nfqnl_test.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <netinet/in.h>
#include <linux/types.h>
#include <linux/netfilter.h> /* for NF_ACCEPT */
#include <errno.h>
#include <libnetfilter_queue/libnetfilter_queue.h>
/* returns packet id */
static uint32_t print_pkt (struct nfq_data *tb)
{
int id = 0;
struct nfqnl_msg_packet_hdr *ph;
struct nfqnl_msg_packet_hw *hwph;
uint32_t mark, ifi, uid, gid;
int ret;
unsigned char *data, *secdata;
ph = nfq_get_msg_packet_hdr(tb);
if (ph) {
id = ntohl(ph->packet_id);
printf("hw_protocol=0x%04x hook=%u id=%u ",
ntohs(ph->hw_protocol), ph->hook, id);
}
hwph = nfq_get_packet_hw(tb);
if (hwph) {
int i, hlen = ntohs(hwph->hw_addrlen);
printf("hw_src_addr=");
for (i = 0; i < hlen-1; i++)
printf("%02x:", hwph->hw_addr[i]);
printf("%02x ", hwph->hw_addr[hlen-1]);
}
mark = nfq_get_nfmark(tb);
if (mark)
printf("mark=%u ", mark);
ifi = nfq_get_indev(tb);
if (ifi)
printf("indev=%u ", ifi);
ifi = nfq_get_outdev(tb);
if (ifi)
printf("outdev=%u ", ifi);
ifi = nfq_get_physindev(tb);
if (ifi)
printf("physindev=%u ", ifi);
ifi = nfq_get_physoutdev(tb);
if (ifi)
printf("physoutdev=%u ", ifi);
if (nfq_get_uid(tb, &uid))
printf("uid=%u ", uid);
if (nfq_get_gid(tb, &gid))
printf("gid=%u ", gid);
ret = nfq_get_secctx(tb, &secdata);
if (ret > 0)
printf("secctx=\"%.*s\" ", ret, secdata);
ret = nfq_get_payload(tb, &data);
if (ret >= 0)
printf("payload_len=%d ", ret);
fputc('\n', stdout);
return id;
}
static int cb(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
struct nfq_data *nfa, void *data)
{
uint32_t id = print_pkt(nfa);
printf("entering callback\n");
return nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL);
}
int main(int argc, char **argv)
{
struct nfq_handle *h;
struct nfq_q_handle *qh;
int fd;
int rv;
uint32_t queue = 0;
char buf[4096] __attribute__ ((aligned));
if (argc == 2) {
queue = atoi(argv[1]);
if (queue > 65535) {
fprintf(stderr, "Usage: %s [<0-65535>]\n", argv[0]);
exit(EXIT_FAILURE);
}
}
printf("opening library handle\n");
h = nfq_open();
if (!h) {
fprintf(stderr, "error during nfq_open()\n");
exit(1);
}
printf("unbinding existing nf_queue handler for AF_INET (if any)\n");
if (nfq_unbind_pf(h, AF_INET) < 0) {
fprintf(stderr, "error during nfq_unbind_pf()\n");
exit(1);
}
printf("binding nfnetlink_queue as nf_queue handler for AF_INET\n");
if (nfq_bind_pf(h, AF_INET) < 0) {
fprintf(stderr, "error during nfq_bind_pf()\n");
exit(1);
}
printf("binding this socket to queue '%d'\n", queue);
qh = nfq_create_queue(h, queue, &cb, NULL);
if (!qh) {
fprintf(stderr, "error during nfq_create_queue()\n");
exit(1);
}
printf("setting copy_packet mode\n");
if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
fprintf(stderr, "can't set packet_copy mode\n");
exit(1);
}
printf("setting flags to request UID and GID\n");
if (nfq_set_queue_flags(qh, NFQA_CFG_F_UID_GID, NFQA_CFG_F_UID_GID)) {
fprintf(stderr, "This kernel version does not allow to "
"retrieve process UID/GID.\n");
}
printf("setting flags to request security context\n");
if (nfq_set_queue_flags(qh, NFQA_CFG_F_SECCTX, NFQA_CFG_F_SECCTX)) {
fprintf(stderr, "This kernel version does not allow to "
"retrieve security context.\n");
}
printf("Waiting for packets...\n");
fd = nfq_fd(h);
for (;;) {
if ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0) {
printf("pkt received\n");
nfq_handle_packet(h, buf, rv);
continue;
}
/* if your application is too slow to digest the packets that
* are sent from kernel-space, the socket buffer that we use
* to enqueue packets may fill up returning ENOBUFS. Depending
* on your application, this error may be ignored. Please, see
* the doxygen documentation of this library on how to improve
* this situation.
