Deleted Added
sdiff udiff text old ( 241231 ) new ( 251129 )
full compact
pcap-netfilter-linux.c (241231) pcap-netfilter-linux.c (251129)
1/*
2 * Copyright (c) 2011 Jakub Zawadzki
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *

--- 37 unchanged lines hidden (view full) ---

46#include <arpa/inet.h>
47
48#include <time.h>
49#include <sys/time.h>
50#include <netinet/in.h>
51#include <linux/types.h>
52
53#include <linux/netlink.h>
1/*
2 * Copyright (c) 2011 Jakub Zawadzki
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *

--- 37 unchanged lines hidden (view full) ---

46#include <arpa/inet.h>
47
48#include <time.h>
49#include <sys/time.h>
50#include <netinet/in.h>
51#include <linux/types.h>
52
53#include <linux/netlink.h>
54#include <linux/netfilter.h>
54#include <linux/netfilter/nfnetlink.h>
55#include <linux/netfilter/nfnetlink_log.h>
55#include <linux/netfilter/nfnetlink.h>
56#include <linux/netfilter/nfnetlink_log.h>
57#include <linux/netfilter/nfnetlink_queue.h>
56
58
59/* NOTE: if your program drops privilages after pcap_activate() it WON'T work with nfqueue.
60 * It took me quite some time to debug ;/
61 *
62 * Sending any data to nfnetlink socket requires CAP_NET_ADMIN privilages,
63 * and in nfqueue we need to send verdict reply after recving packet.
64 *
65 * In tcpdump you can disable dropping privilages with -Z root
66 */
67
57#include "pcap-netfilter-linux.h"
58
59#define HDR_LENGTH (NLMSG_LENGTH(NLMSG_ALIGN(sizeof(struct nfgenmsg))))
60
61#define NFLOG_IFACE "nflog"
68#include "pcap-netfilter-linux.h"
69
70#define HDR_LENGTH (NLMSG_LENGTH(NLMSG_ALIGN(sizeof(struct nfgenmsg))))
71
72#define NFLOG_IFACE "nflog"
73#define NFQUEUE_IFACE "nfqueue"
62
74
75typedef enum { OTHER = -1, NFLOG, NFQUEUE } nftype_t;
76
77static int nfqueue_send_verdict(const pcap_t *handle, u_int16_t group_id, u_int32_t id, u_int32_t verdict);
78
63static int
79static int
64nflog_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
80netfilter_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
65{
66 const unsigned char *buf;
67 int count = 0;
68 int len;
69
70 /* ignore interrupt system call error */
71 do {
72 len = recv(handle->fd, handle->buffer, handle->bufsize, 0);

--- 7 unchanged lines hidden (view full) ---

80 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't receive packet %d:%s", errno, pcap_strerror(errno));
81 return -1;
82 }
83
84 buf = handle->buffer;
85 while (len >= NLMSG_SPACE(0)) {
86 const struct nlmsghdr *nlh = (const struct nlmsghdr *) buf;
87 u_int32_t msg_len;
81{
82 const unsigned char *buf;
83 int count = 0;
84 int len;
85
86 /* ignore interrupt system call error */
87 do {
88 len = recv(handle->fd, handle->buffer, handle->bufsize, 0);

