summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* src: make nfq_open_nfnl thread-safeFlorian Westphal2016-06-201-5/+4
| | | | | | | | | | | | | nfq_open_nfnl uses an intermediate static object, so when it is invoked by distinct threads at the same time there is a small chance that some threads end up with another threads nfq_handle pointer stored in ->data. The result is that the affected queue will be stuck because the thread that was supposed to service it is handling another/wrong queue instead. Tested-by: Michal Tesar <mtesar@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nlmsg: add lacking attributes validationKen-ichirou MATSUZAWA2015-10-051-0/+9
| | | | | | | | This patch adds four (actually two) attributes validation with comparing to current kernel header. Signed-off-by: Ken-ichirou MATSUZAWA <chamas@h4.dion.ne.jp> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add security context informationRoman Kubiak2015-06-306-3/+43
| | | | | | | | | | | | This commit adds security context information structures and functions. This will allow userspace to find the security context of each packet (if it exists) and make decisions based on that. It should work for SELinux and SMACK. Signed-off-by: Roman Kubiak <r.kubiak@samsung.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnetfilter_queue.h: Include <sys/time.h> for struct timevalFelix Janda2015-06-191-1/+1
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: Define _GNU_SOURCE to get members of tcphdr&ucphdrFelix Janda2015-05-292-0/+2
| | | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use stdint types everywhereFelix Janda2015-05-293-82/+82
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Sync with kernel headersFelix Janda2015-05-271-34/+37
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: tcp: insufficient sanitization in nfq_tcp_get_payload()Pablo Neira Ayuso2014-06-301-3/+7
| | | | | | | Similar to 7335cbe ("extra: fix wrong implementation in nfq_udp_get_payload"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: fix wrong implementation in nfq_udp_get_payloadTing-Wei Lan2014-06-301-4/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: use inet_ntop instead of inet_ntoaTing-Wei Lan2014-06-301-1/+5
| | | | | | | | The result of inet_ntoa() will be overwritten by the next call to inet_ntoa(), so using it twice in the same snprintf() call causes wrong result. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: fix wrong function name in the headerTing-Wei Lan2014-06-201-1/+1
| | | | | | There is no nfq_ip6hdr_snprintf(). nfq_ip6_snprintf() is the correct name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: add the parameter queue number in nfqnl_testÁlvaro Neira Ayuso2014-06-091-2/+11
| | | | | | | | This patch allows to stablish the number of the queue that we want to read the packets. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* utils: Remove unused variable in nfqnl_testÁlvaro Neira Ayuso2014-06-061-1/+0
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: PF_BIND/UNBIND is ignored in 3.8 and laterFlorian Westphal2014-04-243-2/+9
| | | | | | | | | | There is confusion on what this command actually does and why examples commonly PF_UNBIND at startup. Since these are obsolete document that its not needed starting with Linux 3.8. Signed-off-by: Florian Westphal <fw@strlen.de>
* utils: add example usage of nfq_get_uid and nfq_get_gidValentina Giusti2014-01-081-1/+15
| | | | | | | | [ Mangled this patch to indicate that this kernel does not support UID/GID retrieval not to confuse users --pablo ] Signed-off-by: Valentina Giusti <Valentina.Giusti@bmw-carit.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for UID/GID socket infoValentina Giusti2014-01-085-2/+62
| | | | | | | | With this patch libnetfilter_queue is able to parse UID/GID socket information. Signed-off-by: Valentina Giusti <Valentina.Giusti@bmw-carit.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: uclinux is also linuxGustavo Zacarias2013-09-171-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: extra: add prefix nfq_ to internal checksum functionsPablo Neira Ayuso2013-08-135-13/+13
