Re: libipq bug on 2.6.4 ?

Re: libipq bug on 2.6.4 ?

[Pablo Neira]

Hi David,

AFAIK, this is not a bug, actually if a packet passes by OUTPUT, it 
means that this is locally generated traffic:

Local machine ---> OUTPUT ----> POSTROUTING

to be exact, this packet is still in level 3 (network), so it doesn't 
know anything about layer 2 (link, it implies MAC address), that 
information would be added later when passed to layer 2.

On the other hand, if you add that rule in INPUT, it has the information 
about MAC and stuff because it is traversing the stack in the opposite 
sense as described above.

regards,
Pablo

DAVID Thomas wrote:

>hi all,
>i'm a computer student, and I've found a strange behaviour when using
>ip_queue with iptables v1.2.9 on a 2.6.4 kernel.I've written s very simple code, which only displays a ipq_packet_msg_t
>structure. The code is at the end of this mail.
>When i use this rule : iptables -A INPUT -j QUEUE and i've got no problem
>do display the structure.But when i use this rule : iptables -A OUTPUT -j QUEUE, the strucuture is
>not complete. For example :
>Id Packet : 204
>Ip_filter Mark: 0
>Hook : 3
>Indev :
>Outdev : eth0
>HW Protocol : 0000
>HW Type : 0
>HW Addr Len : 0
>HW Address : 00:00:00:00:00:00
>Len data : 1331
>
>I hope I didn't forget something, but I think there is a problem here
>
>DAVID Thomas
>
>Here is the code :
>
>#include <linux/netfilter.h>
>#include <libipq/libipq.h>
>#include <stdio.h>
>
>#define BUFSIZE 2048
>
>static void die(struct ipq_handle *h)
>{
>  ipq_perror("passer");
>  ipq_destroy_handle(h);
>  exit(1);
>}
>
>int main(int argc, char **argv)
>{
>  int status;
>  unsigned char buf[BUFSIZE];
>  struct ipq_handle *h;
>
>  h = ipq_create_handle(0, PF_INET);
>  if (!h)
>    die(h);
>
>  status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE);
>  if (status < 0)
>    die(h);
>
>  do{
>    status = ipq_read(h, buf, BUFSIZE, 0);
>    if (status < 0)
>      die(h);
>
>    switch (ipq_message_type(buf)) {
>    case NLMSG_ERROR:
>      fprintf(stderr, "Received error message %d\n",
>	      ipq_get_msgerr(buf));
>      break;
>
>    case IPQM_PACKET: {
>      ipq_packet_msg_t *m = ipq_get_packet(buf);
>
>      status = ipq_set_verdict(h, m->packet_id,
>			       NF_ACCEPT, 0, NULL);
>      printf("Id Packet : %d\n", ntohs(m->packet_id));
>      printf("Ip_filter Mark: %x\n", m->mark);
>      printf("Hook : %d\n", m->hook);
>      printf("Indev : %s\n", m->indev_name);
>      printf("Outdev : %s\n", m->outdev_name);
>      printf("HW Protocol : %.4x\n", ntohs(m->hw_protocol));
>      printf("HW Type : %x\n", m->hw_protocol);
>      printf("HW Addr Len : %d\n",ntohs(m->hw_addrlen));
>      printf("HW Address : %02X:%02X:%02X:%02X:%02X:%02X\n",
>      m->hw_addr[0], m->hw_addr[1],	     m->hw_addr[2], m->hw_addr[3], m->hw_addr[4], m->hw_addr[5]);
>      printf("Len data : %d\n", ntohs(m->data_len));
>      printf("\n");
>      if (status < 0)
>	die(h);
>      break;
>    }
>
>    default:
>      fprintf(stderr, "Unknown message type!\n");
>      break;
>    }
>  } while (1);
>
>  ipq_destroy_handle(h);
>  return 0;
>}
>
>
>
>-
>To unsubscribe from this list: send the line "unsubscribe linux-net" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html
>
>  
>

Re: libipq bug on 2.6.4 ?

