utils/nfqnl_test.c

   1
   2 #include <stdio.h>
   3 #include <stdlib.h>
   4 #include <unistd.h>
   5 #include <netinet/in.h>
   6 #include <linux/types.h>
   7 #include <linux/netfilter.h>            /* for NF_ACCEPT */
   8 #include <errno.h>
   9
  10 #include <libnetfilter_queue/libnetfilter_queue.h>
  11
  12 /* returns packet id */
  13 static u_int32_t print_pkt (struct nfq_data *tb)
  14 {
  15         int id = 0;
  16         struct nfqnl_msg_packet_hdr *ph;
  17         struct nfqnl_msg_packet_hw *hwph;
  18         u_int32_t mark,ifi;
  19         int ret;
  20         unsigned char *data;
  21
  22         ph = nfq_get_msg_packet_hdr(tb);
  23         if (ph) {
  24                 id = ntohl(ph->packet_id);
  25                 printf("hw_protocol=0x%04x hook=%u id=%u ",
  26                         ntohs(ph->hw_protocol), ph->hook, id);
  27         }
  28
  29         hwph = nfq_get_packet_hw(tb);
  30         if (hwph) {
  31                 int i, hlen = ntohs(hwph->hw_addrlen);
  32
  33                 printf("hw_src_addr=");
  34                 for (i = 0; i < hlen-1; i++)
  35                         printf("%02x:", hwph->hw_addr[i]);
  36                 printf("%02x ", hwph->hw_addr[hlen-1]);
  37         }
  38
  39         mark = nfq_get_nfmark(tb);
  40         if (mark)
  41                 printf("mark=%u ", mark);
  42
  43         ifi = nfq_get_indev(tb);
  44         if (ifi)
  45                 printf("indev=%u ", ifi);
  46
  47         ifi = nfq_get_outdev(tb);
  48         if (ifi)
  49                 printf("outdev=%u ", ifi);
  50         ifi = nfq_get_physindev(tb);
  51         if (ifi)
  52                 printf("physindev=%u ", ifi);
  53
  54         ifi = nfq_get_physoutdev(tb);
  55         if (ifi)
  56                 printf("physoutdev=%u ", ifi);
  57
  58         ret = nfq_get_payload(tb, &data);
  59         if (ret >= 0)
  60                 printf("payload_len=%d ", ret);
  61
  62         fputc('\n', stdout);
  63
  64         return id;
  65 }
  66
  67
  68 static int cb(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
  69               struct nfq_data *nfa, void *data)
  70 {
  71         u_int32_t id = print_pkt(nfa);
  72         printf("entering callback\n");
  73         return nfq_set_verdict(qh, id, NF_ACCEPT, 0, NULL);
  74 }
  75
  76 int main(int argc, char **argv)
  77 {
  78         struct nfq_handle *h;
  79         struct nfq_q_handle *qh;
  80         struct nfnl_handle *nh;
  81         int fd;
  82         int rv;
  83         char buf[4096] __attribute__ ((aligned));
  84
  85         printf("opening library handle\n");
  86         h = nfq_open();
  87         if (!h) {
  88                 fprintf(stderr, "error during nfq_open()\n");
  89                 exit(1);
  90         }
  91
  92         printf("unbinding existing nf_queue handler for AF_INET (if any)\n");
  93         if (nfq_unbind_pf(h, AF_INET) < 0) {
  94                 fprintf(stderr, "error during nfq_unbind_pf()\n");
  95                 exit(1);
  96         }
  97
  98         printf("binding nfnetlink_queue as nf_queue handler for AF_INET\n");
  99         if (nfq_bind_pf(h, AF_INET) < 0) {
 100                 fprintf(stderr, "error during nfq_bind_pf()\n");
 101                 exit(1);
 102         }
 103
 104         printf("binding this socket to queue '0'\n");
 105         qh = nfq_create_queue(h,  0, &cb, NULL);
 106         if (!qh) {
 107                 fprintf(stderr, "error during nfq_create_queue()\n");
 108                 exit(1);
 109         }
 110
 111         printf("setting copy_packet mode\n");
 112         if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
 113                 fprintf(stderr, "can't set packet_copy mode\n");
 114                 exit(1);
 115         }
 116
 117         fd = nfq_fd(h);
 118
 119         for (;;) {
 120                 if ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0) {
 121                         printf("pkt received\n");
 122                         nfq_handle_packet(h, buf, rv);
 123                         continue;
 124                 }
 125                 /* if your application is too slow to digest the packets that
 126                  * are sent from kernel-space, the socket buffer that we use
 127                  * to enqueue packets may fill up returning ENOBUFS. Depending
 128                  * on your application, this error may be ignored. Please, see
 129                  * the doxygen documentation of this library on how to improve
 130                  * this situation.
 131                  */
 132                 if (rv < 0 && errno == ENOBUFS) {
 133                         printf("losing packets!\n");
 134                         continue;
 135                 }
 136                 perror("recv failed");
 137                 break;
 138         }
 139
 140         printf("unbinding from queue 0\n");
 141         nfq_destroy_queue(qh);
 142
 143 #ifdef INSANE
 144         /* normally, applications SHOULD NOT issue this command, since
 145          * it detaches other programs/sockets from AF_INET, too ! */
 146         printf("unbinding from AF_INET\n");
 147         nfq_unbind_pf(h, AF_INET);
 148 #endif
 149
 150         printf("closing library handle\n");
 151         nfq_close(h);
 152
 153         exit(0);
 154 }