*/
if (rv < 0 && errno == ENOBUFS) {
printf("losing packets!\n");
continue;
}
perror("recv failed");
break;
}
printf("unbinding from queue 0\n");
nfq_destroy_queue(qh);
#ifdef INSANE
/* normally, applications SHOULD NOT issue this command, since
* it detaches other programs/sockets from AF_INET, too ! */
printf("unbinding from AF_INET\n");
nfq_unbind_pf(h, AF_INET);
#endif
printf("closing library handle\n");
nfq_close(h);
exit(0);
}
nfq_unbind_pf
int nfq_unbind_pf(struct nfq_handle *h, uint16_t pf)
Definition libnetfilter_queue.c:490
nfq_open
struct nfq_handle * nfq_open(void)
Definition libnetfilter_queue.c:363
nfq_bind_pf
int nfq_bind_pf(struct nfq_handle *h, uint16_t pf)
Definition libnetfilter_queue.c:474
nfq_close
int nfq_close(struct nfq_handle *h)
Definition libnetfilter_queue.c:452
nfq_get_secctx
int nfq_get_secctx(struct nfq_data *nfad, unsigned char **secdata)
Definition libnetfilter_queue.c:1298
nfq_get_packet_hw
struct nfqnl_msg_packet_hw * nfq_get_packet_hw(struct nfq_data *nfad)
Definition libnetfilter_queue.c:1207
nfq_get_physoutdev
uint32_t nfq_get_physoutdev(struct nfq_data *nfad)
Definition libnetfilter_queue.c:1072
nfq_get_physindev
uint32_t nfq_get_physindev(struct nfq_data *nfad)
Definition libnetfilter_queue.c:1042
nfq_get_gid
int nfq_get_gid(struct nfq_data *nfad, uint32_t *gid)
Definition libnetfilter_queue.c:1277
nfq_get_nfmark
uint32_t nfq_get_nfmark(struct nfq_data *nfad)
Definition libnetfilter_queue.c:987
nfq_get_msg_packet_hdr
struct nfqnl_msg_packet_hdr * nfq_get_msg_packet_hdr(struct nfq_data *nfad)
Definition libnetfilter_queue.c:974
nfq_get_uid
int nfq_get_uid(struct nfq_data *nfad, uint32_t *uid)
Definition libnetfilter_queue.c:1256
nfq_get_outdev
uint32_t nfq_get_outdev(struct nfq_data *nfad)
Definition libnetfilter_queue.c:1056
nfq_get_indev
uint32_t nfq_get_indev(struct nfq_data *nfad)
Definition libnetfilter_queue.c:1028
nfq_get_payload
int nfq_get_payload(struct nfq_data *nfad, unsigned char **data)
Definition libnetfilter_queue.c:1324
nfq_fd
int nfq_fd(struct nfq_handle *h)
Definition libnetfilter_queue.c:308
nfq_destroy_queue
int nfq_destroy_queue(struct nfq_q_handle *qh)
Definition libnetfilter_queue.c:585
nfq_create_queue
struct nfq_q_handle * nfq_create_queue(struct nfq_handle *h, uint16_t num, nfq_callback *cb, void *data)
Definition libnetfilter_queue.c:538
nfq_set_verdict
int nfq_set_verdict(struct nfq_q_handle *qh, uint32_t id, uint32_t verdict, uint32_t data_len, const unsigned char *buf)
Definition libnetfilter_queue.c:856
nfq_handle_packet
int nfq_handle_packet(struct nfq_handle *h, char *buf, int len)
Definition libnetfilter_queue.c:609
nfq_set_mode
int nfq_set_mode(struct nfq_q_handle *qh, uint8_t mode, uint32_t range)
Definition libnetfilter_queue.c:630
nfq_set_queue_flags
int nfq_set_queue_flags(struct nfq_q_handle *qh, uint32_t mask, uint32_t flags)
Definition libnetfilter_queue.c:719