From 8b6ab7a3a503be66216db7c046646fcd15c28771 Mon Sep 17 00:00:00 2001 From: Krishna Kumar Date: Wed, 6 Jun 2012 00:59:00 +0000 Subject: src: implement API to set per-queue flags Implement API to set per-queue flags. This is initially used to implement fail-open support in NFQUEUE. [ Pablo mangled this patch to bump LIBVERSION as well ] Signed-off-by: Krishna Kumar Signed-off-by: Pablo Neira Ayuso --- src/Makefile.am | 2 +- src/libnetfilter_queue.c | 42 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/Makefile.am b/src/Makefile.am index d49e738..2196aef 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -18,7 +18,7 @@ # set age to 0. # # -LIBVERSION=3:0:2 +LIBVERSION=4:0:3 include ${top_srcdir}/Make_global.am diff --git a/src/libnetfilter_queue.c b/src/libnetfilter_queue.c index d57a523..dcfc36d 100644 --- a/src/libnetfilter_queue.c +++ b/src/libnetfilter_queue.c @@ -601,6 +601,48 @@ int nfq_set_mode(struct nfq_q_handle *qh, return nfnl_query(qh->h->nfnlh, &u.nmh); } +/** + * nfq_set_queue_flags - set flags (options) for the kernel queue + * \param qh Netfilter queue handle obtained by call to nfq_create_queue(). + * \param mask specifies which flag bits to modify + * \param flag bitmask of flags + * + * Here's a little code snippet to show how to use this API: + * \verbatim + uint32_t flags = NFQA_CFG_F_FAIL_OPEN; + uint32_t mask = NFQA_CFG_F_FAIL_OPEN; + + printf("Enabling fail-open on this q\n"); + err = nfq_set_queue_flags(qh, mask, flags); + + printf("Disabling fail-open on this q\n"); + flags &= ~NFQA_CFG_F_FAIL_OPEN; + err = nfq_set_queue_flags(qh, mask, flags); +\endverbatim + * \return -1 on error with errno set appropriately; =0 otherwise. + */ +int nfq_set_queue_flags(struct nfq_q_handle *qh, + uint32_t mask, uint32_t flags) +{ + union { + char buf[NFNL_HEADER_LEN + +NFA_LENGTH(sizeof(mask) + +NFA_LENGTH(sizeof(flags)))]; + struct nlmsghdr nmh; + } u; + + mask = htonl(mask); + flags = htonl(flags); + + nfnl_fill_hdr(qh->h->nfnlssh, &u.nmh, 0, AF_UNSPEC, qh->id, + NFQNL_MSG_CONFIG, NLM_F_REQUEST|NLM_F_ACK); + + nfnl_addattr32(&u.nmh, sizeof(u), NFQA_CFG_FLAGS, flags); + nfnl_addattr32(&u.nmh, sizeof(u), NFQA_CFG_MASK, mask); + + return nfnl_query(qh->h->nfnlh, &u.nmh); +} + /** * nfq_set_queue_maxlen - Set kernel queue maximum length parameter * \param qh Netfilter queue handle obtained by call to nfq_create_queue(). -- cgit v1.2.3