summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* libnetfilter_queue.h: Include <sys/time.h> for struct timevalFelix Janda2015-06-191-1/+1
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: Define _GNU_SOURCE to get members of tcphdr&ucphdrFelix Janda2015-05-292-0/+2
| | | | | | | | | The source uses linux names for members of tcphdr. For example "source" instead of "th_sport", ... musl libc's headers need _GNU_SOURCE defined in order to expose these. Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: Use stdint types everywhereFelix Janda2015-05-293-82/+82
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: Sync with kernel headersFelix Janda2015-05-271-34/+37
| | | | | Signed-off-by: Felix Janda <felix.janda@posteo.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: tcp: insufficient sanitization in nfq_tcp_get_payload()Pablo Neira Ayuso2014-06-301-3/+7
| | | | | | | Similar to 7335cbe ("extra: fix wrong implementation in nfq_udp_get_payload"). Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: fix wrong implementation in nfq_udp_get_payloadTing-Wei Lan2014-06-301-4/+8
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: use inet_ntop instead of inet_ntoaTing-Wei Lan2014-06-301-1/+5
| | | | | | | | The result of inet_ntoa() will be overwritten by the next call to inet_ntoa(), so using it twice in the same snprintf() call causes wrong result. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* include: fix wrong function name in the headerTing-Wei Lan2014-06-201-1/+1
| | | | | | There is no nfq_ip6hdr_snprintf(). nfq_ip6_snprintf() is the correct name. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* utils: add the parameter queue number in nfqnl_testÁlvaro Neira Ayuso2014-06-091-2/+11
| | | | | | | | This patch allows to stablish the number of the queue that we want to read the packets. Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* utils: Remove unused variable in nfqnl_testÁlvaro Neira Ayuso2014-06-061-1/+0
| | | | | Signed-off-by: Alvaro Neira Ayuso <alvaroneay@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: PF_BIND/UNBIND is ignored in 3.8 and laterFlorian Westphal2014-04-243-2/+9
| | | | | | | | | | There is confusion on what this command actually does and why examples commonly PF_UNBIND at startup. Since these are obsolete document that its not needed starting with Linux 3.8. Signed-off-by: Florian Westphal <fw@strlen.de>
* utils: add example usage of nfq_get_uid and nfq_get_gidValentina Giusti2014-01-081-1/+15
| | | | | | | | [ Mangled this patch to indicate that this kernel does not support UID/GID retrieval not to confuse users --pablo ] Signed-off-by: Valentina Giusti <Valentina.Giusti@bmw-carit.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add support for UID/GID socket infoValentina Giusti2014-01-085-2/+62
| | | | | | | | With this patch libnetfilter_queue is able to parse UID/GID socket information. Signed-off-by: Valentina Giusti <Valentina.Giusti@bmw-carit.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* configure: uclinux is also linuxGustavo Zacarias2013-09-171-1/+1
| | | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: extra: add prefix nfq_ to internal checksum functionsPablo Neira Ayuso2013-08-135-13/+13
| | | | | | | | These functions are internal and they belong to the libnetfilter_queue scope, so let's add the corresponding nfq_ prefix. Suggested-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: avoid symbol namespace pollutionFlorian Westphal2013-08-134-4/+50
| | | | | | | | | | | | | | | As of f40eabb01 (add pkt_buff and protocol helper functions) libnetfilter_queue accidentally exports the internal function named 'checksum'. This is a bit too generic and may cause crashes with applications that worked fine before. This patch makes the functions checksum, checksum_tcpudp_ipv4 and checksum_tcpudp_ipv6 local by building with fvis-hidden and adding EXPORTs for the legacy api calls and the ones that seem to have missing EXPORT tags (mainly pktbuff api). Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Merge branch 'next'Pablo Neira Ayuso2013-08-135-21/+98
