CAN you give me a piece of sample code to implement this iptables command? thanks

CAN you give me a piece of sample code to implement this iptables command? thanks

[cyx]

HI, all:

the command is "iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE"

how to write the code using libiptc to implement this? It is hard to get enough useful information about programing with libiptc APIs, so can you give me the sample code ? thanks a lot!

Re: CAN you give me a piece of sample code to implement this iptables command? thanks

[Patrick McHardy]

cyx wrote:
> HI, all:
> 
> the command is "iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE"
> 
> how to write the code using libiptc to implement this? It is hard to get enough useful information about programing with libiptc APIs, so can you give me the sample code ? thanks a lot!


libiptc doesn't provide a API for external programs, its purely
for iptables use. You *can* use it (at least some people do),
but we give no guarantees that it stays stable and additionally
it used to leak memory (not sure about the state today).

Re: Re: CAN you give me a piece of sample code to implement this iptablescommand? thanks

[cyx]

So there is no APIs we can use to manipulate the kernel's iptables, except invoking the "iptables" command from shell? so wired, it should be have some APIs to do the same as the "iptables" does.          

2008-05-11                    



发件人： Patrick McHardy 
发送时间： 2008-05-11  23:26:42 
收件人： cyx 
抄送： netfilter-devel 
主题： Re: CAN you give me a piece of sample code to implement this iptablescommand? thanks 
 
cyx wrote:
> HI, all:
> 
> the command is "iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE"
> 
> how to write the code using libiptc to implement this? It is hard to get enough useful information about programing with libiptc APIs, so can you give me the sample code ? thanks a lot!
libiptc doesn't provide a API for external programs, its purely
for iptables use. You *can* use it (at least some people do),
but we give no guarantees that it stays stable and additionally
it used to leak memory (not sure about the state today).
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
__________ NOD32 3040 (20080419) Information __________
This message was checked by NOD32 antivirus system.
http://www.nod32cn.com

Re: Re: CAN you give me a piece of sample code to implement this iptablescommand? thanks

[Henrik Nordstrom]

On sön, 2008-05-11 at 23:47 +0800, cyx wrote:
> So there is no APIs we can use to manipulate the kernel's iptables,
> except invoking the "iptables" command from shell? so wired, it should
> be have some APIs to do the same as the "iptables" does.          

A pipe to iptables-restore -n is generally the recommended API. Gives
you the full command line of iptables in an reasonably efficient manner.

*nat
-A POSTROUTING -o ppp0 -j MASQUERADE
COMMIT

You may want to restart iptables-restore from time to time just in case
there is memory leaks somewhere, but other than that the pipe can stay
persistent, at least until there is an error in the submitted rules
(causes iptables-restore to exit with an error)

What is missing is an efficient way to read out rules from the kernel.
iptables-restore can only read the human intented version (-L), and
iptables-save is a little too blunt in what it dumps for many purposes..

Regards
Henrik



--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: CAN you give me a piece of sample code to implement this iptablescommand? thanks

[Patrick McHardy]

cyx wrote:
> So there is no APIs we can use to manipulate the kernel's iptables, except invoking the "iptables" command from shell? so wired, it should be have some APIs to do the same as the "iptables" does.          

Unfortunately not, at least not for C. There is a perl-API,
but I forgot its name.

Re: CAN you give me a piece of sample code to implement this iptablescommand? thanks

[Jan Engelhardt]

On Monday 2008-05-12 17:59, Patrick McHardy wrote:
> cyx wrote:
>> So there is no APIs we can use to manipulate the kernel's iptables, except
>> invoking the "iptables" command from shell? so wired, it should be have some
>> APIs to do the same as the "iptables" does.          
>
> Unfortunately not, at least not for C. There is a perl-API,
> but I forgot its name.

Why does everything need a C API? head, tail, grep, sort, are all shell
utilities without a C API yet they are used in an API-like fashion
by the user:

	ls | grep foo | sort -r | tail -n 1

so I do not see anything wrong -- especially now that Henrik presented
his patches -- to do the same with iptables. And it is not really
hard to use pipe() from C.