[Pablo Neira]

Hi David,

AFAIK, this is not a bug, actually if a packet passes by OUTPUT, it
means that this is locally generated traffic:

Local machine ---> OUTPUT ----> POSTROUTING

to be exact, this packet is still in level 3 (network), so it doesn't
know anything about layer 2 (link, it implies MAC address), that
information would be added later when passed to layer 2.

On the other hand, if you add that rule in INPUT, it has the information
about MAC and stuff because it is traversing the stack in the opposite
sense as described above.

regards,
Pablo

DAVID Thomas wrote:

 >hi all,
 >i'm a computer student, and I've found a strange behaviour when using
 >ip_queue with iptables v1.2.9 on a 2.6.4 kernel.I've written s very 
simple code, which only displays a ipq_packet_msg_t
 >structure. The code is at the end of this mail.
 >When i use this rule : iptables -A INPUT -j QUEUE and i've got no problem
 >do display the structure.But when i use this rule : iptables -A OUTPUT 
-j QUEUE, the strucuture is
 >not complete. For example :
 >Id Packet : 204
 >Ip_filter Mark: 0
 >Hook : 3
 >Indev :
 >Outdev : eth0
 >HW Protocol : 0000
 >HW Type : 0
 >HW Addr Len : 0
 >HW Address : 00:00:00:00:00:00
 >Len data : 1331
 >
 >I hope I didn't forget something, but I think there is a problem here
 >
 >DAVID Thomas
 >
 >Here is the code :
 >
 >#include <linux/netfilter.h>
 >#include <libipq/libipq.h>
 >#include <stdio.h>
 >
 >#define BUFSIZE 2048
 >
 >static void die(struct ipq_handle *h)
 >{
 >  ipq_perror("passer");
 >  ipq_destroy_handle(h);
 >  exit(1);
 >}
 >
 >int main(int argc, char **argv)
 >{
 >  int status;
 >  unsigned char buf[BUFSIZE];
 >  struct ipq_handle *h;
 >
 >  h = ipq_create_handle(0, PF_INET);
 >  if (!h)
 >    die(h);
 >
 >  status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE);
 >  if (status < 0)
 >    die(h);
 >
 >  do{
 >    status = ipq_read(h, buf, BUFSIZE, 0);
 >    if (status < 0)
 >      die(h);
 >
 >    switch (ipq_message_type(buf)) {
 >    case NLMSG_ERROR:
 >      fprintf(stderr, "Received error message %d\n",
 >	      ipq_get_msgerr(buf));
 >      break;
 >
 >    case IPQM_PACKET: {
 >      ipq_packet_msg_t *m = ipq_get_packet(buf);
 >
 >      status = ipq_set_verdict(h, m->packet_id,
 > 
		       NF_ACCEPT, 0, NULL);
 >      printf("Id Packet : %d\n", ntohs(m->packet_id));
 >      printf("Ip_filter Mark: %x\n", m->mark);
 >      printf("Hook : %d\n", m->hook);
 >      printf("Indev : %s\n", m->indev_name);
 >      printf("Outdev : %s\n", m->outdev_name);
 >      printf("HW Protocol : %.4x\n", ntohs(m->hw_protocol));
 >      printf("HW Type : %x\n", m->hw_protocol);
 >      printf("HW Addr Len : %d\n",ntohs(m->hw_addrlen));
 >      printf("HW Address : %02X:%02X:%02X:%02X:%02X:%02X\n",
 >      m->hw_addr[0], m->hw_addr[1],	     m->hw_addr[2], m->hw_addr[3], m->hw_addr[4], 
m->hw_addr[5]);
 >      printf("Len data : %d\n", ntohs(m->data_len));
 >      printf("\n");
 >      if (status < 0)
 >	die(h);
 >      break;
 >    }
 >
 >    default:
 >      fprintf(stderr, "Unknown message type!\n");
 >      break;
 >    }
 >  } while (1);
 >
 >  ipq_destroy_handle(h);
 >  return 0;
 >}
 >
 >
 >
 >-
 >To unsubscribe from this list: send the line "unsubscribe linux-net" in
 >the body of a message to majordomo@vger.kernel.org
 >More majordomo info at  http://vger.kernel.org/majordomo-info.html
 >
 >
 >