--- 7 unchanged lines hidden (view full) ---

96 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't receive packet %d:%s", errno, pcap_strerror(errno));
97 return -1;
98 }
99
100 buf = handle->buffer;
101 while (len >= NLMSG_SPACE(0)) {
102 const struct nlmsghdr *nlh = (const struct nlmsghdr *) buf;
103 u_int32_t msg_len;
104 nftype_t type = OTHER;
88
89 if (nlh->nlmsg_len < sizeof(struct nlmsghdr) || len < nlh->nlmsg_len) {
90 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Message truncated: (got: %d) (nlmsg_len: %u)", len, nlh->nlmsg_len);
91 return -1;
92 }
93
94 if (NFNL_SUBSYS_ID(nlh->nlmsg_type) == NFNL_SUBSYS_ULOG &&
95 NFNL_MSG_TYPE(nlh->nlmsg_type) == NFULNL_MSG_PACKET)
105
106 if (nlh->nlmsg_len < sizeof(struct nlmsghdr) || len < nlh->nlmsg_len) {
107 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Message truncated: (got: %d) (nlmsg_len: %u)", len, nlh->nlmsg_len);
108 return -1;
109 }
110
111 if (NFNL_SUBSYS_ID(nlh->nlmsg_type) == NFNL_SUBSYS_ULOG &&
112 NFNL_MSG_TYPE(nlh->nlmsg_type) == NFULNL_MSG_PACKET)
96 {
113 type = NFLOG;
114
115 if (NFNL_SUBSYS_ID(nlh->nlmsg_type) == NFNL_SUBSYS_QUEUE &&
116 NFNL_MSG_TYPE(nlh->nlmsg_type) == NFQNL_MSG_PACKET)
117 type = NFQUEUE;
118
119 if (type != OTHER) {
97 const unsigned char *payload = NULL;
98 struct pcap_pkthdr pkth;
99
120 const unsigned char *payload = NULL;
121 struct pcap_pkthdr pkth;
122
123 const struct nfgenmsg *nfg;
124 int id = 0;
125
100 if (handle->linktype != DLT_NFLOG) {
101 const struct nfattr *payload_attr = NULL;
102
103 if (nlh->nlmsg_len < HDR_LENGTH) {
104 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Malformed message: (nlmsg_len: %u)", nlh->nlmsg_len);
105 return -1;
106 }
107
126 if (handle->linktype != DLT_NFLOG) {
127 const struct nfattr *payload_attr = NULL;
128
129 if (nlh->nlmsg_len < HDR_LENGTH) {
130 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Malformed message: (nlmsg_len: %u)", nlh->nlmsg_len);
131 return -1;
132 }
133
134 nfg = NLMSG_DATA(nlh);
108 if (nlh->nlmsg_len > HDR_LENGTH) {
135 if (nlh->nlmsg_len > HDR_LENGTH) {
109 struct nfattr *attr = NFM_NFA(NLMSG_DATA(nlh));
136 struct nfattr *attr = NFM_NFA(nfg);
110 int attr_len = nlh->nlmsg_len - NLMSG_ALIGN(HDR_LENGTH);
111
112 while (NFA_OK(attr, attr_len)) {
137 int attr_len = nlh->nlmsg_len - NLMSG_ALIGN(HDR_LENGTH);
138
139 while (NFA_OK(attr, attr_len)) {
113 switch (NFA_TYPE(attr)) {
114 case NFULA_PAYLOAD:
115 payload_attr = attr;
116 break;
140 if (type == NFQUEUE) {
141 switch (NFA_TYPE(attr)) {
142 case NFQA_PACKET_HDR:
143 {
144 const struct nfqnl_msg_packet_hdr *pkt_hdr = (const struct nfqnl_msg_packet_hdr *) NFA_DATA(attr);
145
146 id = ntohl(pkt_hdr->packet_id);
147 break;
148 }
149 case NFQA_PAYLOAD:
150 payload_attr = attr;
151 break;
152 }
153
154 } else if (type == NFLOG) {
155 switch (NFA_TYPE(attr)) {
156 case NFULA_PAYLOAD:
157 payload_attr = attr;
158 break;
159 }
117 }
118 attr = NFA_NEXT(attr, attr_len);
119 }
120 }
121
122 if (payload_attr) {
123 payload = NFA_DATA(payload_attr);
124 pkth.len = pkth.caplen = NFA_PAYLOAD(payload_attr);

--- 11 unchanged lines hidden (view full) ---

136 if (handle->fcode.bf_insns == NULL ||
137 bpf_filter(handle->fcode.bf_insns, payload, pkth.len, pkth.caplen))
138 {
139 handle->md.packets_read++;
140 callback(user, &pkth, payload);
141 count++;
142 }
143 }
160 }
161 attr = NFA_NEXT(attr, attr_len);
162 }
163 }
164
165 if (payload_attr) {
166 payload = NFA_DATA(payload_attr);
167 pkth.len = pkth.caplen = NFA_PAYLOAD(payload_attr);

