[lnf-log RFC PATCH 0/2] introduce new functions to use without nflog_handle

[lnf-log RFC PATCH 0/2] introduce new functions to use without nflog_handle

[Ken-ichirou MATSUZAWA]

 Hi,

I am trying to extend ulogd to introduce mmaped netlink socket. The
current libnetfilter_log can not be used since it presumes to use a
normal socket.

This patch adds new functions which can parse nlmsg without
nflog_handle. It would be helpful for me to be accepted to the
master, how about it?

Thanks,

[lnf-log RFC PATCH 1/2] introduce new functions to use without nflog_handle

[Ken-ichirou MATSUZAWA]

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 Make_global.am                              |  2 +-
 configure.ac                                |  1 +
 include/libnetfilter_log/libnetfilter_log.h |  6 ++
 src/Makefile.am                             |  4 +-
 src/libnetfilter_log.c                      | 43 ++++++++++++++
 src/nlmsg.c                                 | 89 +++++++++++++++++++++++++++++
 6 files changed, 142 insertions(+), 3 deletions(-)
 create mode 100644 src/nlmsg.c

diff --git a/Make_global.am b/Make_global.am
index a4e9bd9..9bc8ea1 100644
--- a/Make_global.am
+++ b/Make_global.am
@@ -1,2 +1,2 @@
-AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS}
+AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS} ${LIBMNL_CFLAGS}
 AM_CFLAGS = -Wall
diff --git a/configure.ac b/configure.ac
index cdcbc90..ead9399 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,6 +30,7 @@ AM_CONDITIONAL([BUILD_IPULOG], [test "x$with_ipulog" != xno])
 
 dnl Dependencies
 PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 0.0.41])
+PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 
 dnl Output the makefile
 AC_CONFIG_FILES([Makefile src/Makefile include/Makefile
diff --git a/include/libnetfilter_log/libnetfilter_log.h b/include/libnetfilter_log/libnetfilter_log.h
index 7812877..044f406 100644
--- a/include/libnetfilter_log/libnetfilter_log.h
+++ b/include/libnetfilter_log/libnetfilter_log.h
@@ -11,6 +11,7 @@
 
 #include <stdint.h>
 #include <sys/types.h>
+#include <linux/netlink.h>
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
 struct nflog_handle;
@@ -82,4 +83,9 @@ enum {
 
 extern int nflog_snprintf_xml(char *buf, size_t len, struct nflog_data *tb, int flags);
 
+extern struct nflog_data *nflog_data_alloc(void);
+extern void nflog_data_free(struct nflog_data *nfad);
+extern int nflog_nlmsg_parse_attrs(const struct nlmsghdr *nlh, struct nlattr **attr);
+extern int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nflog_data *nfad);
+
 #endif	/* __LIBNETFILTER_LOG_H */
diff --git a/src/Makefile.am b/src/Makefile.am
index 33933a4..aa56152 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -26,8 +26,8 @@ lib_LTLIBRARIES = libnetfilter_log.la
 
 libnetfilter_log_la_LDFLAGS = -Wc,-nostartfiles -lnfnetlink	\
 			      -version-info $(LIBVERSION)
-libnetfilter_log_la_SOURCES = libnetfilter_log.c 
-libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS}
+libnetfilter_log_la_SOURCES = libnetfilter_log.c nlmsg.c
+libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS} ${LIBMNL_LIBS}
 
 if BUILD_IPULOG
 lib_LTLIBRARIES += libnetfilter_log_libipulog.la
diff --git a/src/libnetfilter_log.c b/src/libnetfilter_log.c
index e92576b..422c550 100644
--- a/src/libnetfilter_log.c
+++ b/src/libnetfilter_log.c
@@ -26,6 +26,7 @@
 #include <errno.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
+#include <linux/netlink.h>
 
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
@@ -1067,5 +1068,47 @@ int nflog_snprintf_xml(char *buf, size_t rem, struct nflog_data *tb, int flags)
 }
 
 /**
+ * nflog_data_alloc - allocate a new nflog data
+ *
+ * In case of success, this function returns a valid pointer to a memory blob,
+ * otherwise NULL is returned and errno is set appropiately.
+ */
+struct nflog_data *nflog_data_alloc(void)
+{
+	struct nflog_data *nfad = calloc(1, sizeof(struct nflog_data));
+	if (nfad == NULL)
+		return NULL;
+	nfad->nfa = (struct nfattr **)calloc(NFULA_MAX + 1,
+					     sizeof(struct nlattr *));
+	if (nfad->nfa == NULL) {
+		free(nfad);
+		return NULL;
+	}
+	return nfad;
+}
+
+/**
+ * nflog_data_free - release a nflog data
+ * \param nfad pointer to the nflog data
+ */
+void nflog_data_free(struct nflog_data *nfad)
+{
+	free(nfad->nfa);
+	free(nfad);
+}
+
+/**
+ * nflog_nlmsg_parse - set packet attributes from netlink message
+ * \param nlh netlink message that you want to read.
+ * \param attr pointer to the nflog_data which is allocate by nflog_data_alloc
+ *
+ * This function returns MNL_CB_ERROR if any error occurs, or MNL_CB_OK on
+ * success.
+ */
+int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nflog_data *nfad)
+{
+	return nflog_nlmsg_parse_attrs(nlh, (struct nlattr **)&nfad->nfa[-1]);
+}
+/**
  * @}
  */
diff --git a/src/nlmsg.c b/src/nlmsg.c
new file mode 100644
index 0000000..8611b9d
--- /dev/null
+++ b/src/nlmsg.c
@@ -0,0 +1,89 @@
+/*
+ * (C) 2015 by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <linux/netfilter/nfnetlink_log.h>
+#include <libmnl/libmnl.h>
+
+/**
+ * \defgroup nlmsg Netlink message helper functions
+ * @{
+ */
+
+static int nflog_pkt_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	/* skip unsupported attribute in user-space */
+	if (mnl_attr_type_valid(attr, NFULA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFULA_HWTYPE:		/* hardware type */
+	case NFULA_HWLEN:		/* hardware header length */
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_MARK:		/* __u32 nfmark */
+	case NFULA_IFINDEX_INDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_OUTDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSINDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSOUTDEV:	/* __u32 ifindex */
+	case NFULA_UID:			/* user id of socket */
+	case NFULA_SEQ:			/* instance-local sequence number */
+	case NFULA_SEQ_GLOBAL:		/* global sequence number */
+	case NFULA_GID:			/* group id of socket */
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_PACKET_HDR:
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hdr)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_TIMESTAMP:		/* nfulnl_msg_packet_timestamp */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_timestamp)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_HWADDR:		/* nfulnl_msg_packet_hw */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hw)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_PREFIX:		/* string prefix */
+		if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_HWHEADER:		/* hardware header */
+	case NFULA_PAYLOAD:		/* opaque data payload */
+		break;
+	}
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+/**
+ * nflog_nlmsg_parse_attrs - set nlattrs from netlink message
+ * \param nlh netlink message that you want to read.
+ * \param attr pointer to the array of nlattr which size is NFULA_MAX + 1
+ *
+ * This function returns MNL_CB_ERROR if any error occurs, or MNL_CB_OK on
+ * success.
+ */
+int nflog_nlmsg_parse_attrs(const struct nlmsghdr *nlh, struct nlattr **attr)
+{
+	return mnl_attr_parse(nlh, sizeof(struct nfgenmsg),
+			      nflog_pkt_parse_attr_cb, attr);
+}
+/**
+ * @}
+ */
-- 
2.1.4

[lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Ken-ichirou MATSUZAWA]

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 utils/Makefile.am |   6 +-
 utils/nf-log.c    | 178 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 183 insertions(+), 1 deletion(-)
 create mode 100644 utils/nf-log.c

diff --git a/utils/Makefile.am b/utils/Makefile.am
index f961b6c..dfe5f34 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -1,11 +1,15 @@
 include ${top_srcdir}/Make_global.am
 
-check_PROGRAMS = nfulnl_test
+check_PROGRAMS = nfulnl_test nf-log
 
 nfulnl_test_SOURCES = nfulnl_test.c
 nfulnl_test_LDADD = ../src/libnetfilter_log.la
 nfulnl_test_LDFLAGS = -dynamic
 
