Netfilter-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH libnetfilter_queue] src: doc: Document nfq_nlmsg_verdict_put_mark() and nfq_nlmsg_verdict_put_pkt()
@ 2019-10-27  8:38 Duncan Roe
  2019-10-29 23:54 ` Duncan Roe
  0 siblings, 1 reply; 3+ messages in thread
From: Duncan Roe @ 2019-10-27  8:38 UTC (permalink / raw)
  To: netfilter-devel

This completes the "Verdict helpers" module.

Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au>
---
 src/nlmsg.c | 45 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 44 insertions(+), 1 deletion(-)

diff --git a/src/nlmsg.c b/src/nlmsg.c
index d06e6db..c40a9e4 100644
--- a/src/nlmsg.c
+++ b/src/nlmsg.c
@@ -31,7 +31,7 @@
  */
 
 /**
- * nfq_nlmsg_verdict_put - Put a verdict into a Netlink header
+ * nfq_nlmsg_verdict_put - Put a verdict into a Netlink message
  * \param nlh Pointer to netlink message
  * \param id ID assigned to packet by netfilter
  * \param verdict verdict to return to netfilter (NF_ACCEPT, NF_DROP)
@@ -50,6 +50,15 @@ void nfq_nlmsg_verdict_put(struct nlmsghdr *nlh, int id, int verdict)
 	mnl_attr_put(nlh, NFQA_VERDICT_HDR, sizeof(vh), &vh);
 }
 
+/**
+ * nfq_nlmsg_verdict_put_mark - Put a packet mark into a netlink message
+ * \param nlh Pointer to netlink message
+ * \param mark Value of mark to put
+ *
+ * The mark becomes part of the packet's metadata, and may be tested by the *nft
+ * primary expression* **meta mark**
+ * \sa __nft__(1)
+ */
 EXPORT_SYMBOL
 void nfq_nlmsg_verdict_put_mark(struct nlmsghdr *nlh, uint32_t mark)
 {
@@ -57,6 +66,40 @@ void nfq_nlmsg_verdict_put_mark(struct nlmsghdr *nlh, uint32_t mark)
 }
 
 EXPORT_SYMBOL
+/**
+ * nfq_nlmsg_verdict_put_pkt - Put replacement packet content into a netlink
+ * message
+ * \param nlh Pointer to netlink message
+ * \param pkt Pointer to start of modified IP datagram
+ * \param plen Length of modified IP datagram
+ *
+ * There is only ever a need to return packet content if it has been modified.
+ * Usually one of the nfq_*_mangle_* functions does the modifying.
+ *
+ * This code snippet uses nfq_udp_mangle_ipv4. See nf-queue.c for
+ * context:
+ * \verbatim
+// main calls queue_cb (line 64) to process an enqueued packet:
+	// Extra variables
+	uint8_t *payload, *rep_data;
+	unsigned int match_offset, match_len, rep_len;
+
+	// The next line was commented-out (with payload void*)
+	payload = mnl_attr_get_payload(attr[NFQA_PAYLOAD]);
+	// Copy data to a packet buffer (allow 255 bytes for mangling).
+	pktb = pktb_alloc(AF_INET, payload, plen, 255);
+	// (decide that this packet needs mangling)
+	nfq_udp_mangle_ipv4(pktb, match_offset, match_len, rep_data, rep_len);
+	// Update IP Datagram length
+	plen += rep_len - match_len;
+
+	// Eventually nfq_send_verdict (line 39) gets called
+	// The received packet may or may not have been modified.
+	// Add this code before nfq_nlmsg_verdict_put call:
+	if (pktb_mangled(pktb))
+		nfq_nlmsg_verdict_put_pkt(nlh, pktb_data(pktb), plen);
+\endverbatim
+ */
 void nfq_nlmsg_verdict_put_pkt(struct nlmsghdr *nlh, const void *pkt,
 			       uint32_t plen)
 {
-- 
2.14.5


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH libnetfilter_queue] src: doc: Document nfq_nlmsg_verdict_put_mark() and nfq_nlmsg_verdict_put_pkt()
  2019-10-27  8:38 [PATCH libnetfilter_queue] src: doc: Document nfq_nlmsg_verdict_put_mark() and nfq_nlmsg_verdict_put_pkt() Duncan Roe
@ 2019-10-29 23:54 ` Duncan Roe
  2019-10-30  0:00   ` Florian Westphal
  0 siblings, 1 reply; 3+ messages in thread
From: Duncan Roe @ 2019-10-29 23:54 UTC (permalink / raw)
  To: Pablo Neira Ayuso; +Cc: Netfilter Development

Hi Pablo,

On Sun, Oct 27, 2019 at 07:38:04PM +1100, Duncan Roe wrote:
> This completes the "Verdict helpers" module.
>
> Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au>
> ---
>  src/nlmsg.c | 45 ++++++++++++++++++++++++++++++++++++++++++++-
>  1 file changed, 44 insertions(+), 1 deletion(-)
>
> diff --git a/src/nlmsg.c b/src/nlmsg.c
[...]

Anything wrong with this? It's the first of many libnetfilter_queue
documentation updates I was planning to send.

Is there anything I could do to make it more obvious (for you) that they are
doco updates?
 (I thought tagging them "src: doc:" would do that)
 (Should I send them to you cc: the list?)

Cheers ... Duncan.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [PATCH libnetfilter_queue] src: doc: Document nfq_nlmsg_verdict_put_mark() and nfq_nlmsg_verdict_put_pkt()
  2019-10-29 23:54 ` Duncan Roe
@ 2019-10-30  0:00   ` Florian Westphal
  0 siblings, 0 replies; 3+ messages in thread
From: Florian Westphal @ 2019-10-30  0:00 UTC (permalink / raw)
  To: Pablo Neira Ayuso, Netfilter Development

Duncan Roe <duncan_roe@optusnet.com.au> wrote:
> Anything wrong with this? It's the first of many libnetfilter_queue
> documentation updates I was planning to send.

Can't see anything wrong, so I applied this, thanks Duncan.

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, back to index

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-10-27  8:38 [PATCH libnetfilter_queue] src: doc: Document nfq_nlmsg_verdict_put_mark() and nfq_nlmsg_verdict_put_pkt() Duncan Roe
2019-10-29 23:54 ` Duncan Roe
2019-10-30  0:00   ` Florian Westphal

Netfilter-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/netfilter-devel/0 netfilter-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 netfilter-devel netfilter-devel/ https://lore.kernel.org/netfilter-devel \
		netfilter-devel@vger.kernel.org
	public-inbox-index netfilter-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.netfilter-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git