| | | | | | | | These functions are internal and they belong to the libnetfilter_queue scope, so let's add the corresponding nfq_ prefix. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: avoid symbol namespace pollutionFlorian Westphal2013-08-134-4/+50
| | | | | | | | | | | | | | | As of f40eabb01 (add pkt_buff and protocol helper functions) libnetfilter_queue accidentally exports the internal function named 'checksum'. This is a bit too generic and may cause crashes with applications that worked fine before. This patch makes the functions checksum, checksum_tcpudp_ipv4 and checksum_tcpudp_ipv6 local by building with fvis-hidden and adding EXPORTs for the legacy api calls and the ones that seem to have missing EXPORT tags (mainly pktbuff api). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next'Pablo Neira Ayuso2013-08-135-21/+98
|\ | | | | | | | | | | | | | | Get the following patches into master: examples/nf-queue: receive large gso packets src: add new GSO handling capabilities examples/nf-queue: handle recv error, use larger buffer
| * examples/nf-queue: receive large gso packetsFlorian Westphal2013-04-301-2/+27
| | | | | | | | Signed-off-by: Florian Westphal <fw@strlen.de>
| * src: add new GSO handling capabilitiesFlorian Westphal2013-04-304-6/+47
| | | | | | | | | | | | allows userspace to ask for large gso packets via nfqueue. Signed-off-by: Florian Westphal <fw@strlen.de>
| * examples/nf-queue: handle recv error, use larger bufferFlorian Westphal2013-04-301-13/+24
| | | | | | | | | | | | | | | | | | We ask for 0xffff copy size, so we need a buffer that can hold 0xffff, plus a few more bytes to allow for netlink attributes. Also, turn off/handle ENOBUFS. Signed-off-by: Florian Westphal <fw@strlen.de>
* | fix valgrind errors of uninitialised byte during call to nfq_unbind_pfTamas Lengyel2013-06-011-0/+1
|/ | | | | | | | | | | | | | | | Valgrind generates error reports during a call to the nfq_unbind_pf function: ==00:00:00:08.662 22111== 4 errors in context 1 of 1: ==00:00:00:08.662 22111== Syscall param socketcall.sendto(msg) points to uninitialised byte(s) ... ==00:00:00:08.662 22111== Uninitialised value was created by a stack allocation ==00:00:00:08.662 22111== at 0x679C30B: __build_send_cfg_msg (libnetfilter_queue.c:178 Signed-off-by: Tamas K Lengyel <tamas.k.lengyel@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: don't install internal.hFlorian Westphal2013-04-271-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: document NFQA_CFG_F_CONNTRACK flagPablo Neira Ayuso2013-03-141-5/+9
| | | | | | Suggested by Eric Leblond. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doxygen: improve documentationEric Leblond2013-01-251-1/+21
| | | | | This patch improves the doxygen documentation and adds a reference to an external article.
* doxygen: improve fail-open documentation.Eric Leblond2013-01-251-0/+8
|
* examples: nf-queue: fix api usageFlorian Westphal2012-11-251-12/+12
| | | | | | | | | | | 1. struct nlattr *attr[NFQA_MAX+1] must be initialized. Otherwise, attr[FOO] might be non-null after parsing even if that attribute isn't present in the message. 2. mnl_attr_get_payload will never return NULL (if the attribute is NULL, it returns MNL_ATTR_HDRLEN.) Signed-off-by: Florian Westphal <fw@strlen.de>
* build: resolve automake-1.12 warningsJan Engelhardt2012-10-081-0/+1
| | | | | | | | am/ltlibrary.am: warning: 'libnetfilter_queue.la': linking libtool libraries using a non-POSIX archiver requires 'AM_PROG_AR' in 'configure.ac' Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* bump version to 1.0.2libnetfilter_queue-1.0.2Pablo Neira Ayuso2012-10-081-1/+1
| | | | | | | | | | | | | | LIBVERSION is already correctly updates, previous release was: 3:0:2 and this is: 4:0:3 This release includes new interfaces, but we're still backward compatible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix compilation warning in nfq_get_payloadPablo Neira Ayuso2012-08-211-1/+2
| | | | | | | libnetfilter_queue.c: In function 'nfq_get_payload': libnetfilter_queue.c:1116:8: warning: pointer targets in assignment differ in signedness [-Wpointer-sign] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nf-queue: fix compilation warning with gcc-4.7Pablo Neira Ayuso2012-08-202-8/+7