+nf_log_SOURCES = nf-log.c
+nf_log_LDADD = ../src/libnetfilter_log.la
+nf_log_LDFLAGS = -dynamic -lmnl
+
 if BUILD_IPULOG
 check_PROGRAMS += ulog_test
 
diff --git a/utils/nf-log.c b/utils/nf-log.c
new file mode 100644
index 0000000..ab9ac70
--- /dev/null
+++ b/utils/nf-log.c
@@ -0,0 +1,178 @@
+/* This example is placed in the public domain. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <time.h>
+#include <arpa/inet.h>
+
+#include <linux/netfilter.h>
+#include <linux/netfilter/nfnetlink.h>
+#include <linux/netfilter/nfnetlink_log.h>
+
+#include <libmnl/libmnl.h>
+#include <libnetfilter_log/libnetfilter_log.h>
+
+static int log_cb(const struct nlmsghdr *nlh, void *data)
+{
+	struct nflog_data *nfad;
+	struct nfulnl_msg_packet_hdr *ph = NULL;
+	const char *prefix = NULL;
+	uint32_t mark = 0;
+	int ret;
+
+	nfad = nflog_data_alloc();
+	if (nfad == NULL)
+		return MNL_CB_ERROR;
+	ret = nflog_nlmsg_parse(nlh, nfad);
+	if (ret != MNL_CB_OK)
+		return ret;
+
+	ph = nflog_get_msg_packet_hdr(nfad);
+	prefix = nflog_get_prefix(nfad);
+	mark = nflog_get_nfmark(nfad);
+
+	printf("log received (prefix=\"%s\" hw=0x%04x hook=%u mark=%u)\n",
+		prefix ? prefix : "", ntohs(ph->hw_protocol), ph->hook,
+		mark);
+
+	return MNL_CB_OK;
+}
+
+static struct nlmsghdr *
+nflog_build_cfg_pf_request(char *buf, uint8_t command)
+{
+	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
+	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
+	nlh->nlmsg_flags = NLM_F_REQUEST;
+
+	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
+	nfg->nfgen_family = AF_INET;
+	nfg->version = NFNETLINK_V0;
+
+	struct nfulnl_msg_config_cmd cmd = {
+		.command = command,
+	};
+	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(cmd), &cmd);
+
+	return nlh;
+}
+
+static struct nlmsghdr *
+nflog_build_cfg_request(char *buf, uint8_t command, int qnum)
+{
+	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
+	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
+	nlh->nlmsg_flags = NLM_F_REQUEST;
+
+	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
+	nfg->nfgen_family = AF_INET;
+	nfg->version = NFNETLINK_V0;
+	nfg->res_id = htons(qnum);
+
+	struct nfulnl_msg_config_cmd cmd = {
+		.command = command,
+	};
+	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(cmd), &cmd);
+
+	return nlh;
+}
+
+static struct nlmsghdr *
+nflog_build_cfg_params(char *buf, uint8_t mode, int range, int qnum)
+{
+	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
+	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
+	nlh->nlmsg_flags = NLM_F_REQUEST;
+
+	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
+	nfg->nfgen_family = AF_UNSPEC;
+	nfg->version = NFNETLINK_V0;
+	nfg->res_id = htons(qnum);
+
+	struct nfulnl_msg_config_mode params = {
+		.copy_range = htonl(range),
+		.copy_mode = mode,
+	};
+	mnl_attr_put(nlh, NFULA_CFG_MODE, sizeof(params), &params);
+
+	return nlh;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	int ret;
+	unsigned int portid, qnum;
+
+	if (argc != 2) {
+		printf("Usage: %s [queue_num]\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+	qnum = atoi(argv[1]);
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	nlh = nflog_build_cfg_pf_request(buf, NFULNL_CFG_CMD_PF_UNBIND);
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nflog_build_cfg_pf_request(buf, NFULNL_CFG_CMD_PF_BIND);
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nflog_build_cfg_request(buf, NFULNL_CFG_CMD_BIND, qnum);
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nflog_build_cfg_params(buf, NFULNL_COPY_PACKET, 0xFFFF, qnum);
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	if (ret == -1) {
+		perror("mnl_socket_recvfrom");
+		exit(EXIT_FAILURE);
+	}
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, 0, portid, log_cb, NULL);
+		if (ret < 0){
+			perror("mnl_cb_run");
+			exit(EXIT_FAILURE);
+		}
+
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+		if (ret == -1) {
+			perror("mnl_socket_recvfrom");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	mnl_socket_close(nl);
+
+	return 0;
+}
-- 
2.1.4

Re: [lnf-log RFC PATCH 1/2] introduce new functions to use without nflog_handle

[Pablo Neira Ayuso]

On Mon, Aug 10, 2015 at 05:15:54PM +0900, Ken-ichirou MATSUZAWA wrote:
[...]
> diff --git a/src/libnetfilter_log.c b/src/libnetfilter_log.c
> index e92576b..422c550 100644
> --- a/src/libnetfilter_log.c
> +++ b/src/libnetfilter_log.c
> @@ -26,6 +26,7 @@
>  #include <errno.h>
>  #include <netinet/in.h>
>  #include <sys/socket.h>
> +#include <linux/netlink.h>
>  
>  #include <libnetfilter_log/linux_nfnetlink_log.h>
>  
> @@ -1067,5 +1068,47 @@ int nflog_snprintf_xml(char *buf, size_t rem, struct nflog_data *tb, int flags)
>  }
>  
>  /**
> + * nflog_data_alloc - allocate a new nflog data
> + *
> + * In case of success, this function returns a valid pointer to a memory blob,
> + * otherwise NULL is returned and errno is set appropiately.
> + */
> +struct nflog_data *nflog_data_alloc(void)
> +{
> +	struct nflog_data *nfad = calloc(1, sizeof(struct nflog_data));
> +	if (nfad == NULL)
> +		return NULL;
> +	nfad->nfa = (struct nfattr **)calloc(NFULA_MAX + 1,
> +					     sizeof(struct nlattr *));
> +	if (nfad->nfa == NULL) {
> +		free(nfad);
> +		return NULL;
> +	}
> +	return nfad;
> +}
[...]

The libnetfilter_log.c file contains the old API, its use is
discouraged since it depends on libnfnetlink.

> diff --git a/src/nlmsg.c b/src/nlmsg.c
> new file mode 100644
> index 0000000..8611b9d
> --- /dev/null
> +++ b/src/nlmsg.c

I like that you started the libmnl support for libnetfilter_log.

The idea is to provide a set of helper functions that we can use in
conjunction with libmnl, similar to what we have in
libnetfilter_queue/nlmsg.c

Thanks.

Re: [lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Pablo Neira Ayuso]

This code can be generalized a bit so you can place it in
src/nlmsg.c, see below.

On Mon, Aug 10, 2015 at 05:17:53PM +0900, Ken-ichirou MATSUZAWA wrote:
[...]
> +static struct nlmsghdr *
> +nflog_build_cfg_pf_request(char *buf, uint8_t command)
> +{
> +	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
> +	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
> +	nlh->nlmsg_flags = NLM_F_REQUEST;
> +
> +	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
> +	nfg->nfgen_family = AF_INET;
> +	nfg->version = NFNETLINK_V0;
> +
> +	struct nfulnl_msg_config_cmd cmd = {
> +		.command = command,
> +	};
> +	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(cmd), &cmd);
> +
> +	return nlh;
> +}

I suggest you use and implement the following new helper functions for
libnetfilter_log:

struct nlmsghdr *
nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t cmd, uint16_t qnum);

int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, struct nfulnl_msg_config_mode *mode);
int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, struct nfulnl_msg_config_cmd *cmd);

You can reuse code in the functions here below to make it. Thanks.

> +static struct nlmsghdr *
> +nflog_build_cfg_request(char *buf, uint8_t command, int qnum)
> +{
> +	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
> +	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
> +	nlh->nlmsg_flags = NLM_F_REQUEST;
> +
> +	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
> +	nfg->nfgen_family = AF_INET;
> +	nfg->version = NFNETLINK_V0;
> +	nfg->res_id = htons(qnum);
> +
> +	struct nfulnl_msg_config_cmd cmd = {
> +		.command = command,
> +	};
> +	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(cmd), &cmd);
> +
> +	return nlh;
> +}
> +
> +static struct nlmsghdr *
> +nflog_build_cfg_params(char *buf, uint8_t mode, int range, int qnum)
> +{
> +	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
> +	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
> +	nlh->nlmsg_flags = NLM_F_REQUEST;
> +
> +	struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
> +	nfg->nfgen_family = AF_UNSPEC;
> +	nfg->version = NFNETLINK_V0;
> +	nfg->res_id = htons(qnum);
> +
> +	struct nfulnl_msg_config_mode params = {
> +		.copy_range = htonl(range),
> +		.copy_mode = mode,
> +	};
> +	mnl_attr_put(nlh, NFULA_CFG_MODE, sizeof(params), &params);
> +
> +	return nlh;
> +}
> +
[...]

Re: [lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Ken-ichirou MATSUZAWA]

 Thank you for comment.

On Tue, Aug 18, 2015 at 08:04:22AM +0200, Pablo Neira Ayuso wrote:
> I suggest you use and implement the following new helper functions for
> libnetfilter_log:
> 
> struct nlmsghdr *
> nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t cmd, uint16_t qnum);
> 
> int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, struct nfulnl_msg_config_mode *mode);
> int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, struct nfulnl_msg_config_cmd *cmd);

Would you confirm the functions for nlmsg building which you suggested
to add because it's a little different from you suggested. I am worried
about it's in accodance with your intention.

In addition, I added NFLOG_DATA_SIZE as is, the size of struct
nflog_data. This enables to preallocate buffer, and I added
functions which initialize a buffer based on this.

Would you see it again?

Changes from previous:
  * introduce nlmsg three build functions:
    struct nlmsghdr *
      nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum);
    int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, struct nfulnl_msg_config_mode *mode);
    int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, struct nfulnl_msg_config_cmd *cmd);
    
  * introduce NFLOG_DATA_SIZE macro and use it at allocate functions.
  * update utils/nf-log to fit with the above.

[lnf-log RFC PATCH v2 1/2] introduce new functions independent from libnfnetlink

[Ken-ichirou MATSUZAWA]

The libnetfilter_log.c file contains the old API, its use is
discouraged since it depends on libnfnetlink.

