netfilter

1. 官方资源
官方网址是：http://netfilter.org/projects/libnetfilter_queue/
截止2017年2月16日，最新版本是1.0.2 , 这个版本的依赖libnfnetlink和libmnl并要求linux内核 2.6.14以上.
比较早的版本1.0.1多一个libmnl. 这些也体现在示例代码里。

2. 安装与设置
下载完源码后，先安装libnfnetlink和libmnl，再安装netfilter_queue

2.1 编译

configure, make ,make install (注意make install的时候需要sudo)

2.2 检查

在安装完所有库之后，我们可以到/usr/local/include查看这三个库的头文件是否存在，他们的目录分别是”libmnl”, “libnetfilter_queue”和”libnfnetlink”.

3. 样例代码

3.1 netfilter_queue 1.0.2版本的样例代码在 libnetfilter_queue-1.0.2/examples里”nf-queue.c”, 如下：

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <time.h>
#include <arpa/inet.h>#include <libmnl/libmnl.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nfnetlink.h>#include <linux/types.h>
#include <linux/netfilter/nfnetlink_queue.h>#include <libnetfilter_queue/libnetfilter_queue.h>static struct mnl_socket *nl;static struct nlmsghdr *
nfq_hdr_put(char *buf, int type, uint32_t queue_num)
{struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | type;nlh->nlmsg_flags = NLM_F_REQUEST;struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));nfg->nfgen_family = AF_UNSPEC;nfg->version = NFNETLINK_V0;nfg->res_id = htons(queue_num);return nlh;
}#处理后返回给netfilter对数据包的处理
static int
nfq_send_verdict(int queue_num, uint32_t id)
{char buf[MNL_SOCKET_BUFFER_SIZE];struct nlmsghdr *nlh;int ret;nlh = nfq_hdr_put(buf, NFQNL_MSG_VERDICT, queue_num);nfq_nlmsg_verdict_put(nlh, id, NF_ACCEPT);if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {perror("mnl_socket_send");exit(EXIT_FAILURE);}return ret;
}static int queue_cb(const struct nlmsghdr *nlh, void *data)
{struct nfqnl_msg_packet_hdr *ph = NULL;struct nlattr *attr[NFQA_MAX+1];uint32_t id = 0;struct nfgenmsg *nfg;if (nfq_nlmsg_parse(nlh, attr) < 0) {perror("problems parsing");return MNL_CB_ERROR;}nfg = mnl_nlmsg_get_payload(nlh);ph = (struct nfqnl_msg_packet_hdr *)mnl_attr_get_payload(attr[NFQA_PACKET_HDR]);if (ph == NULL) {perror("problems retrieving metaheader");return MNL_CB_ERROR;}id = ntohl(ph->packet_id);printf("packet received (id=%u hw=0x%04x hook=%u)\n",id, ntohs(ph->hw_protocol), ph->hook);nfq_send_verdict(ntohs(nfg->res_id), id);return MNL_CB_OK;
}int main(int argc, char *argv[])
{char buf[MNL_SOCKET_BUFFER_SIZE];struct nlmsghdr *nlh;int ret;unsigned int portid, queue_num;#这里的queue_num是从参数里读进来的，在iptables命令里可以设置if (argc != 2) {printf("Usage: %s [queue_num]\n", argv[0]);exit(EXIT_FAILURE);}queue_num = atoi(argv[1]);nl = mnl_socket_open(NETLINK_NETFILTER);if (nl == NULL) {perror("mnl_socket_open");exit(EXIT_FAILURE);}if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {perror("mnl_socket_bind");exit(EXIT_FAILURE);}portid = mnl_socket_get_portid(nl);nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0);nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_UNBIND);if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {perror("mnl_socket_send");exit(EXIT_FAILURE);}nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0);nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_BIND);if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {perror("mnl_socket_send");exit(EXIT_FAILURE);}nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, queue_num);nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND);if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {perror("mnl_socket_send");exit(EXIT_FAILURE);}nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, queue_num);nfq_nlmsg_cfg_put_params(nlh, NFQNL_COPY_PACKET, 0xffff);if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {perror("mnl_socket_send");exit(EXIT_FAILURE);}ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));if (ret == -1) {perror("mnl_socket_recvfrom");exit(EXIT_FAILURE);}while (ret > 0) {ret = mnl_cb_run(buf, ret, 0, portid, queue_cb, NULL);if (ret < 0){perror("mnl_cb_run");exit(EXIT_FAILURE);}ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));if (ret == -1) {perror("mnl_socket_recvfrom");exit(EXIT_FAILURE);}}mnl_socket_close(nl);return 0;
}

在该文件夹内运行

make nf-queue

得到 nf-queue

另外，还有一个示例代码在“libnetfilter_queue-1.0.2/utils/nfqnl_test.c”，这里不细谈，同样make之后可以测试。

3.2 设置iptables

iptables -A OUTPUT -j NFQUEUE --queue-num 111

这里把发出的数据包都转到queue-num为111的用户态程序。

3.3 运行 nf-queue

./nf-queue 111

得到

....
packet received (id=476 hw=0x0800 hook=3)
packet received (id=477 hw=0x0800 hook=3)
packet received (id=478 hw=0x0800 hook=3)
packet received (id=479 hw=0x0800 hook=3)
packet received (id=480 hw=0x0800 hook=3)
packet received (id=481 hw=0x0800 hook=3)
packet received (id=482 hw=0x0800 hook=3)
packet received (id=483 hw=0x0800 hook=3)
packet received (id=484 hw=0x0800 hook=3)

证明用户态的程序已经收到了数据包。

4. 性能相关
关于netfilter_queue的性能问题，http://www.netfilter.org/projects/libnetfilter_queue/doxygen/index.html 里提到了几个可以注意的点：

To improve your libnetfilter_queue application in terms of performance, you may consider the following tweaks:

increase the default socket buffer size by means of nfnl_rcvbufsiz().
set nice value of your process to -20 (maximum priority).
set the CPU affinity of your process to a spare core that is not used to handle NIC interruptions.
set NETLINK_NO_ENOBUFS socket option to avoid receiving ENOBUFS errors (requires Linux kernel >= 2.6.30).
see –queue-balance option in NFQUEUE target for multi-threaded apps (it requires Linux kernel >= 2.6.31).

netfilter_queue相关推荐

使用netfilter_queue改包笔记
系统:centos 7 准备:安装libnetfilter_queue模块,可以yum安装,也可以网上下载rpm包安装简介:使用iptables在NAT表上创建DNAT与SNAT规则,对数据包进行转 ...
写了个Linux包过滤防火墙
花几天写了个so easy的Linux包过滤防火墙,估计实际意义不是很大.防火墙包括用户态执行程序和内核模块,内核模块完全可以用iptable代替.由于在编写的过程一开始写的是内核模块所以就直接用上来 ...
Linux内核：网络过滤器简介与示例代码
目录简单的例子实施用户空间处理 Linux的一大优点是其网络功能.路由器,交换机等许多网络产品均基于嵌入式Linux操作系统. 网络过滤是Linux内核中很好的基础结构,它使我们能够过滤和操作网 ...
从ip_queue到nfnetlink_queue(上)
本文档的Copyleft归yfydz所有,使用GPL发布,可以自由拷贝,转载,转载时请保持文档的完整性,严禁用于任何商业用途. msn: yfydz_no1@hotmail.com 来源:http:/ ...
Linux 内核开发 - NetFilter
入门编写一个简单的内核模块 #include<linux/module.h> #include<linux/kernel.h> #include<linux/init. ...

netfilter_queue

netfilter_queue相关推荐

最新文章

热门文章