcode NFQInitThread(NFQThreadVars *nfq_t, uint32_t queue_maxlen)
{
#ifndef OS_WIN32
struct timeval tv;
int opt;
#endif
NFQQueueVars *nfq_q = NFQGetQueue(nfq_t->nfq_index);
if (nfq_q == NULL) {
SCLogError(SC_ERR_NFQ_OPEN, "no queue for given index");
return TM_ECODE_FAILED;
}
SCLogDebug("opening library handle");
nfq_q->h = nfq_open();
if (!nfq_q->h) {
SCLogError(SC_ERR_NFQ_OPEN, "nfq_open() failed");
return TM_ECODE_FAILED;
}
if (nfq_g.unbind == 0)
{
/* VJ: on my Ubuntu Hardy system this fails the first time it's
* run. Ignoring the error seems to have no bad effects. */
SCLogDebug("unbinding existing nf_queue handler for AF_INET (if any)");
if (nfq_unbind_pf(nfq_q->h, AF_INET) < 0) {
SCLogError(SC_ERR_NFQ_UNBIND, "nfq_unbind_pf() for AF_INET failed");
exit(EXIT_FAILURE);
}
if (nfq_unbind_pf(nfq_q->h, AF_INET6) < 0) {
SCLogError(SC_ERR_NFQ_UNBIND, "nfq_unbind_pf() for AF_INET6 failed");
exit(EXIT_FAILURE);
}
nfq_g.unbind = 1;
SCLogDebug("binding nfnetlink_queue as nf_queue handler for AF_INET and AF_INET6");
if (nfq_bind_pf(nfq_q->h, AF_INET) < 0) {
SCLogError(SC_ERR_NFQ_BIND, "nfq_bind_pf() for AF_INET failed");
exit(EXIT_FAILURE);
}
if (nfq_bind_pf(nfq_q->h, AF_INET6) < 0) {
SCLogError(SC_ERR_NFQ_BIND, "nfq_bind_pf() for AF_INET6 failed");
exit(EXIT_FAILURE);
}
}
SCLogInfo("binding this thread %d to queue '%" PRIu32 "'", nfq_t->nfq_index, nfq_q->queue_num);
/* pass the thread memory as a void ptr so the
* callback function has access to it. */
nfq_q->qh = nfq_create_queue(nfq_q->h, nfq_q->queue_num, &NFQCallBack, (void *)nfq_t);
if (nfq_q->qh == NULL)
{
SCLogError(SC_ERR_NFQ_CREATE_QUEUE, "nfq_create_queue failed");
return TM_ECODE_FAILED;
}
SCLogDebug("setting copy_packet mode");
/* 05DC = 1500 */
//if (nfq_set_mode(nfq_t->qh, NFQNL_COPY_PACKET, 0x05DC) < 0) {
if (nfq_set_mode(nfq_q->qh, NFQNL_COPY_PACKET, 0xFFFF) < 0) {
SCLogError(SC_ERR_NFQ_SET_MODE, "can't set packet_copy mode");
return TM_ECODE_FAILED;
}
#ifdef HAVE_NFQ_MAXLEN
if (queue_maxlen > 0) {
SCLogInfo("setting queue length to %" PRId32 "", queue_maxlen);
/* non-fatal if it fails */
if (nfq_set_queue_maxlen(nfq_q->qh, queue_maxlen) < 0) {
SCLogWarning(SC_ERR_NFQ_MAXLEN, "can't set queue maxlen: your kernel probably "
"doesn't support setting the queue length");
}
}
#endif /* HAVE_NFQ_MAXLEN */
#ifndef OS_WIN32
/* set netlink buffer size to a decent value */
nfnl_rcvbufsiz(nfq_nfnlh(nfq_q->h), queue_maxlen * 1500);
SCLogInfo("setting nfnl bufsize to %" PRId32 "", queue_maxlen * 1500);
nfq_q->nh = nfq_nfnlh(nfq_q->h);
nfq_q->fd = nfnl_fd(nfq_q->nh);
NFQMutexInit(nfq_q);
/* Set some netlink specific option on the socket to increase
performance */
opt = 1;
#ifdef NETLINK_BROADCAST_SEND_ERROR
setsockopt(nfq_q->fd, SOL_NETLINK,
NETLINK_BROADCAST_SEND_ERROR, &opt, sizeof(int));
#endif
/* Don't send error about no buffer space available but drop the
packets instead */
#ifdef NETLINK_NO_ENOBUFS
setsockopt(nfq_q->fd, SOL_NETLINK, NETLINK_NO_ENOBUFS, &opt, sizeof(int));
#endif
#ifdef HAVE_NFQ_SET_QUEUE_FLAGS
if (nfq_config.flags & NFQ_FLAG_FAIL_OPEN) {
uint32_t flags = NFQA_CFG_F_FAIL_OPEN;
uint32_t mask = NFQA_CFG_F_FAIL_OPEN;
int r = nfq_set_queue_flags(nfq_q->qh, mask, flags);
if (r == -1) {
SCLogWarning(SC_ERR_NFQ_SET_MODE, "can't set fail-open mode: %s",
strerror(errno));
} else {
SCLogInfo("fail-open mode should be set on queue");
}
}
#endif
/* set a timeout to the socket so we can check for a signal
* in case we don't get packets for a longer period. */
tv.tv_sec = 1;
tv.tv_usec = 0;