The idea is to provide a set of helper functions that we can use in
conjunction with libmnl, similar to what we have in
libnetfilter_queue/nlmsg.c

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 Make_global.am                              |   2 +-
 configure.ac                                |   1 +
 include/libnetfilter_log/libnetfilter_log.h |  12 +++
 src/Makefile.am                             |   4 +-
 src/libnetfilter_log.c                      |  52 ++++++++++
 src/nlmsg.c                                 | 149 ++++++++++++++++++++++++++++
 6 files changed, 217 insertions(+), 3 deletions(-)
 create mode 100644 src/nlmsg.c

diff --git a/Make_global.am b/Make_global.am
index a4e9bd9..9bc8ea1 100644
--- a/Make_global.am
+++ b/Make_global.am
@@ -1,2 +1,2 @@
-AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS}
+AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS} ${LIBMNL_CFLAGS}
 AM_CFLAGS = -Wall
diff --git a/configure.ac b/configure.ac
index cdcbc90..ead9399 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,6 +30,7 @@ AM_CONDITIONAL([BUILD_IPULOG], [test "x$with_ipulog" != xno])
 
 dnl Dependencies
 PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 0.0.41])
+PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 
 dnl Output the makefile
 AC_CONFIG_FILES([Makefile src/Makefile include/Makefile
diff --git a/include/libnetfilter_log/libnetfilter_log.h b/include/libnetfilter_log/libnetfilter_log.h
index 7812877..c662b63 100644
--- a/include/libnetfilter_log/libnetfilter_log.h
+++ b/include/libnetfilter_log/libnetfilter_log.h
@@ -11,6 +11,7 @@
 
 #include <stdint.h>
 #include <sys/types.h>
+#include <linux/netlink.h>
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
 struct nflog_handle;
@@ -82,4 +83,15 @@ enum {
 
 extern int nflog_snprintf_xml(char *buf, size_t len, struct nflog_data *tb, int flags);
 
+#define NFLOG_DATA_SIZE (sizeof(struct nfattr **) + sizeof(struct nlattr *) * (NFULA_MAX + 1))
+extern struct nflog_data *nflog_data_alloc(void);
+extern struct nflog_data *nflog_data_init(void *data);
+extern void nflog_data_free(struct nflog_data *nfad);
+extern struct nlmsghdr *
+nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum);
+extern int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, struct nfulnl_msg_config_mode *mode);
+extern int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, struct nfulnl_msg_config_cmd *cmd);
+extern int nflog_nlmsg_parse_attrs(const struct nlmsghdr *nlh, struct nlattr **attr);
+extern int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nflog_data *nfad);
+
 #endif	/* __LIBNETFILTER_LOG_H */
diff --git a/src/Makefile.am b/src/Makefile.am
index 33933a4..aa56152 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -26,8 +26,8 @@ lib_LTLIBRARIES = libnetfilter_log.la
 
 libnetfilter_log_la_LDFLAGS = -Wc,-nostartfiles -lnfnetlink	\
 			      -version-info $(LIBVERSION)
-libnetfilter_log_la_SOURCES = libnetfilter_log.c 
-libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS}
+libnetfilter_log_la_SOURCES = libnetfilter_log.c nlmsg.c
+libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS} ${LIBMNL_LIBS}
 
 if BUILD_IPULOG
 lib_LTLIBRARIES += libnetfilter_log_libipulog.la
diff --git a/src/libnetfilter_log.c b/src/libnetfilter_log.c
index e92576b..8f037ae 100644
--- a/src/libnetfilter_log.c
+++ b/src/libnetfilter_log.c
@@ -26,6 +26,7 @@
 #include <errno.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
+#include <linux/netlink.h>
 
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
@@ -1067,5 +1068,56 @@ int nflog_snprintf_xml(char *buf, size_t rem, struct nflog_data *tb, int flags)
 }
 
 /**
+ * nflog_data_init - initialize the preallocated nflog data
+ *
+ * this function requires NFLOG_DATA_SIZE allocated memory area and returns a
+ * pointer to a initialized nflog_data.
+ */
+struct nflog_data *nflog_data_init(void *data)
+{
+	struct nflog_data *nfad = data;
+
+	memset(data, 0, NFLOG_DATA_SIZE);
+	nfad->nfa = data + sizeof(struct nfattr **);
+	return nfad;
+}
+
+/**
+ * nflog_data_alloc - allocate a new nflog data
+ *
+ * In case of success, this function returns a valid pointer to a memory blob,
+ * otherwise NULL is returned and errno is set appropiately.
+ */
+struct nflog_data *nflog_data_alloc(void)
+{
+	void *data = malloc(NFLOG_DATA_SIZE);
+
+	if (data == NULL)
+		return NULL;
+	return nflog_data_init(data);
+}
+
+/**
+ * nflog_data_free - release a nflog data
+ * \param nfad pointer to the nflog data
+ */
+void nflog_data_free(struct nflog_data *nfad)
+{
+	free(nfad);
+}
+
+/**
+ * nflog_nlmsg_parse - set packet attributes from netlink message
+ * \param nlh netlink message that you want to read.
+ * \param attr pointer to the nflog_data which is allocate by nflog_data_alloc
+ *
+ * This function returns MNL_CB_ERROR if any error occurs, or MNL_CB_OK on
+ * success.
+ */
+int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nflog_data *nfad)
+{
+	return nflog_nlmsg_parse_attrs(nlh, (struct nlattr **)&nfad->nfa[-1]);
+}
+/**
  * @}
  */
diff --git a/src/nlmsg.c b/src/nlmsg.c
new file mode 100644
index 0000000..269fb9d
--- /dev/null
+++ b/src/nlmsg.c
@@ -0,0 +1,149 @@
+/*
+ * (C) 2015 by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <arpa/inet.h>
+#include <linux/netfilter/nfnetlink_log.h>
+#include <libmnl/libmnl.h>
+
+/**
+ * \defgroup nlmsg Netlink message helper functions
+ * @{
+ */
+
+/**
+ * nfnl_nlmsg_put_header - reserve and prepare room for nflog Netlink header
+ * \param buf memory already allocated to store the Netlink header
+ * \param type message type one of the enum nfulnl_msg_types
+ * \param family protocol family to be an object of
+ * \param qnum queue number to be an object of
+ *
+ * This function creates Netlink header in the memory buffer passed
+ * as parameter that will send to nfnetlink log . This function
+ * returns a pointer to the Netlink header structure.
+ */
+struct nlmsghdr *
+nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum)
+{
+	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
+	struct nfgenmsg *nfg;
+
+	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | type;
+	nlh->nlmsg_flags = NLM_F_REQUEST;
+
+	nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
+	nfg->nfgen_family = family;
+	nfg->version = NFNETLINK_V0;
+	nfg->res_id = htons(qnum);
+
+	return nlh;
+}
+
+/**
+ * nfnl_attr_put_cfg_mode - add an mode attribute to nflog netlink message
+ * \param nlh pointer to the netlink message
+ * \param mode pointer to the mode that will be stored by the new attribute
+ *
+ * this function returns -1 and errno is explicitly set. On success, this
+ * function returns 1.
+ */
+int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, struct nfulnl_msg_config_mode *mode)
+{
+	mnl_attr_put(nlh, NFULA_CFG_MODE, sizeof(*mode), mode);
+	/* it may returns -1 in future */
+	return 1;
+}
+
+/**
+ * nfnl_attr_put_cfg_cmd - add an cmd attribute to nflog netlink message
+ * \param nlh pointer to the netlink message
+ * \param cmd pointer to the cmd that will be stored by the new attribute
+ *
+ * this function returns -1 and errno is explicitly set. On success, this
+ * function returns 1.
+ */
+int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, struct nfulnl_msg_config_cmd *cmd)
+{
+	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(*cmd), cmd);
+	/* it may returns -1 in future */
+	return 1;
+}
+
+static int nflog_pkt_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	/* skip unsupported attribute in user-space */
+	if (mnl_attr_type_valid(attr, NFULA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFULA_HWTYPE:		/* hardware type */
+	case NFULA_HWLEN:		/* hardware header length */
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_MARK:		/* __u32 nfmark */
+	case NFULA_IFINDEX_INDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_OUTDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSINDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSOUTDEV:	/* __u32 ifindex */
+	case NFULA_UID:			/* user id of socket */
+	case NFULA_SEQ:			/* instance-local sequence number */
+	case NFULA_SEQ_GLOBAL:		/* global sequence number */
+	case NFULA_GID:			/* group id of socket */
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_PACKET_HDR:
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hdr)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_TIMESTAMP:		/* nfulnl_msg_packet_timestamp */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_timestamp)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_HWADDR:		/* nfulnl_msg_packet_hw */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hw)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_PREFIX:		/* string prefix */
+		if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_HWHEADER:		/* hardware header */
+	case NFULA_PAYLOAD:		/* opaque data payload */
+		break;
+	}
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+/**
+ * nflog_nlmsg_parse_attrs - set nlattrs from netlink message
+ * \param nlh netlink message that you want to read.
+ * \param attr pointer to the array of nlattr which size is NFULA_MAX + 1
+ *
+ * This function returns MNL_CB_ERROR if any error occurs, or MNL_CB_OK on
+ * success.
+ */
+int nflog_nlmsg_parse_attrs(const struct nlmsghdr *nlh, struct nlattr **attr)
+{
+	return mnl_attr_parse(nlh, sizeof(struct nfgenmsg),
+			      nflog_pkt_parse_attr_cb, attr);
+}
+
+/**
+ * @}
+ */
-- 
2.1.4

[lnf-log RFC PATCH v2 2/2] utils: take a example from libmnl and use new functions

[Ken-ichirou MATSUZAWA]

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 utils/.gitignore  |   1 +
 utils/Makefile.am |   6 ++-
 utils/nf-log.c    | 139 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 145 insertions(+), 1 deletion(-)
 create mode 100644 utils/nf-log.c

diff --git a/utils/.gitignore b/utils/.gitignore
index 64e4588..01fa66d 100644
--- a/utils/.gitignore
+++ b/utils/.gitignore
@@ -1,2 +1,3 @@
 /nfulnl_test
 /ulog_test
+/nf-log
diff --git a/utils/Makefile.am b/utils/Makefile.am
index f961b6c..dfe5f34 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -1,11 +1,15 @@
 include ${top_srcdir}/Make_global.am
 