|\ | | | | | | | | | | | | | | Get the following patches into master: examples/nf-queue: receive large gso packets src: add new GSO handling capabilities examples/nf-queue: handle recv error, use larger buffer
| * examples/nf-queue: receive large gso packetsFlorian Westphal2013-04-301-2/+27
| | | | | | | | Signed-off-by: Florian Westphal <fw@strlen.de>
| * src: add new GSO handling capabilitiesFlorian Westphal2013-04-304-6/+47
| | | | | | | | | | | | allows userspace to ask for large gso packets via nfqueue. Signed-off-by: Florian Westphal <fw@strlen.de>
| * examples/nf-queue: handle recv error, use larger bufferFlorian Westphal2013-04-301-13/+24
| | | | | | | | | | | | | | | | | | We ask for 0xffff copy size, so we need a buffer that can hold 0xffff, plus a few more bytes to allow for netlink attributes. Also, turn off/handle ENOBUFS. Signed-off-by: Florian Westphal <fw@strlen.de>
* | fix valgrind errors of uninitialised byte during call to nfq_unbind_pfTamas Lengyel2013-06-011-0/+1
|/ | | | | | | | | | | | | | | | Valgrind generates error reports during a call to the nfq_unbind_pf function: ==00:00:00:08.662 22111== 4 errors in context 1 of 1: ==00:00:00:08.662 22111== Syscall param socketcall.sendto(msg) points to uninitialised byte(s) ... ==00:00:00:08.662 22111== Uninitialised value was created by a stack allocation ==00:00:00:08.662 22111== at 0x679C30B: __build_send_cfg_msg (libnetfilter_queue.c:178 Signed-off-by: Tamas K Lengyel <tamas.k.lengyel@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* build: don't install internal.hFlorian Westphal2013-04-271-1/+1
| | | | Signed-off-by: Florian Westphal <fw@strlen.de>
* src: document NFQA_CFG_F_CONNTRACK flagPablo Neira Ayuso2013-03-141-5/+9
| | | | | | Suggested by Eric Leblond. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doxygen: improve documentationEric Leblond2013-01-251-1/+21
| | | | | This patch improves the doxygen documentation and adds a reference to an external article.
* doxygen: improve fail-open documentation.Eric Leblond2013-01-251-0/+8
|
* examples: nf-queue: fix api usageFlorian Westphal2012-11-251-12/+12
| | | | | | | | | | | 1. struct nlattr *attr[NFQA_MAX+1] must be initialized. Otherwise, attr[FOO] might be non-null after parsing even if that attribute isn't present in the message. 2. mnl_attr_get_payload will never return NULL (if the attribute is NULL, it returns MNL_ATTR_HDRLEN.) Signed-off-by: Florian Westphal <fw@strlen.de>
* build: resolve automake-1.12 warningsJan Engelhardt2012-10-081-0/+1
| | | | | | | | am/ltlibrary.am: warning: 'libnetfilter_queue.la': linking libtool libraries using a non-POSIX archiver requires 'AM_PROG_AR' in 'configure.ac' Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* bump version to 1.0.2libnetfilter_queue-1.0.2Pablo Neira Ayuso2012-10-081-1/+1
| | | | | | | | | | | | | | LIBVERSION is already correctly updates, previous release was: 3:0:2 and this is: 4:0:3 This release includes new interfaces, but we're still backward compatible. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* fix compilation warning in nfq_get_payloadPablo Neira Ayuso2012-08-211-1/+2
| | | | | | | libnetfilter_queue.c: In function 'nfq_get_payload': libnetfilter_queue.c:1116:8: warning: pointer targets in assignment differ in signedness [-Wpointer-sign] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* examples: nf-queue: fix compilation warning with gcc-4.7Pablo Neira Ayuso2012-08-202-8/+7
| | | | | | | nf-queue.c: In function ‘main’: nf-queue.c:146:12: warning: unused variable ‘id’ [-Wunused-variable] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: update doxygen documentation for new API for libmnlPablo Neira Ayuso2012-08-206-7/+86
| | | | | | This patch updates the doxygen documentation for the new API. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* pktbuff: fix pktb_push, _pull and _put functionPablo Neira Ayuso2012-08-201-2/+5
| | | | | | Fix wrong arithmetics and missing pktb->len update Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* extra: pktbuff: pktb_expand_tail return 0 if there is no room in the tailPablo Neira Ayuso2012-08-201-3/+9
