* Modifying NFQUEUE rules in flight
@ 2017-03-14 1:18 W. Michael Petullo
2017-03-14 8:08 ` Eric Leblond
0 siblings, 1 reply; 2+ messages in thread
From: W. Michael Petullo @ 2017-03-14 1:18 UTC (permalink / raw)
To: netfilter
I have a question about the use of NFQUEUE from userspace.
Imagine two firewall rules:
(A): NFQUEUE tcp -- imp x.x.x.x tcp dpt:http NFQUEUE num 0
and
(B): NFQUEUE tcp -- imp x.x.x.x tcp dpt:http NFQUEUE num 1
I am interested in making the callback associated with rule (A)/NFQUEUE 0
remove rule (B) and replace it (usng firewalld/dbus in my case)
with another, more specific rule. For example, perhaps the callback for
NFQUEUE 0 would rewrite rule (B) to include a source port. I am further
interested in having this new rule apply to the packet being processed.
Is this type of modification in flight possible? By the time the callback
for (A)/NFQUEUE 0 is invoked, the kernel is obviously processing a packet
through the rule chain. In my experiments I have not been able to modify
the chain such that the kernel continues to push the packet through the
modified chain.
I assume that if this is possible it requires the proper use of NF_QUEUE,
NF_STOLEN, and so on. However, I have not yet come across a clear
description of the meaning of these values with respect to libnetfilter.
I can instead get what I want by copying some of the functionality in
(B)'s callback to (A)'s callback. However, the two callbacks really do
two different things, and futher (A) exists only for a short time. For
these reasons, I am trying to move the code to something which resembles
what I describe above.
Any comments would be helpful.
Thank you,
--
Mike
:wq
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Modifying NFQUEUE rules in flight
2017-03-14 1:18 Modifying NFQUEUE rules in flight W. Michael Petullo
@ 2017-03-14 8:08 ` Eric Leblond
0 siblings, 0 replies; 2+ messages in thread
From: Eric Leblond @ 2017-03-14 8:08 UTC (permalink / raw)
To: W. Michael Petullo, netfilter
Hi,
On Mon, 2017-03-13 at 21:18 -0400, W. Michael Petullo wrote:
> I have a question about the use of NFQUEUE from userspace.
>
> Imagine two firewall rules:
>
> (A): NFQUEUE tcp -- imp x.x.x.x tcp dpt:http NFQUEUE num 0
>
> and
>
> (B): NFQUEUE tcp -- imp x.x.x.x tcp dpt:http NFQUEUE num 1
>
> I am interested in making the callback associated with rule
> (A)/NFQUEUE 0
> remove rule (B) and replace it (usng firewalld/dbus in my case)
> with another, more specific rule. For example, perhaps the callback
> for
> NFQUEUE 0 would rewrite rule (B) to include a source port. I am
> further
> interested in having this new rule apply to the packet being
> processed.
I don't think you can do this. What you could do a push a packet mark
at verdict time on rule A. With a filter on mark on rule B, it will
only match when rule A wants it to match.
BR,
--
Eric Leblond <eric@regit.org>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-14 8:08 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-03-14 1:18 Modifying NFQUEUE rules in flight W. Michael Petullo
2017-03-14 8:08 ` Eric Leblond
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.