-check_PROGRAMS = nfulnl_test
+check_PROGRAMS = nfulnl_test nf-log
 
 nfulnl_test_SOURCES = nfulnl_test.c
 nfulnl_test_LDADD = ../src/libnetfilter_log.la
 nfulnl_test_LDFLAGS = -dynamic
 
+nf_log_SOURCES = nf-log.c
+nf_log_LDADD = ../src/libnetfilter_log.la
+nf_log_LDFLAGS = -dynamic -lmnl
+
 if BUILD_IPULOG
 check_PROGRAMS += ulog_test
 
diff --git a/utils/nf-log.c b/utils/nf-log.c
new file mode 100644
index 0000000..e044321
--- /dev/null
+++ b/utils/nf-log.c
@@ -0,0 +1,139 @@
+/* This example is placed in the public domain. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+
+#include <linux/netfilter/nfnetlink_log.h>
+
+#include <libmnl/libmnl.h>
+#include <libnetfilter_log/libnetfilter_log.h>
+
+static int log_cb(const struct nlmsghdr *nlh, void *data)
+{
+	char buf[NFLOG_DATA_SIZE];
+	struct nflog_data *nfad;
+	struct nfulnl_msg_packet_hdr *ph = NULL;
+	const char *prefix = NULL;
+	uint32_t mark = 0;
+	int ret;
+
+	nfad = nflog_data_init(buf);
+	if (nfad == NULL)
+		return MNL_CB_ERROR;
+	ret = nflog_nlmsg_parse(nlh, nfad);
+	if (ret != MNL_CB_OK)
+		return ret;
+
+	ph = nflog_get_msg_packet_hdr(nfad);
+	prefix = nflog_get_prefix(nfad);
+	mark = nflog_get_nfmark(nfad);
+
+	printf("log received (prefix=\"%s\" hw=0x%04x hook=%u mark=%u)\n",
+		prefix ? prefix : "", ntohs(ph->hw_protocol), ph->hook,
+		mark);
+
+	return MNL_CB_OK;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	struct nfulnl_msg_config_mode nfmode;
+	struct nfulnl_msg_config_cmd nfcmd;
+	int ret;
+	unsigned int portid, qnum;
+
+	if (argc != 2) {
+		printf("Usage: %s [queue_num]\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+	qnum = atoi(argv[1]);
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	/* kernels 3.8 and later is required to omit PF_(UN)BIND */
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, 0);
+	nfcmd.command = NFULNL_CFG_CMD_PF_UNBIND;
+	if (nfnl_attr_put_cfg_cmd(nlh, &nfcmd) < 0) {
+		perror("nfnl_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, 0);
+	nfcmd.command = NFULNL_CFG_CMD_PF_BIND;
+	if (nfnl_attr_put_cfg_cmd(nlh, &nfcmd) < 0) {
+		perror("nfnl_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, qnum);
+	nfcmd.command = NFULNL_CFG_CMD_BIND;
+	if (nfnl_attr_put_cfg_cmd(nlh, &nfcmd) < 0) {
+		perror("nfnl_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_UNSPEC, qnum);
+	nfmode.copy_mode = NFULNL_COPY_PACKET;
+	nfmode.copy_range = 0xFFFF;
+	if (nfnl_attr_put_cfg_mode(nlh, &nfmode) < 0) {
+		perror("nfnl_attr_put_cfg_mode");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	if (ret == -1) {
+		perror("mnl_socket_recvfrom");
+		exit(EXIT_FAILURE);
+	}
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, 0, portid, log_cb, NULL);
+		if (ret < 0){
+			perror("mnl_cb_run");
+			exit(EXIT_FAILURE);
+		}
+
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+		if (ret == -1) {
+			perror("mnl_socket_recvfrom");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	mnl_socket_close(nl);
+
+	return 0;
+}
-- 
2.1.4

Re: [lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Pablo Neira Ayuso]

On Wed, Aug 19, 2015 at 04:11:03PM +0900, Ken-ichirou MATSUZAWA wrote:
[...]
> Would you confirm the functions for nlmsg building which you suggested
> to add because it's a little different from you suggested. I am worried
> about it's in accodance with your intention.

I suggest you remove the nflog_data_init(), nflog_data_alloc(),
nflog_data_free() and nflog_nlmsg_parse().

Those are part of the old API, we should focus on API that we can
combine with libmnl.

More comments below:

> In addition, I added NFLOG_DATA_SIZE as is, the size of struct
> nflog_data. This enables to preallocate buffer, and I added
> functions which initialize a buffer based on this.
> 
> Would you see it again?
> 
> Changes from previous:
>   * introduce nlmsg three build functions:
>     struct nlmsghdr *
>       nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum);
>     int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, struct nfulnl_msg_config_mode *mode);
>     int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, struct nfulnl_msg_config_cmd *cmd);

One small change more, please change this interface from:

+       nfcmd.command = NFULNL_CFG_CMD_PF_UNBIND;
+       if (nfnl_attr_put_cfg_cmd(nlh, &nfcmd) < 0) {

to:

        if (nfnl_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_PF_UNBIND) < 0) {

Same thing with nfnl_attr_put_cfg_mode(), replace this:

+       nfmode.copy_mode = NFULNL_COPY_PACKET;
+       nfmode.copy_range = 0xFFFF;
+       if (nfnl_attr_put_cfg_mode(nlh, &nfmode) < 0) {

to:
        if (nfnl_attr_put_cfg_mode(nlh, NFULNL_COPY_PACKET, 0xffff)

>   * introduce NFLOG_DATA_SIZE macro and use it at allocate functions.

You can remove NFLOG_DATA_SIZE, this is only needed by the old API,
not for libmnl.

>   * update utils/nf-log to fit with the above.

Thanks a lot!

Re: [lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Ken-ichirou MATSUZAWA]

 Thank you for the reply.

On Thu, Aug 20, 2015 at 12:04:03AM +0200, Pablo Neira Ayuso wrote:
> I suggest you remove the nflog_data_init(), nflog_data_alloc(),
> nflog_data_free() and nflog_nlmsg_parse().
> 
> Those are part of the old API, we should focus on API that we can
> combine with libmnl.

I think I can follow your suggestion, is it correct?

Please let me ask two more things.
With these functions, nflog attrs can be acquired by
mnl_attr_get_payload, but can not show as XML in one shot. To do it,
may I post another patch:

    struct nflog_data *nfnl_attrs2data(struct nlattr **attr)
    {
        struct nflog_data *nfad = calloc(1, sizeof(struct nflog_data));
        if (nfad == NULL)
            return NULL;
        nfad->nfa = (struct nfattr **)&attr[1];
        return nfad;
    }

Is it acceptable?

It's just my curiosity, would you tell me what does nfnl_ prefix
stand for?

Thanks,

[lnf-log PATCH 1/2] introduce new functions independent from libnfnetlink

[Ken-ichirou MATSUZAWA]

The libnetfilter_log.c file contains the old API, its use is
discouraged since it depends on libnfnetlink.

The idea is to provide a set of helper functions that we can use in
conjunction with libmnl, similar to what we have in
libnetfilter_queue/nlmsg.c

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 Make_global.am                              |   2 +-
 configure.ac                                |   1 +
 include/libnetfilter_log/libnetfilter_log.h |   7 ++
 src/Makefile.am                             |   4 +-
 src/nlmsg.c                                 | 161 ++++++++++++++++++++++++++++
 5 files changed, 172 insertions(+), 3 deletions(-)
 create mode 100644 src/nlmsg.c

diff --git a/Make_global.am b/Make_global.am
index a4e9bd9..9bc8ea1 100644
--- a/Make_global.am
+++ b/Make_global.am
@@ -1,2 +1,2 @@
-AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS}
+AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS} ${LIBMNL_CFLAGS}
 AM_CFLAGS = -Wall
diff --git a/configure.ac b/configure.ac
index cdcbc90..ead9399 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,6 +30,7 @@ AM_CONDITIONAL([BUILD_IPULOG], [test "x$with_ipulog" != xno])
 
 dnl Dependencies
 PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 0.0.41])
+PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 
 dnl Output the makefile
 AC_CONFIG_FILES([Makefile src/Makefile include/Makefile
diff --git a/include/libnetfilter_log/libnetfilter_log.h b/include/libnetfilter_log/libnetfilter_log.h
index 7812877..723d812 100644
--- a/include/libnetfilter_log/libnetfilter_log.h
+++ b/include/libnetfilter_log/libnetfilter_log.h
@@ -11,6 +11,7 @@
 
 #include <stdint.h>
 #include <sys/types.h>
+#include <linux/netlink.h>
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
 struct nflog_handle;
@@ -82,4 +83,10 @@ enum {
 
 extern int nflog_snprintf_xml(char *buf, size_t len, struct nflog_data *tb, int flags);
 