| | | | | | | nf-queue.c: In function ‘main’: nf-queue.c:146:12: warning: unused variable ‘id’ [-Wunused-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: update doxygen documentation for new API for libmnlPablo Neira Ayuso2012-08-206-7/+86
| | | | | | This patch updates the doxygen documentation for the new API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pktbuff: fix pktb_push, _pull and _put functionPablo Neira Ayuso2012-08-201-2/+5
| | | | | | Fix wrong arithmetics and missing pktb->len update Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: pktbuff: pktb_expand_tail return 0 if there is no room in the tailPablo Neira Ayuso2012-08-201-3/+9
| | | | | | | | | | | | pktb_expand_tail returns 0 if there is no room for the mangling. Note that we don't support dynamic reallocation, instead the caller is responsible for allocating the extra room via pktb_alloc according to the maximum amount of bytes it needs for the mangling. Since pkt_buff layout is not exposed, we can change this in the future if we prefer dynamic reallocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add mangle functions for IPv4/TCP and IPv4/UDPPablo Neira Ayuso2012-08-0611-4/+146
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add pkt_buff and protocol helper functionsPablo Neira Ayuso2012-08-0614-2/+910
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add new libnetfilter_queue API for libmnlPablo Neira Ayuso2012-08-0615-13/+510
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: implement API to set per-queue flagsKrishna Kumar2012-07-144-1/+53
| | | | | | | | | | Implement API to set per-queue flags. This is initially used to implement fail-open support in NFQUEUE. [ Pablo mangled this patch to bump LIBVERSION as well ] Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove stray empty variableJan Engelhardt2012-06-301-1/+1
| | | | | | | | | | | | | | | | Compilation can fail when libnfnetlink is not in a directory searched by default. Reason is the empty KERNELDIR variable which makes for a gcc command like: gcc -I. -I../include -I -Wall -I/usr/include/libnfnetlink-1.0.0+git28 -Wall -c libnetfilter_queue.c What one would expect is that gcc would search in the (non-existent) directory "-Wall" and just continue as usual, since -Wall is specified again. Instead, gcc versions before 4.6 attempt to search the (similarly non-existent) directory "-I/usr/[...]" and thus miss. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: remove unused lines in Makefile.amJan Engelhardt2012-06-241-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: remove unnecessary AC_EXEEXTJan Engelhardt2012-01-051-1/+0
| | | | | | | The result of AC_EXEEXT is never used -- there is no ${EXEEXT} to be found in the Makefiles. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: bump version to 1.0.1libnetfilter_queue-1.0.1Pablo Neira Ayuso2012-01-022-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: disable implicit .tar.gz archive generation and use POSIX modeJan Engelhardt2011-12-171-1/+2
|
* build: use AC_CONFIG_AUX_DIR and stash away toolsJan Engelhardt2011-12-172-5/+2
|
* Update .gitignoreJan Engelhardt2011-12-171-3/+3
| | | | Only ignore these paths if they are a directory.
* src: add notes on NF_STOLEN and NF_REPEAT to documentationFlorian Westphal2011-09-061-1/+6
| | | | | | | | | | | | The verdict NF_STOLEN must not be used. When using NF_REPEAT, one way to prevent re-queueing of the same packet is to also set an nfmark using nfq_set_verdict2, and set up the nefilter rules to only queue a packet when the mark is not (yet) set. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* src: add NFQNL_MSG_VERDICT_BATCH supportFlorian Westphal2011-09-063-6/+54
| | | | | | | | | | | | | add nfq_set_verdict_batch() and nfq_set_verdict_batch2 (to also set the nfmark of all packets). verdicts sent by the _batch variant will affect all queued skbs whose id is smaller or equal to the given id. This facility is available from Linux 3.1 onwards. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* build: fix file list warning with automake-1.9Jan Engelhardt2011-08-031-1/+1
| | | | | | | Makefile.am:12: EXTRA_DIST multiply defined in condition TRUE ... Makefile.am:3: ... "EXTRA_DIST" previously defined here Signed-off-by: Jan Engelhardt <jengelh@medozas.de>