nf-queue.c as an example of libnetfilter_queue

nf-queue.c as an example of libnetfilter_queue

[Flavio Poletti]

Hello All,

    I was curious about NFQUEUE/QUEUE targets for iptables and I
eventually landed on libnetfilter_queue.

As documented by the doxygen stuff online, the library provides some
functions (e.g. nfq_open(), nfq_handle_packet(), nfq_set_verdict(),
etc.).

On the other hand, the example nf-queue.c program in the examples
directory does not seem to use these functions at all.

Is there some place where I can find out some examples of usage of
libnetfilter_queue functions? Are they deprecated and should I go for
the Netlink-based solution as in the example?

Thank you,

    Flavio.

Re: nf-queue.c as an example of libnetfilter_queue

[Flavio Poletti]

Hi,

The example file nf-queue.c program in the examples
directory does not seem to use the functions in the library at all.

Are they deprecated in favor of something else?

This is a repetition of a question I sent some 10 days ago, sorry for
bothering again
but I'm interested into this. Anyway I won't post it again if I get no
answers, please
accept apologies in advance if inconvenient.

Thanks,

    Flavio.

Re: nf-queue.c as an example of libnetfilter_queue

[Pablo Neira Ayuso]

On Tue, Apr 23, 2013 at 02:13:22AM +0200, Flavio Poletti wrote:
> Hi,
> 
> The example file nf-queue.c program in the examples
> directory does not seem to use the functions in the library at all.
> 
> Are they deprecated in favor of something else?
> 
> This is a repetition of a question I sent some 10 days ago, sorry
> for bothering again but I'm interested into this. Anyway I won't
> post it again if I get no answers, please accept apologies in
> advance if inconvenient.

Both APIs are currently supported, nf-queue uses libmnl. The former
uses the old libnfnetlink. I needed a rather more flexible API for the
connection tracking support in user-space in conntrackd over libmnl.

The new API also provides also helpers for ipv4, ipv6, tcp and udp,
which seems to be a common requirement for everyone. See the
libnetfilter_queue/src/extra/ directory in case you want to check
implementation details.

You can generate up to date doxygen documentation with the following
command:

libnetfilter_queue$ doxygen doxygen.cfg

Regards.