+extern struct nlmsghdr *
+nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum);
+extern int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t range);
+extern int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, uint8_t cmd);
+extern int nfnl_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr);
+
 #endif	/* __LIBNETFILTER_LOG_H */
diff --git a/src/Makefile.am b/src/Makefile.am
index 33933a4..aa56152 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -26,8 +26,8 @@ lib_LTLIBRARIES = libnetfilter_log.la
 
 libnetfilter_log_la_LDFLAGS = -Wc,-nostartfiles -lnfnetlink	\
 			      -version-info $(LIBVERSION)
-libnetfilter_log_la_SOURCES = libnetfilter_log.c 
-libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS}
+libnetfilter_log_la_SOURCES = libnetfilter_log.c nlmsg.c
+libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS} ${LIBMNL_LIBS}
 
 if BUILD_IPULOG
 lib_LTLIBRARIES += libnetfilter_log_libipulog.la
diff --git a/src/nlmsg.c b/src/nlmsg.c
new file mode 100644
index 0000000..5c133fa
--- /dev/null
+++ b/src/nlmsg.c
@@ -0,0 +1,161 @@
+/*
+ * (C) 2015 by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <arpa/inet.h>
+#include <linux/netfilter/nfnetlink_log.h>
+#include <libmnl/libmnl.h>
+
+/**
+ * \defgroup nlmsg Netlink message helper functions
+ * @{
+ */
+
+/**
+ * nfnl_nlmsg_put_header - reserve and prepare room for nflog Netlink header
+ * \param buf memory already allocated to store the Netlink header
+ * \param type message type one of the enum nfulnl_msg_types
+ * \param family protocol family to be an object of
+ * \param qnum queue number to be an object of
+ *
+ * This function creates Netlink header in the memory buffer passed
+ * as parameter that will send to nfnetlink log. This function
+ * returns a pointer to the Netlink header structure.
+ */
+struct nlmsghdr *
+nfnl_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum)
+{
+	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
+	struct nfgenmsg *nfg;
+
+	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | type;
+	nlh->nlmsg_flags = NLM_F_REQUEST;
+
+	nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
+	nfg->nfgen_family = family;
+	nfg->version = NFNETLINK_V0;
+	nfg->res_id = htons(qnum);
+
+	return nlh;
+}
+
+/**
+ * nfnl_attr_put_cfg_mode - add a mode attribute to nflog netlink message
+ * \param nlh pointer to the netlink message
+ * \param mode copy mode defined in linux/netfilter/nfnetlink_log.h
+ * \param range copy range
+ *
+ * this function returns -1 and errno is explicitly set. On success, this
+ * function returns 1.
+ */
+int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t range)
+{
+	struct nfulnl_msg_config_mode nfmode = {
+		.copy_mode = mode,
+		.copy_range = htonl(range)
+	};
+
+	mnl_attr_put(nlh, NFULA_CFG_MODE, sizeof(nfmode), &nfmode);
+
+	/* it may returns -1 in future */
+	return 1;
+}
+
+/**
+ * nfnl_attr_put_cfg_cmd - add a cmd attribute to nflog netlink message
+ * \param nlh pointer to the netlink message
+ * \param cmd command one of the enum nfulnl_msg_config_cmds
+ *
+ * this function returns -1 and errno is explicitly set. On success, this
+ * function returns 1.
+ */
+int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, uint8_t cmd)
+{
+	struct nfulnl_msg_config_cmd nfcmd = {
+		.command = cmd
+	};
+
+	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(nfcmd), &nfcmd);
+
+	/* it may returns -1 in future */
+	return 1;
+}
+
+static int nfnl_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	/* skip unsupported attribute in user-space */
+	if (mnl_attr_type_valid(attr, NFULA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFULA_HWTYPE:		/* hardware type */
+	case NFULA_HWLEN:		/* hardware header length */
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_MARK:		/* __u32 nfmark */
+	case NFULA_IFINDEX_INDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_OUTDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSINDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSOUTDEV:	/* __u32 ifindex */
+	case NFULA_UID:			/* user id of socket */
+	case NFULA_SEQ:			/* instance-local sequence number */
+	case NFULA_SEQ_GLOBAL:		/* global sequence number */
+	case NFULA_GID:			/* group id of socket */
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_PACKET_HDR:
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hdr)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_TIMESTAMP:		/* nfulnl_msg_packet_timestamp */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_timestamp)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_HWADDR:		/* nfulnl_msg_packet_hw */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hw)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_PREFIX:		/* string prefix */
+		if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_HWHEADER:		/* hardware header */
+	case NFULA_PAYLOAD:		/* opaque data payload */
+		break;
+	}
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+/**
+ * nfnl_nlmsg_parse - set nlattrs from netlink message
+ * \param nlh netlink message that you want to read.
+ * \param attr pointer to the array of nlattr which size is NFULA_MAX + 1
+ *
+ * This function returns MNL_CB_ERROR if any error occurs, or MNL_CB_OK on
+ * success.
+ */
+int nfnl_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr)
+{
+	return mnl_attr_parse(nlh, sizeof(struct nfgenmsg),
+			      nfnl_parse_attr_cb, attr);
+}
+
+/**
+ * @}
+ */
-- 
2.1.4

[lnf-log PATCH 2/2] utils: take a example from libmnl and use new functions

[Ken-ichirou MATSUZAWA]

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 utils/.gitignore  |   1 +
 utils/Makefile.am |   6 ++-
 utils/nf-log.c    | 131 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 137 insertions(+), 1 deletion(-)
 create mode 100644 utils/nf-log.c

diff --git a/utils/.gitignore b/utils/.gitignore
index 64e4588..01fa66d 100644
--- a/utils/.gitignore
+++ b/utils/.gitignore
@@ -1,2 +1,3 @@
 /nfulnl_test
 /ulog_test
+/nf-log
diff --git a/utils/Makefile.am b/utils/Makefile.am
index f961b6c..dfe5f34 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -1,11 +1,15 @@
 include ${top_srcdir}/Make_global.am
 
-check_PROGRAMS = nfulnl_test
+check_PROGRAMS = nfulnl_test nf-log
 
 nfulnl_test_SOURCES = nfulnl_test.c
 nfulnl_test_LDADD = ../src/libnetfilter_log.la
 nfulnl_test_LDFLAGS = -dynamic
 
+nf_log_SOURCES = nf-log.c
+nf_log_LDADD = ../src/libnetfilter_log.la
+nf_log_LDFLAGS = -dynamic -lmnl
+
 if BUILD_IPULOG
 check_PROGRAMS += ulog_test
 
diff --git a/utils/nf-log.c b/utils/nf-log.c
new file mode 100644
index 0000000..0ff1392
--- /dev/null
+++ b/utils/nf-log.c
@@ -0,0 +1,131 @@
+/* This example is placed in the public domain. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+
+#include <linux/netfilter/nfnetlink_log.h>
+
+#include <libmnl/libmnl.h>
+#include <libnetfilter_log/libnetfilter_log.h>
+
+static int log_cb(const struct nlmsghdr *nlh, void *data)
+{
+	struct nlattr *attrs[NFULA_MAX + 1] = { NULL };
+	struct nfulnl_msg_packet_hdr *ph = NULL;
+	const char *prefix = NULL;
+	uint32_t mark = 0;
+	int ret;
+
+	ret = nfnl_nlmsg_parse(nlh, attrs);
+	if (ret != MNL_CB_OK)
+		return ret;
+
+	if (attrs[NFULA_PACKET_HDR])
+		ph = mnl_attr_get_payload(attrs[NFULA_PACKET_HDR]);
+	if (attrs[NFULA_PREFIX])
+		prefix = mnl_attr_get_str(attrs[NFULA_PREFIX]);
+	if (attrs[NFULA_MARK])
+		mark = ntohl(mnl_attr_get_u32(attrs[NFULA_MARK]));
+
+	printf("log received (prefix=\"%s\" hw=0x%04x hook=%u mark=%u)\n",
+		prefix ? prefix : "", ntohs(ph->hw_protocol), ph->hook,
+		mark);
+
+	return MNL_CB_OK;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	int ret;
+	unsigned int portid, qnum;
+
+	if (argc != 2) {
+		printf("Usage: %s [queue_num]\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+	qnum = atoi(argv[1]);
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	/* kernels 3.8 and later is required to omit PF_(UN)BIND */
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, 0);
+	if (nfnl_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_PF_UNBIND) < 0) {
+		perror("nfnl_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, 0);
+	if (nfnl_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_PF_BIND) < 0) {
+		perror("nfnl_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, qnum);
+	if (nfnl_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_BIND) < 0) {
+		perror("nfnl_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nfnl_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_UNSPEC, qnum);
+	if (nfnl_attr_put_cfg_mode(nlh, NFULNL_COPY_PACKET, 0xffff) < 0) {
+		perror("nfnl_attr_put_cfg_mode");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	if (ret == -1) {
+		perror("mnl_socket_recvfrom");
+		exit(EXIT_FAILURE);
+	}
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, 0, portid, log_cb, NULL);
+		if (ret < 0){
+			perror("mnl_cb_run");
+			exit(EXIT_FAILURE);
+		}
+
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+		if (ret == -1) {
+			perror("mnl_socket_recvfrom");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	mnl_socket_close(nl);
+
+	return 0;
+}
-- 
2.1.4

Re: [lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Pablo Neira Ayuso]

[-- Attachment #1: Type: text/plain, Size: 1742 bytes --]

On Thu, Aug 20, 2015 at 04:26:45PM +0900, Ken-ichirou MATSUZAWA wrote:
>  Thank you for the reply.
> 
> On Thu, Aug 20, 2015 at 12:04:03AM +0200, Pablo Neira Ayuso wrote:
> > I suggest you remove the nflog_data_init(), nflog_data_alloc(),
> > nflog_data_free() and nflog_nlmsg_parse().
> > 
> > Those are part of the old API, we should focus on API that we can
> > combine with libmnl.
> 
> I think I can follow your suggestion, is it correct?
> 
> Please let me ask two more things.
> With these functions, nflog attrs can be acquired by
> mnl_attr_get_payload, but can not show as XML in one shot.
>
> To do it, may I post another patch:
> 
>     struct nflog_data *nfnl_attrs2data(struct nlattr **attr)
>     {
>         struct nflog_data *nfad = calloc(1, sizeof(struct nflog_data));
>         if (nfad == NULL)
>             return NULL;
>         nfad->nfa = (struct nfattr **)&attr[1];
>         return nfad;
>     }
> 
> Is it acceptable?

