src: implement API to set per-queue flags

Implement API to set per-queue flags. This is initially used
to implement fail-open support in NFQUEUE.

[ Pablo mangled this patch to bump LIBVERSION as well ]

Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/include/libnetfilter_queue/libnetfilter_queue.h b/include/libnetfilter_queue/libnetfilter_queue.h
index 28bf2b1c3502095e0640a69184bbc6321c5693ff..6b8acd23d7fcfbe37336b64b992a726b7f478b00 100644 (file)
--- a/include/libnetfilter_queue/libnetfilter_queue.h
+++ b/include/libnetfilter_queue/libnetfilter_queue.h
@@ -56,6 +56,9 @@ extern int nfq_set_mode(struct nfq_q_handle *qh,
 int nfq_set_queue_maxlen(struct nfq_q_handle *qh,
                        u_int32_t queuelen);
 
+extern int nfq_set_queue_flags(struct nfq_q_handle *qh,
+                              uint32_t mask, uint32_t flags);
+
 extern int nfq_set_verdict(struct nfq_q_handle *qh,
                             u_int32_t id,
                             u_int32_t verdict,

diff --git a/include/libnetfilter_queue/linux_nfnetlink_queue.h b/include/libnetfilter_queue/linux_nfnetlink_queue.h
index 6b4f86ddc9386694aebdca0f9bc9dab8b3490bce..58c8ca504549ba04ecc08d8dc7ddfe4c612b09d3 100644 (file)
--- a/include/libnetfilter_queue/linux_nfnetlink_queue.h
+++ b/include/libnetfilter_queue/linux_nfnetlink_queue.h
@@ -87,8 +87,15 @@ enum nfqnl_attr_config {
        NFQA_CFG_CMD,                   /* nfqnl_msg_config_cmd */
        NFQA_CFG_PARAMS,                /* nfqnl_msg_config_params */
        NFQA_CFG_QUEUE_MAXLEN,          /* u_int32_t */
+       NFQA_CFG_MASK,                  /* identify which flags to change */
+       NFQA_CFG_FLAGS,                 /* value of these flags (__u32) */
        __NFQA_CFG_MAX
 };
 #define NFQA_CFG_MAX (__NFQA_CFG_MAX-1)
 
+/* Flags/options for NFQA_CFG_FLAGS */
+#define NFQA_CFG_F_FAIL_OPEN           (1 << 0)
+#define NFQA_CFG_F_CONNTRACK           (1 << 1)
+#define NFQA_CFG_F_MAX                 (1 << 2)
+
 #endif /* _NFNETLINK_QUEUE_H */

diff --git a/src/Makefile.am b/src/Makefile.am
index d49e738b601341f9d2a8603e58975012bbc9afdf..2196aef915d125fa04831bdcc241c4a4fbb26319 100644 (file)
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -18,7 +18,7 @@
 # set age to 0.
 # </snippet>
 #
-LIBVERSION=3:0:2
+LIBVERSION=4:0:3
 
 include ${top_srcdir}/Make_global.am
 

diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c
index d57a5233c2b1972eccb0253bfb73640cc7612eac..dcfc36d0a5e608f450ca369322c308d6b3a9de0b 100644 (file)
--- a/src/libnetfilter_queue.c
+++ b/src/libnetfilter_queue.c
@@ -601,6 +601,48 @@ int nfq_set_mode(struct nfq_q_handle *qh,
        return nfnl_query(qh->h->nfnlh, &u.nmh);
 }
 
+/**
+ * nfq_set_queue_flags - set flags (options) for the kernel queue
+ * \param qh Netfilter queue handle obtained by call to nfq_create_queue().
+ * \param mask specifies which flag bits to modify
+ * \param flag bitmask of flags
+ *
+ * Here's a little code snippet to show how to use this API:
+ * \verbatim
+       uint32_t flags = NFQA_CFG_F_FAIL_OPEN;
+       uint32_t mask = NFQA_CFG_F_FAIL_OPEN;
+
+       printf("Enabling fail-open on this q\n");
+       err = nfq_set_queue_flags(qh, mask, flags);
+
+       printf("Disabling fail-open on this q\n");
+       flags &= ~NFQA_CFG_F_FAIL_OPEN;
+       err = nfq_set_queue_flags(qh, mask, flags);
+\endverbatim
+ * \return -1 on error with errno set appropriately; =0 otherwise.
+ */
+int nfq_set_queue_flags(struct nfq_q_handle *qh,
+                       uint32_t mask, uint32_t flags)
+{
+       union {
+               char buf[NFNL_HEADER_LEN
+                       +NFA_LENGTH(sizeof(mask)
+                       +NFA_LENGTH(sizeof(flags)))];
+               struct nlmsghdr nmh;
+       } u;
+
+       mask = htonl(mask);
+       flags = htonl(flags);
+
+       nfnl_fill_hdr(qh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, qh->id,
+                     NFQNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK);
+
+       nfnl_addattr32(&u.nmh, sizeof(u), NFQA_CFG_FLAGS, flags);
+       nfnl_addattr32(&u.nmh, sizeof(u), NFQA_CFG_MASK, mask);
+
+       return nfnl_query(qh->h->nfnlh, &u.nmh);
+}
+
 /**
  * nfq_set_queue_maxlen - Set kernel queue maximum length parameter
  * \param qh Netfilter queue handle obtained by call to nfq_create_queue().