if(setsockopt(nfq_q->fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)) == -1) {
SCLogWarning(SC_ERR_NFQ_SETSOCKOPT, "can't set socket timeout: %s", strerror(errno));
}
SCLogDebug("nfq_q->h %p, nfq_q->nh %p, nfq_q->qh %p, nfq_q->fd %" PRId32 "",
nfq_q->h, nfq_q->nh, nfq_q->qh, nfq_q->fd);
#else /* OS_WIN32 */
NFQMutexInit(nfq_q);
nfq_q->ovr.hEvent = CreateEvent(NULL, FALSE, FALSE, NULL);
nfq_q->fd = nfq_fd(nfq_q->h);
SCLogDebug("nfq_q->h %p, nfq_q->qh %p, nfq_q->fd %p", nfq_q->h, nfq_q->qh, nfq_q->fd);
#endif /* OS_WIN32 */
return TM_ECODE_OK;
}
static struct packet_module_state *init_state(int thread_id)
{
static const u_int16_t proto_family[] = { AF_INET, AF_INET6 };
int i;
struct packet_module_state *state = malloc(sizeof(struct packet_module_state));
if (!state) {
return NULL;
}
/* Setup nfqueue connection */
state->handle = nfq_open();
if (!state->handle) {
message(HAKA_LOG_ERROR, MODULE_NAME, L"unable to open nfqueue handle");
cleanup_state(state);
return NULL;
}
for (i=0; i<sizeof(proto_family)/sizeof(proto_family[0]); ++i) {
if (nfq_unbind_pf(state->handle, proto_family[i]) < 0) {
message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot unbind queue");
cleanup_state(state);
return NULL;
}
if (nfq_bind_pf(state->handle, proto_family[i]) < 0) {
message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot bind queue");
cleanup_state(state);
return NULL;
}
state->send_fd = open_send_socket(false);
if (state->send_fd < 0) {
cleanup_state(state);
return NULL;
}
state->send_mark_fd = open_send_socket(true);
if (state->send_fd < 0) {
cleanup_state(state);
return NULL;
}
}
state->queue = nfq_create_queue(state->handle, thread_id,
&packet_callback, state);
if (!state->queue) {
message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot create queue");
cleanup_state(state);
return NULL;
}
if (nfq_set_mode(state->queue, NFQNL_COPY_PACKET,
PACKET_BUFFER_SIZE) < 0) {
message(HAKA_LOG_ERROR, MODULE_NAME, L"cannot set mode to copy packet");
cleanup_state(state);
return NULL;
}
state->fd = nfq_fd(state->handle);
/* Change nfq queue len and netfilter receive size */
if (nfq_set_queue_maxlen(state->queue, nfqueue_len) < 0) {
message(HAKA_LOG_WARNING, MODULE_NAME, L"cannot change netfilter queue len");
}
nfnl_rcvbufsiz(nfq_nfnlh(state->handle), nfqueue_len * 1500);
return state;
}
static int nfq_daq_initialize (
const DAQ_Config_t* cfg, void** handle, char* errBuf, size_t errMax)
{
if(cfg->name && *(cfg->name))
{
snprintf(errBuf, errMax, "The nfq DAQ module does not support interface or readback mode!");
return DAQ_ERROR_INVAL;
}
// setup internal stuff
NfqImpl *impl = calloc(1, sizeof(*impl));
if ( !impl )
{
snprintf(errBuf, errMax, "%s: failed to allocate nfq context\n",
__FUNCTION__);
return DAQ_ERROR_NOMEM;
}
if ( nfq_daq_get_setup(impl, cfg, errBuf, errMax) != DAQ_SUCCESS )
{
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
if ( (impl->buf = malloc(MSG_BUF_SIZE)) == NULL )
{
snprintf(errBuf, errMax, "%s: failed to allocate nfq buffer\n",
__FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR_NOMEM;
}
// setup input stuff
// 1. get a new q handle
if ( !(impl->nf_handle = nfq_open()) )
{
snprintf(errBuf, errMax, "%s: failed to get handle for nfq\n",
__FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
// 2. now use the new q handle to rip the rug out from other
// nfq users / handles? actually that doesn't seem to
// happen which is good, but then why is this *supposed*
// to be necessary? especially since we haven't bound to
// a qid yet, and that is exclusive anyway.