I would like not to have any code that mixes both APIs. The idea is to
deprecate libnfnetlink and any client of that library at some point,
that will take quite time though since we'll have to mark those old
interfaces as deprecated.

Please, see my rough proposal patch attached so you also have access
to the XML output, it applies on top of your patchset. I made some
quick testing here, review it. Note that I have also included the
nlmsghdr as it contains useful information that we may want to display
in the feature (eg. queue number).

> It's just my curiosity, would you tell me what does nfnl_ prefix
> stand for?

Good point, we should be using nflog_ prefix instead, sorry. nfnl_ is
already used by libnfnetlink so we can't use it.

Will you send me a new round of patches? Thanks!

[-- Attachment #2: kenichirou.patch --]
[-- Type: text/x-diff, Size: 3213 bytes --]

diff --git a/include/internal.h b/include/internal.h
new file mode 100644
index 0000000..7839fd8
--- /dev/null
+++ b/include/internal.h
@@ -0,0 +1,9 @@
+#ifndef _LIBNETFILTER_LOG_INTERNAL_H
+#define _LIBNETFILTER_LOG_INTERNAL_H
+
+struct nflog_data
+{
+	struct nfattr **nfa;
+};
+
+#endif
diff --git a/include/libnetfilter_log/libnetfilter_log.h b/include/libnetfilter_log/libnetfilter_log.h
index 723d812..60cabb9 100644
--- a/include/libnetfilter_log/libnetfilter_log.h
+++ b/include/libnetfilter_log/libnetfilter_log.h
@@ -89,4 +89,12 @@ extern int nfnl_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t r
 extern int nfnl_attr_put_cfg_cmd(struct nlmsghdr *nlh, uint8_t cmd);
 extern int nfnl_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr);
 
+enum nflog_output_type {
+	NFLOG_OUTPUT_XML	= 0,
+};
+
+int nflog_nlmsg_snprintf(char *buf, size_t bufsiz, const struct nlmsghdr *nlh,
+			 struct nlattr **attr, enum nflog_output_type type,
+			 uint32_t flags);
+
 #endif	/* __LIBNETFILTER_LOG_H */
diff --git a/src/libnetfilter_log.c b/src/libnetfilter_log.c
index e92576b..567049c 100644
--- a/src/libnetfilter_log.c
+++ b/src/libnetfilter_log.c
@@ -26,6 +26,7 @@
 #include <errno.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
+#include "internal.h"
 
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
@@ -78,11 +79,6 @@ struct nflog_g_handle
 	void *data;
 };
 
-struct nflog_data
-{
-	struct nfattr **nfa;
-};
-
 int nflog_errno;
 
 /***********************************************************************
diff --git a/src/nlmsg.c b/src/nlmsg.c
index 5c133fa..86da579 100644
--- a/src/nlmsg.c
+++ b/src/nlmsg.c
@@ -9,6 +9,9 @@
 #include <arpa/inet.h>
 #include <linux/netfilter/nfnetlink_log.h>
 #include <libmnl/libmnl.h>
+#include <libnetfilter_log/libnetfilter_log.h>
+#include <errno.h>
+#include "internal.h"
 
 /**
  * \defgroup nlmsg Netlink message helper functions
@@ -156,6 +159,27 @@ int nfnl_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr)
 			      nfnl_parse_attr_cb, attr);
 }
 
+int nflog_nlmsg_snprintf(char *buf, size_t bufsiz, const struct nlmsghdr *nlh,
+			 struct nlattr **attr, enum nflog_output_type type,
+			 uint32_t flags)
+{
+	/* This is a hack to re-use the existing old API code. */
+	struct nflog_data nfad = {
+		.nfa	= (struct nfattr **)&attr[1],
+	};
+	int ret;
+
+	switch (type) {
+	case NFLOG_OUTPUT_XML:
+		ret = nflog_snprintf_xml(buf, bufsiz, &nfad, flags);
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+	return ret;
+}
+
 /**
  * @}
  */
diff --git a/utils/nf-log.c b/utils/nf-log.c
index 0ff1392..dafaeb7 100644
--- a/utils/nf-log.c
+++ b/utils/nf-log.c
@@ -14,6 +14,7 @@ static int log_cb(const struct nlmsghdr *nlh, void *data)
 	struct nfulnl_msg_packet_hdr *ph = NULL;
 	const char *prefix = NULL;
 	uint32_t mark = 0;
+	char buf[4096];
 	int ret;
 
 	ret = nfnl_nlmsg_parse(nlh, attrs);
@@ -31,6 +32,10 @@ static int log_cb(const struct nlmsghdr *nlh, void *data)
 		prefix ? prefix : "", ntohs(ph->hw_protocol), ph->hook,
 		mark);
 
+	nflog_nlmsg_snprintf(buf, sizeof(buf), nlh, attrs, NFLOG_OUTPUT_XML,
+			     NFLOG_XML_ALL);
+	printf("%s (ret =%d)\n", buf, ret);
+
 	return MNL_CB_OK;
 }
 

Re: [lnf-log RFC PATCH 2/2] utils: take a example from libmnl and use nflog_nlmsg_parse

[Ken-ichirou MATSUZAWA]

 Thank you for the reply and patch.
 
On Thu, Aug 20, 2015 at 08:16:13PM +0200, Pablo Neira Ayuso wrote:
> Please, see my rough proposal patch attached so you also have access
> to the XML output, it applies on top of your patchset. I made some

Thank you, I can printf a nflog in XML by nlattrs.

> Will you send me a new round of patches? Thanks!

Is the following patches right to start a new round?
# I quote your message in log many times, thanks.

Thanks,

[lnf-log PATCHv2 1/3] introduce new functions independent from libnfnetlink

[Ken-ichirou MATSUZAWA]

The libnetfilter_log.c file contains the old API, its use is
discouraged since it depends on libnfnetlink.

The idea is to provide a set of helper functions that we can use in
conjunction with libmnl, similar to what we have in
libnetfilter_queue/nlmsg.c

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 Make_global.am                              |   2 +-
 configure.ac                                |   1 +
 include/libnetfilter_log/libnetfilter_log.h |   7 ++
 src/Makefile.am                             |   4 +-
 src/nlmsg.c                                 | 161 ++++++++++++++++++++++++++++
 5 files changed, 172 insertions(+), 3 deletions(-)
 create mode 100644 src/nlmsg.c

diff --git a/Make_global.am b/Make_global.am
index a4e9bd9..9bc8ea1 100644
--- a/Make_global.am
+++ b/Make_global.am
@@ -1,2 +1,2 @@
-AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS}
+AM_CPPFLAGS = -I${top_srcdir}/include ${LIBNFNETLINK_CFLAGS} ${LIBMNL_CFLAGS}
 AM_CFLAGS = -Wall
diff --git a/configure.ac b/configure.ac
index cdcbc90..ead9399 100644
--- a/configure.ac
+++ b/configure.ac
@@ -30,6 +30,7 @@ AM_CONDITIONAL([BUILD_IPULOG], [test "x$with_ipulog" != xno])
 
 dnl Dependencies
 PKG_CHECK_MODULES([LIBNFNETLINK], [libnfnetlink >= 0.0.41])
+PKG_CHECK_MODULES([LIBMNL], [libmnl >= 1.0.3])
 
 dnl Output the makefile
 AC_CONFIG_FILES([Makefile src/Makefile include/Makefile
diff --git a/include/libnetfilter_log/libnetfilter_log.h b/include/libnetfilter_log/libnetfilter_log.h
index 7812877..5087f6f 100644
--- a/include/libnetfilter_log/libnetfilter_log.h
+++ b/include/libnetfilter_log/libnetfilter_log.h
@@ -11,6 +11,7 @@
 
 #include <stdint.h>
 #include <sys/types.h>
+#include <linux/netlink.h>
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
 struct nflog_handle;
@@ -82,4 +83,10 @@ enum {
 
 extern int nflog_snprintf_xml(char *buf, size_t len, struct nflog_data *tb, int flags);
 
