NFQUEUE handler source example

NFQUEUE handler source example

[Mike Herms]

Short question:
Does anyone have example source code for user land handling of packets
off of NFQUEUE in a bridged environment?  I believe that I've
successfully created a bridged environment as follows:
============================
ifconfig eth0 promisc up
ifconfig eth0 promisc up
brctl addbr br0
brctl stp br0 off
brctl setbridgeprio br0 2
brctl addif br0 eth0
brctl addif br0 eth1
ifconfig br0 0.0.0.0

echo 1 > /proc/sys/net/ipv4/ip_forward
============================
Using the above configuration and connecting my box between two
networks or a network and a client computer works great.  Both sides
work and the bridge appears transparent to them.

I try to handle packets in my userland application by sending them to
an NFQUEUE using:
============================
sudo iptables -t mangle -A FORWARD -m physdev --physdev-in eth0 -j
NFQUEUE --queue-num 0
sudo iptables -t mangle -A FORWARD -m physdev --physdev-in eth1 -j
NFQUEUE --queue-num 0
============================

After I create the above two rules traffic no longer gets through the
bridge, as I'd suspect since it must now be handled by someone reading
from the NFQUEUE.

============================
sudo iptables -t mangle --list -v
============================
Shows packets reaching both physical devices.  My problem is I cannot
get my application to get a notification that something is in the
queue so it can be handled.  I'm can post my source but a working
skeleton example would get me there just as quickly without people
debugging my code.

Version information:
bridge-utils v1.2
iptables v1.4.0
ebtables v2.0.8-1 (May 2007
arptables v0.0.3-3

Thanks,
Mike Herms

Re: NFQUEUE handler source example

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 685 bytes --]

Hello,

On Tuesday, 2008 April 22 at 10:04:18 -0400, Mike Herms wrote:
> Short question:
> Does anyone have example source code for user land handling of packets
> off of NFQUEUE in a bridged environment?  I believe that I've
> successfully created a bridged environment as follows:
...
> Version information:
> bridge-utils v1.2
> iptables v1.4.0
> ebtables v2.0.8-1 (May 2007
> arptables v0.0.3-3

Which kernel do you use, we did not succeed in queueing packet on 2.6.22
but 2.6.24 was clean. The effect was the same as your: no routed packet as
soon as NFQUEUE application is launched.

BR,
-- 
Eric Leblond
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: NFQUEUE handler source example

[Mike Herms]

On Tue, Apr 22, 2008 at 4:17 PM, Eric Leblond <eric@inl.fr> wrote:
> Hello,
>
>
>  On Tuesday, 2008 April 22 at 10:04:18 -0400, Mike Herms wrote:
>  > Short question:
>  > Does anyone have example source code for user land handling of packets
>  > off of NFQUEUE in a bridged environment?  I believe that I've
>  > successfully created a bridged environment as follows:
>  ...
>
> > Version information:
>  > bridge-utils v1.2
>  > iptables v1.4.0
>  > ebtables v2.0.8-1 (May 2007
>  > arptables v0.0.3-3
>
>  Which kernel do you use, we did not succeed in queueing packet on 2.6.22
>  but 2.6.24 was clean. The effect was the same as your: no routed packet as
>  soon as NFQUEUE application is launched.

Thanks for the lead.  My kernel is the current for Ubuntu 7.10, which
is 2.6.22-14.  I'll check out my stuff on a newer kernel.

BTW, I'd still love to have a source code example if anyone is willing to share.

Mike

Re: NFQUEUE handler source example

[Eric Leblond]

[-- Attachment #1: Type: text/plain, Size: 669 bytes --]

Hello,

On Tuesday, 2008 April 22 at 16:43:53 -0400, Mike Herms wrote:
> On Tue, Apr 22, 2008 at 4:17 PM, Eric Leblond <eric@inl.fr> wrote:
> > Hello,
> >
> 
> Thanks for the lead.  My kernel is the current for Ubuntu 7.10, which
> is 2.6.22-14.  I'll check out my stuff on a newer kernel.
> 
> BTW, I'd still love to have a source code example if anyone is willing to share.

NuFW is working fine (with a 2.6.24 kernel) on a bridge setup.
http://docs.nufw.org/doxygen/trunk/html/packetsrv_8c-source.html#l00373

In fact, there is no change between the different subsystem.

BR,
-- 
Eric Leblond
INL: http://www.inl.fr/
NuFW: http://www.nufw.org/

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]