Re: [RFC] libnfnetlink and iface conversion to string

[Eric Leblond <eric@inl.fr>]

[-- Attachment #1.1: Type: text/plain, Size: 1063 bytes --]

Hi,

Le jeudi 28 décembre 2006 à 18:39 +0100, Pablo Neira Ayuso a écrit :
> Eric Leblond wrote:
> > I'm currently working on NuFW where I try to do iface conversion from
> > integer to string to be able to filter "naturally" on interfaces.
> Interesting question. Since this is related with the rtnetlink
> subsystem, I'm unsure that this feature naturally belongs to
> libnfnetlink nor to libnetfilter_queue.

I agree that this does not seem to be the correct place.

> However, IMO libnetfilter_queue should provide enough features to let
> userspace apps implement filtering without requiring extra dependencies.
> BTW, what are the benefits of dumping the index instead of the interface
> name in this particular case?

This is interesting !

I've looked at kernel code and the information was easy to add. I attach
a small patch against kernel.

It will add 4*IFNAMSIZ = 64 octets to each nfnetlink_queue message but
this is not impressive as a part of the packet payload is usually sent.

BR,
-- 
Eric Leblond <eric@inl.fr>
INL

[-- Attachment #1.2: nfnetlink_queue-iface-name.diff --]
[-- Type: text/x-patch, Size: 3609 bytes --]

diff --git a/include/linux/netfilter/nfnetlink_queue.h b/include/linux/netfilter/nfnetlink_queue.h
index 83e7896..8318105 100644
--- a/include/linux/netfilter/nfnetlink_queue.h
+++ b/include/linux/netfilter/nfnetlink_queue.h
@@ -41,6 +41,10 @@ enum nfqnl_attr_type {
 	NFQA_IFINDEX_PHYSOUTDEV,	/* u_int32_t ifindex */
 	NFQA_HWADDR,			/* nfqnl_msg_packet_hw */
 	NFQA_PAYLOAD,			/* opaque data payload */
+	NFQA_IFNAME_INDEV,		/* string name of iface */
+	NFQA_IFNAME_OUTDEV,		/*  string name of iface  */
+	NFQA_IFNAME_PHYSINDEV,		/* string name of iface */
+	NFQA_IFNAME_PHYSOUTDEV,	/* string name of iface */
 
 	__NFQA_MAX
 };
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index a88a017..9b86b9d 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -424,6 +424,7 @@ #endif
 		tmp_uint = htonl(indev->ifindex);
 #ifndef CONFIG_BRIDGE_NETFILTER
 		NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint), &tmp_uint);
+		NFA_PUT(skb, NFQA_IFNAME_INDEV, IFNAMSIZ, indev->name);
 #else
 		if (entinf->pf == PF_BRIDGE) {
 			/* Case 1: indev is physical input device, we need to
@@ -431,20 +432,28 @@ #else
 			 * netfilter_bridge) */
 			NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV, sizeof(tmp_uint), 
 				&tmp_uint);
+			NFA_PUT(skb, NFQA_IFNAME_PHYSINDEV, IFNAMSIZ,
+				indev->name);
 			/* this is the bridge group "brX" */
 			tmp_uint = htonl(indev->br_port->br->dev->ifindex);
 			NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
 				&tmp_uint);
+			NFA_PUT(skb, NFQA_IFNAME_INDEV, IFNAMSIZ,
+				indev->name);
 		} else {
 			/* Case 2: indev is bridge group, we need to look for
 			 * physical device (when called from ipv4) */
 			NFA_PUT(skb, NFQA_IFINDEX_INDEV, sizeof(tmp_uint),
 				&tmp_uint);
+			NFA_PUT(skb, NFQA_IFNAME_INDEV, IFNAMSIZ,
+				indev->name);
 			if (entskb->nf_bridge
 			    && entskb->nf_bridge->physindev) {
 				tmp_uint = htonl(entskb->nf_bridge->physindev->ifindex);
 				NFA_PUT(skb, NFQA_IFINDEX_PHYSINDEV,
 					sizeof(tmp_uint), &tmp_uint);
+				NFA_PUT(skb, NFQA_IFNAME_PHYSINDEV, IFNAMSIZ,
+					entskb->nf_bridge->physindev->name);
 			}
 		}
 #endif
@@ -454,6 +463,7 @@ #endif
 		tmp_uint = htonl(outdev->ifindex);
 #ifndef CONFIG_BRIDGE_NETFILTER
 		NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint), &tmp_uint);
+		NFA_PUT(skb, NFQA_IFNAME_OUTDEV, IFNAMSIZ, outdev->name);
 #else
 		if (entinf->pf == PF_BRIDGE) {
 			/* Case 1: outdev is physical output device, we need to
@@ -461,20 +471,28 @@ #else
 			 * netfilter_bridge) */
 			NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV, sizeof(tmp_uint),
 				&tmp_uint);
+			NFA_PUT(skb, NFQA_IFNAME_PHYSOUTDEV, IFNAMSIZ,
+				outdev->name);
 			/* this is the bridge group "brX" */
 			tmp_uint = htonl(outdev->br_port->br->dev->ifindex);
 			NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
 				&tmp_uint);
+			NFA_PUT(skb, NFQA_IFNAME_OUTDEV, IFNAMSIZ,
+				outdev->name);
 		} else {
 			/* Case 2: outdev is bridge group, we need to look for
 			 * physical output device (when called from ipv4) */
 			NFA_PUT(skb, NFQA_IFINDEX_OUTDEV, sizeof(tmp_uint),
 				&tmp_uint);
+			NFA_PUT(skb, NFQA_IFNAME_OUTDEV, IFNAMSIZ,
+				outdev->name);
 			if (entskb->nf_bridge
 			    && entskb->nf_bridge->physoutdev) {
 				tmp_uint = htonl(entskb->nf_bridge->physoutdev->ifindex);
 				NFA_PUT(skb, NFQA_IFINDEX_PHYSOUTDEV,
 					sizeof(tmp_uint), &tmp_uint);
+				NFA_PUT(skb, NFQA_IFNAME_PHYSOUTDEV, IFNAMSIZ,
+					entskb->nf_bridge->physoutdev->name);
 			}
 		}
 #endif

[-- Attachment #2: Ceci est une partie de message numériquement signée --]
[-- Type: application/pgp-signature, Size: 189 bytes --]