+extern struct nlmsghdr *
+nflog_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum);
+extern int nflog_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t range);
+extern int nflog_attr_put_cfg_cmd(struct nlmsghdr *nlh, uint8_t cmd);
+extern int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr);
+
 #endif	/* __LIBNETFILTER_LOG_H */
diff --git a/src/Makefile.am b/src/Makefile.am
index 33933a4..aa56152 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -26,8 +26,8 @@ lib_LTLIBRARIES = libnetfilter_log.la
 
 libnetfilter_log_la_LDFLAGS = -Wc,-nostartfiles -lnfnetlink	\
 			      -version-info $(LIBVERSION)
-libnetfilter_log_la_SOURCES = libnetfilter_log.c 
-libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS}
+libnetfilter_log_la_SOURCES = libnetfilter_log.c nlmsg.c
+libnetfilter_log_la_LIBADD  = ${LIBNFNETLINK_LIBS} ${LIBMNL_LIBS}
 
 if BUILD_IPULOG
 lib_LTLIBRARIES += libnetfilter_log_libipulog.la
diff --git a/src/nlmsg.c b/src/nlmsg.c
new file mode 100644
index 0000000..a917a70
--- /dev/null
+++ b/src/nlmsg.c
@@ -0,0 +1,161 @@
+/*
+ * (C) 2015 by Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published
+ * by the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+#include <arpa/inet.h>
+#include <linux/netfilter/nfnetlink_log.h>
+#include <libmnl/libmnl.h>
+
+/**
+ * \defgroup nlmsg Netlink message helper functions
+ * @{
+ */
+
+/**
+ * nflog_nlmsg_put_header - reserve and prepare room for nflog Netlink header
+ * \param buf memory already allocated to store the Netlink header
+ * \param type message type one of the enum nfulnl_msg_types
+ * \param family protocol family to be an object of
+ * \param qnum queue number to be an object of
+ *
+ * This function creates Netlink header in the memory buffer passed
+ * as parameter that will send to nfnetlink log. This function
+ * returns a pointer to the Netlink header structure.
+ */
+struct nlmsghdr *
+nflog_nlmsg_put_header(char *buf, uint8_t type, uint8_t family, uint16_t qnum)
+{
+	struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
+	struct nfgenmsg *nfg;
+
+	nlh->nlmsg_type	= (NFNL_SUBSYS_ULOG << 8) | type;
+	nlh->nlmsg_flags = NLM_F_REQUEST;
+
+	nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
+	nfg->nfgen_family = family;
+	nfg->version = NFNETLINK_V0;
+	nfg->res_id = htons(qnum);
+
+	return nlh;
+}
+
+/**
+ * nflog_attr_put_cfg_mode - add a mode attribute to nflog netlink message
+ * \param nlh pointer to the netlink message
+ * \param mode copy mode defined in linux/netfilter/nfnetlink_log.h
+ * \param range copy range
+ *
+ * this function returns -1 and errno is explicitly set on error.
+ * On success, this function returns 1.
+ */
+int nflog_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t range)
+{
+	struct nfulnl_msg_config_mode nfmode = {
+		.copy_mode = mode,
+		.copy_range = htonl(range)
+	};
+
+	mnl_attr_put(nlh, NFULA_CFG_MODE, sizeof(nfmode), &nfmode);
+
+	/* it may returns -1 in future */
+	return 1;
+}
+
+/**
+ * nflog_attr_put_cfg_cmd - add a cmd attribute to nflog netlink message
+ * \param nlh pointer to the netlink message
+ * \param cmd command one of the enum nfulnl_msg_config_cmds
+ *
+ * this function returns -1 and errno is explicitly set on error.
+ *  On success, this function returns 1.
+ */
+int nflog_attr_put_cfg_cmd(struct nlmsghdr *nlh, uint8_t cmd)
+{
+	struct nfulnl_msg_config_cmd nfcmd = {
+		.command = cmd
+	};
+
+	mnl_attr_put(nlh, NFULA_CFG_CMD, sizeof(nfcmd), &nfcmd);
+
+	/* it may returns -1 in future */
+	return 1;
+}
+
+static int nflog_parse_attr_cb(const struct nlattr *attr, void *data)
+{
+	const struct nlattr **tb = data;
+	int type = mnl_attr_get_type(attr);
+
+	/* skip unsupported attribute in user-space */
+	if (mnl_attr_type_valid(attr, NFULA_MAX) < 0)
+		return MNL_CB_OK;
+
+	switch(type) {
+	case NFULA_HWTYPE:		/* hardware type */
+	case NFULA_HWLEN:		/* hardware header length */
+		if (mnl_attr_validate(attr, MNL_TYPE_U16) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_MARK:		/* __u32 nfmark */
+	case NFULA_IFINDEX_INDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_OUTDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSINDEV:	/* __u32 ifindex */
+	case NFULA_IFINDEX_PHYSOUTDEV:	/* __u32 ifindex */
+	case NFULA_UID:			/* user id of socket */
+	case NFULA_SEQ:			/* instance-local sequence number */
+	case NFULA_SEQ_GLOBAL:		/* global sequence number */
+	case NFULA_GID:			/* group id of socket */
+		if (mnl_attr_validate(attr, MNL_TYPE_U32) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_PACKET_HDR:
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hdr)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_TIMESTAMP:		/* nfulnl_msg_packet_timestamp */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_timestamp)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_HWADDR:		/* nfulnl_msg_packet_hw */
+		if (mnl_attr_validate2(attr, MNL_TYPE_UNSPEC,
+		    sizeof(struct nfulnl_msg_packet_hw)) < 0) {
+			return MNL_CB_ERROR;
+		}
+		break;
+	case NFULA_PREFIX:		/* string prefix */
+		if (mnl_attr_validate(attr, MNL_TYPE_NUL_STRING) < 0)
+			return MNL_CB_ERROR;
+		break;
+	case NFULA_HWHEADER:		/* hardware header */
+	case NFULA_PAYLOAD:		/* opaque data payload */
+		break;
+	}
+	tb[type] = attr;
+	return MNL_CB_OK;
+}
+
+/**
+ * nflog_nlmsg_parse - set nlattrs from netlink message
+ * \param nlh netlink message that you want to read.
+ * \param attr pointer to the array of nlattr which size is NFULA_MAX + 1
+ *
+ * This function returns MNL_CB_ERROR if any error occurs, or MNL_CB_OK on
+ * success.
+ */
+int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr)
+{
+	return mnl_attr_parse(nlh, sizeof(struct nfgenmsg),
+			      nflog_parse_attr_cb, attr);
+}
+
+/**
+ * @}
+ */
-- 
2.1.4

[lnf-log PATCHv2 2/3] utils: take a example from libmnl and use new functions

[Ken-ichirou MATSUZAWA]

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 utils/.gitignore  |   1 +
 utils/Makefile.am |   6 ++-
 utils/nf-log.c    | 131 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 137 insertions(+), 1 deletion(-)
 create mode 100644 utils/nf-log.c

diff --git a/utils/.gitignore b/utils/.gitignore
index 64e4588..01fa66d 100644
--- a/utils/.gitignore
+++ b/utils/.gitignore
@@ -1,2 +1,3 @@
 /nfulnl_test
 /ulog_test
+/nf-log
diff --git a/utils/Makefile.am b/utils/Makefile.am
index f961b6c..dfe5f34 100644
--- a/utils/Makefile.am
+++ b/utils/Makefile.am
@@ -1,11 +1,15 @@
 include ${top_srcdir}/Make_global.am
 
-check_PROGRAMS = nfulnl_test
+check_PROGRAMS = nfulnl_test nf-log
 
 nfulnl_test_SOURCES = nfulnl_test.c
 nfulnl_test_LDADD = ../src/libnetfilter_log.la
 nfulnl_test_LDFLAGS = -dynamic
 
+nf_log_SOURCES = nf-log.c
+nf_log_LDADD = ../src/libnetfilter_log.la
+nf_log_LDFLAGS = -dynamic -lmnl
+
 if BUILD_IPULOG
 check_PROGRAMS += ulog_test
 
diff --git a/utils/nf-log.c b/utils/nf-log.c
new file mode 100644
index 0000000..d575b77
--- /dev/null
+++ b/utils/nf-log.c
@@ -0,0 +1,131 @@
+/* This example is placed in the public domain. */
+#include <stdio.h>
+#include <stdlib.h>
+#include <arpa/inet.h>
+
+#include <linux/netfilter/nfnetlink_log.h>
+
+#include <libmnl/libmnl.h>
+#include <libnetfilter_log/libnetfilter_log.h>
+
+static int log_cb(const struct nlmsghdr *nlh, void *data)
+{
+	struct nlattr *attrs[NFULA_MAX + 1] = { NULL };
+	struct nfulnl_msg_packet_hdr *ph = NULL;
+	const char *prefix = NULL;
+	uint32_t mark = 0;
+	int ret;
+
+	ret = nflog_nlmsg_parse(nlh, attrs);
+	if (ret != MNL_CB_OK)
+		return ret;
+
+	if (attrs[NFULA_PACKET_HDR])
+		ph = mnl_attr_get_payload(attrs[NFULA_PACKET_HDR]);
+	if (attrs[NFULA_PREFIX])
+		prefix = mnl_attr_get_str(attrs[NFULA_PREFIX]);
+	if (attrs[NFULA_MARK])
+		mark = ntohl(mnl_attr_get_u32(attrs[NFULA_MARK]));
+
+	printf("log received (prefix=\"%s\" hw=0x%04x hook=%u mark=%u)\n",
+		prefix ? prefix : "", ntohs(ph->hw_protocol), ph->hook,
+		mark);
+
+	return MNL_CB_OK;
+}
+
+int main(int argc, char *argv[])
+{
+	struct mnl_socket *nl;
+	char buf[MNL_SOCKET_BUFFER_SIZE];
+	struct nlmsghdr *nlh;
+	int ret;
+	unsigned int portid, qnum;
+
+	if (argc != 2) {
+		printf("Usage: %s [queue_num]\n", argv[0]);
+		exit(EXIT_FAILURE);
+	}
+	qnum = atoi(argv[1]);
+
+	nl = mnl_socket_open(NETLINK_NETFILTER);
+	if (nl == NULL) {
+		perror("mnl_socket_open");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
+		perror("mnl_socket_bind");
+		exit(EXIT_FAILURE);
+	}
+	portid = mnl_socket_get_portid(nl);
+
+	/* kernels 3.8 and later is required to omit PF_(UN)BIND */
+
+	nlh = nflog_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, 0);
+	if (nflog_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_PF_UNBIND) < 0) {
+		perror("nflog_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nflog_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, 0);
+	if (nflog_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_PF_BIND) < 0) {
+		perror("nflog_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nflog_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_INET, qnum);
+	if (nflog_attr_put_cfg_cmd(nlh, NFULNL_CFG_CMD_BIND) < 0) {
+		perror("nflog_attr_put_cfg_cmd");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	nlh = nflog_nlmsg_put_header(buf, NFULNL_MSG_CONFIG, AF_UNSPEC, qnum);
+	if (nflog_attr_put_cfg_mode(nlh, NFULNL_COPY_PACKET, 0xffff) < 0) {
+		perror("nflog_attr_put_cfg_mode");
+		exit(EXIT_FAILURE);
+	}
+
+	if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
+		perror("mnl_socket_sendto");
+		exit(EXIT_FAILURE);
+	}
+
+	ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+	if (ret == -1) {
+		perror("mnl_socket_recvfrom");
+		exit(EXIT_FAILURE);
+	}
+	while (ret > 0) {
+		ret = mnl_cb_run(buf, ret, 0, portid, log_cb, NULL);
+		if (ret < 0){
+			perror("mnl_cb_run");
+			exit(EXIT_FAILURE);
+		}
+
+		ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
+		if (ret == -1) {
+			perror("mnl_socket_recvfrom");
+			exit(EXIT_FAILURE);
+		}
+	}
+
+	mnl_socket_close(nl);
+
+	return 0;
+}
-- 
2.1.4