if (
(IP4(impl) && nfq_unbind_pf(impl->nf_handle, PF_INET) < 0) ||
(IP6(impl) && nfq_unbind_pf(impl->nf_handle, PF_INET6) < 0) )
{
snprintf(errBuf, errMax, "%s: failed to unbind protocols for nfq\n",
__FUNCTION__);
//nfq_daq_shutdown(impl);
//return DAQ_ERROR;
}
// 3. select protocols for the q handle
// this is necessary but insufficient because we still
// must configure iptables externally, eg:
//
// iptables -A OUTPUT -p icmp -j NFQUEUE [--queue-num <#>]
// (# defaults to 0).
//
// :( iptables rules should be managed automatically to avoid
// queueing packets to nowhere or waiting for packets that
// will never come. (ie this bind should take the -p, -s,
// etc args you can pass to iptables and create the dang
// rule!)
if (
(IP4(impl) && nfq_bind_pf(impl->nf_handle, PF_INET) < 0) ||
(IP6(impl) && nfq_bind_pf(impl->nf_handle, PF_INET6) < 0) )
{
snprintf(errBuf, errMax, "%s: failed to bind protocols for nfq\n",
__FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
// 4. bind to/allocate the specified nfqueue instance
// (this is the puppy specified via iptables as in
// above example.)
//
// ** there can be at most 1 nf_queue per qid
if ( !(impl->nf_queue = nfq_create_queue(
impl->nf_handle, impl->qid, daq_nfq_callback, impl)) )
{
snprintf(errBuf, errMax, "%s: nf queue creation failed\n",
__FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
// 5. configure copying for maximum overhead
if ( nfq_set_mode(impl->nf_queue, NFQNL_COPY_PACKET, IP_MAXPACKET) < 0 )
{
snprintf(errBuf, errMax, "%s: unable to set packet copy mode\n",
__FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
// 6. set queue length (optional)
if ( impl->qlen > 0 &&
nfq_set_queue_maxlen(impl->nf_queue, impl->qlen))
{
snprintf(errBuf, errMax, "%s: unable to set queue length\n",
__FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
// 7. get the q socket descriptor
// (after getting not 1 but 2 handles!)
impl->sock = nfq_fd(impl->nf_handle);
// setup output stuff
// we've got 2 handles and a socket descriptor but, incredibly,
// no way to inject?