| | | | | | | | | | | | pktb_expand_tail returns 0 if there is no room for the mangling. Note that we don't support dynamic reallocation, instead the caller is responsible for allocating the extra room via pktb_alloc according to the maximum amount of bytes it needs for the mangling. Since pkt_buff layout is not exposed, we can change this in the future if we prefer dynamic reallocation. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add mangle functions for IPv4/TCP and IPv4/UDPPablo Neira Ayuso2012-08-0611-4/+146
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add pkt_buff and protocol helper functionsPablo Neira Ayuso2012-08-0614-2/+910
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* add new libnetfilter_queue API for libmnlPablo Neira Ayuso2012-08-0615-13/+510
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: implement API to set per-queue flagsKrishna Kumar2012-07-144-1/+53
| | | | | | | | | | Implement API to set per-queue flags. This is initially used to implement fail-open support in NFQUEUE. [ Pablo mangled this patch to bump LIBVERSION as well ] Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: remove stray empty variableJan Engelhardt2012-06-301-1/+1
| | | | | | | | | | | | | | | | Compilation can fail when libnfnetlink is not in a directory searched by default. Reason is the empty KERNELDIR variable which makes for a gcc command like: gcc -I. -I../include -I -Wall -I/usr/include/libnfnetlink-1.0.0+git28 -Wall -c libnetfilter_queue.c What one would expect is that gcc would search in the (non-existent) directory "-Wall" and just continue as usual, since -Wall is specified again. Instead, gcc versions before 4.6 attempt to search the (similarly non-existent) directory "-I/usr/[...]" and thus miss. Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: remove unused lines in Makefile.amJan Engelhardt2012-06-241-2/+2
| | | | Signed-off-by: Jan Engelhardt <jengelh@inai.de>
* build: remove unnecessary AC_EXEEXTJan Engelhardt2012-01-051-1/+0
| | | | | | | The result of AC_EXEEXT is never used -- there is no ${EXEEXT} to be found in the Makefiles. Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: bump version to 1.0.1libnetfilter_queue-1.0.1Pablo Neira Ayuso2012-01-022-2/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: disable implicit .tar.gz archive generation and use POSIX modeJan Engelhardt2011-12-171-1/+2
|
* build: use AC_CONFIG_AUX_DIR and stash away toolsJan Engelhardt2011-12-172-5/+2
|
* Update .gitignoreJan Engelhardt2011-12-171-3/+3
| | | | Only ignore these paths if they are a directory.
* src: add notes on NF_STOLEN and NF_REPEAT to documentationFlorian Westphal2011-09-061-1/+6
| | | | | | | | | | | | The verdict NF_STOLEN must not be used. When using NF_REPEAT, one way to prevent re-queueing of the same packet is to also set an nfmark using nfq_set_verdict2, and set up the nefilter rules to only queue a packet when the mark is not (yet) set. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* src: add NFQNL_MSG_VERDICT_BATCH supportFlorian Westphal2011-09-063-6/+54
| | | | | | | | | | | | | add nfq_set_verdict_batch() and nfq_set_verdict_batch2 (to also set the nfmark of all packets). verdicts sent by the _batch variant will affect all queued skbs whose id is smaller or equal to the given id. This facility is available from Linux 3.1 onwards. Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo@gnumonks.org>
* build: fix file list warning with automake-1.9Jan Engelhardt2011-08-031-1/+1
| | | | | | | Makefile.am:12: EXTRA_DIST multiply defined in condition TRUE ... Makefile.am:3: ... "EXTRA_DIST" previously defined here Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: fix error with automake-1.9Jan Engelhardt2011-08-012-0/+2
| | | | | | | src/Makefile.am: C objects in subdir but "AM_PROG_CC_C_O" not in "configure.ac" Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
* build: Linux kernel-style for compilation messagesPablo Neira Ayuso2011-03-151-0/+3
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: fix `make distcheck'Pablo Neira Ayuso2011-01-061-0/+2
| | | | Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>