[lnf-log PATCHv2 3/3] nlmsg: add printf function in conjunction with libmnl

[Ken-ichirou MATSUZAWA]

To printf nflog netlink message in XML, nflog_snprintf_xml can be
used after converting nflog nlattrs to nflog_data, but we should not
have any code that mixes both new and old, which handles nflog_data,
APIs. The idea is to deprecate libnfnetlink and any client of that
library at some point, that will take quite time though since we'll
have to mark those old interfaces as deprecated.

Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp>
---
 include/internal.h                          |  9 +++++
 include/libnetfilter_log/libnetfilter_log.h |  8 +++++
 src/libnetfilter_log.c                      |  6 +---
 src/nlmsg.c                                 | 53 +++++++++++++++++++++++++++++
 utils/nf-log.c                              |  7 ++++
 5 files changed, 78 insertions(+), 5 deletions(-)
 create mode 100644 include/internal.h

diff --git a/include/internal.h b/include/internal.h
new file mode 100644
index 0000000..7839fd8
--- /dev/null
+++ b/include/internal.h
@@ -0,0 +1,9 @@
+#ifndef _LIBNETFILTER_LOG_INTERNAL_H
+#define _LIBNETFILTER_LOG_INTERNAL_H
+
+struct nflog_data
+{
+	struct nfattr **nfa;
+};
+
+#endif
diff --git a/include/libnetfilter_log/libnetfilter_log.h b/include/libnetfilter_log/libnetfilter_log.h
index 5087f6f..46767eb 100644
--- a/include/libnetfilter_log/libnetfilter_log.h
+++ b/include/libnetfilter_log/libnetfilter_log.h
@@ -89,4 +89,12 @@ extern int nflog_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t
 extern int nflog_attr_put_cfg_cmd(struct nlmsghdr *nlh, uint8_t cmd);
 extern int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr);
 
+enum nflog_output_type {
+	NFLOG_OUTPUT_XML	= 0,
+};
+
+int nflog_nlmsg_snprintf(char *buf, size_t bufsiz, const struct nlmsghdr *nlh,
+			 struct nlattr **attr, enum nflog_output_type type,
+			 uint32_t flags);
+
 #endif	/* __LIBNETFILTER_LOG_H */
diff --git a/src/libnetfilter_log.c b/src/libnetfilter_log.c
index e92576b..567049c 100644
--- a/src/libnetfilter_log.c
+++ b/src/libnetfilter_log.c
@@ -26,6 +26,7 @@
 #include <errno.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
+#include "internal.h"
 
 #include <libnetfilter_log/linux_nfnetlink_log.h>
 
@@ -78,11 +79,6 @@ struct nflog_g_handle
 	void *data;
 };
 
-struct nflog_data
-{
-	struct nfattr **nfa;
-};
-
 int nflog_errno;
 
 /***********************************************************************
diff --git a/src/nlmsg.c b/src/nlmsg.c
index a917a70..708e32d 100644
--- a/src/nlmsg.c
+++ b/src/nlmsg.c
@@ -9,6 +9,9 @@
 #include <arpa/inet.h>
 #include <linux/netfilter/nfnetlink_log.h>
 #include <libmnl/libmnl.h>
+#include <libnetfilter_log/libnetfilter_log.h>
+#include <errno.h>
+#include "internal.h"
 
 /**
  * \defgroup nlmsg Netlink message helper functions
@@ -157,5 +160,55 @@ int nflog_nlmsg_parse(const struct nlmsghdr *nlh, struct nlattr **attr)
 }
 
 /**
+ * nflog_nlmsg_snprintf - print a nflog nlattrs to a buffer
+ * \param buf buffer used to build the printable nflog
+ * \param bufsiz size of the buffer
+ * \param nlh netlink message (to get queue num in the futuer)
+ * \param attr pointer to a nflog attrs
+ * \param type print message type in enum nflog_output_type
+ * \param flags The flag that tell what to print into the buffer
+ *
+ * This function supports the following type - flags:
+ *
+ *   type: NFLOG_OUTPUT_XML
+ *	- NFLOG_XML_PREFIX: include the string prefix
+ *	- NFLOG_XML_HW: include the hardware link layer address
+ *	- NFLOG_XML_MARK: include the packet mark
+ *	- NFLOG_XML_DEV: include the device information
+ *	- NFLOG_XML_PHYSDEV: include the physical device information
+ *	- NFLOG_XML_PAYLOAD: include the payload (in hexadecimal)
+ *	- NFLOG_XML_TIME: include the timestamp
+ *	- NFLOG_XML_ALL: include all the logging information (all flags set)
+ *
+ * You can combine this flags with an binary OR.
+ *
+ * this function returns -1 and errno is explicitly set in case of
+ * failure, otherwise the length of the string that would have been
+ * printed into the buffer (in case that there is enough room in
+ * it). See snprintf() return value for more information.
+ */
+int nflog_nlmsg_snprintf(char *buf, size_t bufsiz, const struct nlmsghdr *nlh,
+			 struct nlattr **attr, enum nflog_output_type type,
+			 uint32_t flags)
+{
+	/* This is a hack to re-use the existing old API code. */
+	struct nflog_data nfad = {
+		.nfa	= (struct nfattr **)&attr[1],
+	};
+	int ret;
+
+	switch (type) {
+	case NFLOG_OUTPUT_XML:
+		ret = nflog_snprintf_xml(buf, bufsiz, &nfad, flags);
+		break;
+	default:
+		ret = -1;
+		errno = EOPNOTSUPP;
+		break;
+	}
+	return ret;
+}
+
+/**
  * @}
  */
diff --git a/utils/nf-log.c b/utils/nf-log.c
index d575b77..5f2a192 100644
--- a/utils/nf-log.c
+++ b/utils/nf-log.c
@@ -14,6 +14,7 @@ static int log_cb(const struct nlmsghdr *nlh, void *data)
 	struct nfulnl_msg_packet_hdr *ph = NULL;
 	const char *prefix = NULL;
 	uint32_t mark = 0;
+	char buf[4096];
 	int ret;
 
 	ret = nflog_nlmsg_parse(nlh, attrs);
@@ -31,6 +32,12 @@ static int log_cb(const struct nlmsghdr *nlh, void *data)
 		prefix ? prefix : "", ntohs(ph->hw_protocol), ph->hook,
 		mark);
 
+	ret = nflog_nlmsg_snprintf(buf, sizeof(buf), nlh, attrs,
+				   NFLOG_OUTPUT_XML, NFLOG_XML_ALL);
+	if (ret < 0)
+		return MNL_CB_ERROR;
+	printf("%s (ret=%d)\n", buf, ret);
+
 	return MNL_CB_OK;
 }
 
-- 
2.1.4

Re: [lnf-log PATCHv2 1/3] introduce new functions independent from libnfnetlink

[Pablo Neira Ayuso]

On Fri, Aug 21, 2015 at 09:26:08AM +0900, Ken-ichirou MATSUZAWA wrote:
> The libnetfilter_log.c file contains the old API, its use is
> discouraged since it depends on libnfnetlink.
> 
> The idea is to provide a set of helper functions that we can use in
> conjunction with libmnl, similar to what we have in
> libnetfilter_queue/nlmsg.c

Applied with minor change, thanks!

> +int nflog_attr_put_cfg_mode(struct nlmsghdr *nlh, uint8_t mode, uint32_t range)
> +{
> +	struct nfulnl_msg_config_mode nfmode = {
> +		.copy_mode = mode,
> +		.copy_range = htonl(range)
> +	};
> +
> +	mnl_attr_put(nlh, NFULA_CFG_MODE, sizeof(nfmode), &nfmode);
> +
> +	/* it may returns -1 in future */
> +	return 1;

This is now returning 0 instead.

So we reserve negative values for errors, 0 means success and >= 0 are
left unused for future use.

Re: [lnf-log PATCHv2 2/3] utils: take a example from libmnl and use new functions

[Pablo Neira Ayuso]

Also applied, thanks!

Re: [lnf-log PATCHv2 3/3] nlmsg: add printf function in conjunction with libmnl

[Pablo Neira Ayuso]

On Fri, Aug 21, 2015 at 09:30:33AM +0900, Ken-ichirou MATSUZAWA wrote:
> To printf nflog netlink message in XML, nflog_snprintf_xml can be
> used after converting nflog nlattrs to nflog_data, but we should not
> have any code that mixes both new and old, which handles nflog_data,
> APIs. The idea is to deprecate libnfnetlink and any client of that
> library at some point, that will take quite time though since we'll
> have to mark those old interfaces as deprecated.

this one also applied, thanks.