if ( impl->device && strcasecmp(impl->device, "ip") )
{
impl->link = eth_open(impl->device);
if ( !impl->link )
{
snprintf(errBuf, errMax, "%s: can't open %s!\n",
__FUNCTION__, impl->device);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
}
else
{
impl->net = ip_open();
if ( !impl->net )
{
snprintf(errBuf, errMax, "%s: can't open ip!\n", __FUNCTION__);
nfq_daq_shutdown(impl);
return DAQ_ERROR;
}
}
impl->state = DAQ_STATE_INITIALIZED;
*handle = impl;
return DAQ_SUCCESS;
}
/**
* Open a netlink connection and returns file descriptor
*/
int packetsrv_open(void *data)
{
int ret;
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_DEBUG,
"Opening netfilter queue socket");
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_DEBUG,
"[!] Don't forget to load kernel modules nfnetlink and nfnetlink_queue (using modprobe command)");
/* opening library handle */
h = nfq_open();
if (!h) {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Error during nfq_open()");
return -1;
}
/* unbinding existing nf_queue handler for AF_INET (if any) */
/* ignoring return, see http://www.spinics.net/lists/netfilter/msg42063.html */
nfq_unbind_pf(h, AF_INET);
/* binding nfnetlink_queue as nf_queue handler for AF_INET */
if (nfq_bind_pf(h, AF_INET) < 0) {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Error during nfq_bind_pf()");
return -1;
}
if (!nufw_no_ipv6) {
/* unbinding existing nf_queue handler for AF_INET6 (if any) */
nfq_unbind_pf(h, AF_INET6);
/* binding nfnetlink_queue as nf_queue handler for AF_INET6 */
if (nfq_bind_pf(h, AF_INET6) < 0) {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Error during nfq_bind_pf()");
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"Maybe you need to compile NF_NETLINK* kernel options as modules (not built in the kernel!)");
return -1;
}
}
ret = nfnl_rcvbufsiz(nfq_nfnlh(h), 10 * 65536);
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"rcv buf size set to %d (%d asked)",
ret, 10 * 65536);
/* binding this socket to queue number ::nfqueue_num
* and install our packet handler */
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_DEBUG,
"[+] Binding to netfilter queue %d", nfqueue_num);
hndl = nfq_create_queue(h, nfqueue_num,
(nfq_callback *) & treat_packet, data);
if (!hndl) {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Error during nfq_create_queue() (queue %d busy ?)",
nfqueue_num);
return -1;
}
/* setting copy_packet mode */
if (nfq_set_mode(hndl, NFQNL_COPY_PACKET, 0xffff) < 0) {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Can't set packet_copy mode");
return -1;
}
#ifdef HAVE_NFQ_SET_QUEUE_MAXLEN
/* setting queue length */
if (queue_maxlen) {
if (nfq_set_queue_maxlen(hndl, queue_maxlen) < 0) {
if (nufw_set_mark) {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Can't set queue length, and mark will be set, leaving !");
exit(EXIT_FAILURE);
} else {
log_area_printf(DEBUG_AREA_MAIN, DEBUG_LEVEL_CRITICAL,
"[!] Can't set queue length, continuing anyway");
}
}
}
#endif
return nfq_fd(h);
}
int main(int argc, char **argv)
{
struct nfq_handle *h;
struct nfq_q_handle *qh;
fd_set sockets;
int fd;
int rv;
char buf[MAX_PACKET_SIZE] __attribute__ ((aligned));
int s, sock_out, len, t;
struct sockaddr_un local, remote;
if ((s = socket(AF_UNIX, SOCK_DGRAM, 0)) == -1) {
perror("socket");
exit(1);
}
local.sun_family = AF_UNIX;
strcpy(local.sun_path, SOCK_PATH_S);
unlink(local.sun_path);
len = strlen(local.sun_path) + sizeof(local.sun_family);
if (bind(s, (struct sockaddr *)&local, len) == -1) {
perror("bind");
exit(1);
}
remote.sun_family = AF_UNIX;
strcpy(remote.sun_path, SOCK_PATH);
// unlink(remote.sun_path);
if (connect(s, (struct sockaddr*)&remote, sizeof(remote))) {
perror("connect");
exit(1);
}
/*
if (listen(s, 5) == -1) {
perror("listen");
exit(1);
}
*/
for(;;) {
printf("opening library handle\n");
h = nfq_open();
if (!h) {
fprintf(stderr, "error during nfq_open()\n");
exit(1);
}
printf("unbinding existing nf_queue handler for AF_INET (if any)\n");
if (nfq_unbind_pf(h, AF_INET) < 0) {
fprintf(stderr, "error during nfq_unbind_pf()\n");
exit(1);
}
printf("binding nfnetlink_queue as nf_queue handler for AF_INET\n");
if (nfq_bind_pf(h, AF_INET) < 0) {
fprintf(stderr, "error during nfq_bind_pf()\n");
exit(1);
}
printf("binding this socket to queue '0'\n");
qh = nfq_create_queue(h, 0, &cb, &s);
if (!qh) {
fprintf(stderr, "error during nfq_create_queue()\n");
exit(1);
}
printf("setting copy_packet mode\n");
if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
fprintf(stderr, "can't set packet_copy mode\n");
exit(1);
}
if (nfq_set_queue_maxlen(qh, 1024) < 0) {
perror("length");
}
fd = nfq_fd(h);
t = sizeof(remote);
/* if ((sock_out = accept(s, (struct sockaddr *)&remote, &t)) == -1) {
perror("accept");
exit(1);
}
*/
for (;;) {
int nready;
int i;
FD_ZERO(&sockets);
FD_SET(fd, &sockets);
FD_SET(s, &sockets);
int maxfd = MAX(fd, s);
nready = select(maxfd + 1, &sockets, NULL, NULL, NULL);
if (nready == -1) {
perror("select");
exit(1);
}
for(i=maxfd; i>= 0 && nready>0; i--)
{
if(FD_ISSET(i, &sockets))
{
nready--;
if (i == fd) {
if ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0) {
nfq_handle_packet(h, buf, rv);
continue;
}
/* if your application is too slow to digest the packets that
* are sent from kernel-space, the socket buffer that we use
* to enqueue packets may fill up returning ENOBUFS. Depending
* on your application, this error may be ignored. Please, see
* the doxygen documentation of this library on how to improve
* this situation.
*/
if (rv < 0 && errno == ENOBUFS) {
printf("losing packets!\n");
continue;
}
perror("recv failed");
break;
}
if (i == s) {
if ((rv = recv(s, buf, sizeof(buf), 0)) >= 0) {
set_verdict(qh, (verdict_msg*)buf);
continue;
}
}
}
}
}
}
printf("unbinding from queue 0\n");
nfq_destroy_queue(qh);
printf("closing library handle\n");
nfq_close(h);
close(s);
exit(0);
}
// loop to process a received packet at the queue
// ----------------------------------------------
short int netlink_loop(unsigned short int queuenum) {
int fd, rv;
char buf[MAX_PKTSIZE];
struct queues_t *queue;
pthread_mutex_lock(&mutexusock);
queue = malloc(sizeof(struct queues_t));
// opening library handle
queue->nfqh = nfq_open();
if (!queue->nfqh)
error(ERR, 0, "Error during nfq_open()\n");
// unbinding existing nf_queue handler for AF_INET (if any)
// an error with Kernel 2.6.23 or above --> commented 2 lines
if (nfq_unbind_pf(queue->nfqh, AF_INET) < 0)
error(ERR, 0, "Error during nfq_unbind_pf()\n");
// binds the given queue connection handle to process packets.
if (nfq_bind_pf(queue->nfqh, AF_INET) < 0)
error(ERR, 0, "Error during nfq_bind_pf()\n");
printf("NFQUEUE: binding to queue '%hd'\n", queuenum);
// create queue
queue->qh = nfq_create_queue(queue->nfqh, queuenum, &nfqueue_cb, NULL);
if (!queue->qh)
error(ERR, 0, "Error during nfq_create_queue()\n");
// sets the amount of data to be copied to userspace for each packet queued
// to the given queue.
if (nfq_set_mode(queue->qh, NFQNL_COPY_PACKET, MAX_PKTSIZE) < 0)
error(ERR, 0, "Can't set packet_copy mode\n");
// Set kernel queue maximum length parameter
if (nfq_set_queue_maxlen(queue->qh, MAX_QUEUE_LEN) < 0)
error(ERR, 0, "Can't set max len of queue\n");
// returns the netlink handle associated with the given queue connection handle.
// Possibly useful if you wish to perform other netlink communication
// directly after opening a queue without opening a new netlink connection to do so
queue->nh = nfq_nfnlh(queue->nfqh);
queue->next = queues;
queues = queue;
pthread_mutex_unlock(&mutexusock);
// returns a file descriptor for the netlink connection associated with the
// given queue connection handle. The file descriptor can then be used for
// receiving the queued packets for processing.
fd = nfnl_fd(queue->nh);
while ((rv = recv(fd, buf, sizeof(buf), 0)) && rv >= 0) {
// triggers an associated callback for the given packet received from the queue.
// Packets can be read from the queue using nfq_fd() and recv().
nfq_handle_packet(queue->nfqh, buf, rv);
memset(buf, 0x0, sizeof(buf));
for (;;) {
if ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0) {
nfq_handle_packet(queue->nfqh, buf, rv);
memset(buf, 0x0, sizeof(buf));
continue;
}
/* if the computer is slower than the network the buffer
* may fill up. Depending on the application, this error
* may be ignored */
if (errno == ENOBUFS) {
printf("packet lost!!\n");
continue;
}
printf("NFQUEUE: recv failed: errno=%d (%s)\n", errno, strerror(errno));
}
}
// unbinding before exit
printf("NFQUEUE: unbinding from queue '%hd'\n", queuenum);
nfq_destroy_queue(queue->qh);
nfq_close(queue->nfqh);
return OK;
}