--- 11 unchanged lines hidden (view full) ---

179 if (handle->fcode.bf_insns == NULL ||
180 bpf_filter(handle->fcode.bf_insns, payload, pkth.len, pkth.caplen))
181 {
182 handle->md.packets_read++;
183 callback(user, &pkth, payload);
184 count++;
185 }
186 }
187
188 if (type == NFQUEUE) {
189 /* XXX, possible responses: NF_DROP, NF_ACCEPT, NF_STOLEN, NF_QUEUE, NF_REPEAT, NF_STOP */
190 nfqueue_send_verdict(handle, ntohs(nfg->res_id), id, NF_ACCEPT);
191 }
144 }
145
146 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
147 if (msg_len > len)
148 msg_len = len;
149
150 len -= msg_len;
151 buf += msg_len;

--- 26 unchanged lines hidden (view full) ---

178
179struct my_nfattr {
180 u_int16_t nfa_len;
181 u_int16_t nfa_type;
182 void *data;
183};
184
185static int
192 }
193
194 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
195 if (msg_len > len)
196 msg_len = len;
197
198 len -= msg_len;
199 buf += msg_len;

--- 26 unchanged lines hidden (view full) ---

226
227struct my_nfattr {
228 u_int16_t nfa_len;
229 u_int16_t nfa_type;
230 void *data;
231};
232
233static int
186nflog_send_config_msg(const pcap_t *handle, u_int8_t family, u_int16_t res_id, const struct my_nfattr *mynfa)
234netfilter_send_config_msg(const pcap_t *handle, u_int16_t msg_type, int ack, u_int8_t family, u_int16_t res_id, const struct my_nfattr *mynfa)
187{
188 char buf[1024] __attribute__ ((aligned));
189
190 struct nlmsghdr *nlh = (struct nlmsghdr *) buf;
191 struct nfgenmsg *nfg = (struct nfgenmsg *) (buf + sizeof(struct nlmsghdr));
192
193 struct sockaddr_nl snl;
194 static unsigned int seq_id;
195
196 if (!seq_id)
197 seq_id = time(NULL);
198 ++seq_id;
199
200 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
235{
236 char buf[1024] __attribute__ ((aligned));
237
238 struct nlmsghdr *nlh = (struct nlmsghdr *) buf;
239 struct nfgenmsg *nfg = (struct nfgenmsg *) (buf + sizeof(struct nlmsghdr));
240
241 struct sockaddr_nl snl;
242 static unsigned int seq_id;
243
244 if (!seq_id)
245 seq_id = time(NULL);
246 ++seq_id;
247
248 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nfgenmsg));
201 nlh->nlmsg_type = (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG;
202 nlh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
249 nlh->nlmsg_type = msg_type;
250 nlh->nlmsg_flags = NLM_F_REQUEST | (ack ? NLM_F_ACK : 0);
203 nlh->nlmsg_pid = 0; /* to kernel */
204 nlh->nlmsg_seq = seq_id;
205
206 nfg->nfgen_family = family;
207 nfg->version = NFNETLINK_V0;
208 nfg->res_id = htons(res_id);
209
210 if (mynfa) {

--- 6 unchanged lines hidden (view full) ---

217 }
218
219 memset(&snl, 0, sizeof(snl));
220 snl.nl_family = AF_NETLINK;
221
222 if (sendto(handle->fd, nlh, nlh->nlmsg_len, 0, (struct sockaddr *) &snl, sizeof(snl)) == -1)
223 return -1;
224
251 nlh->nlmsg_pid = 0; /* to kernel */
252 nlh->nlmsg_seq = seq_id;
253
254 nfg->nfgen_family = family;
255 nfg->version = NFNETLINK_V0;
256 nfg->res_id = htons(res_id);
257
258 if (mynfa) {

--- 6 unchanged lines hidden (view full) ---

265 }
266
267 memset(&snl, 0, sizeof(snl));
268 snl.nl_family = AF_NETLINK;
269
270 if (sendto(handle->fd, nlh, nlh->nlmsg_len, 0, (struct sockaddr *) &snl, sizeof(snl)) == -1)
271 return -1;
272
273 if (!ack)
274 return 0;
275
225 /* waiting for reply loop */
226 do {
227 socklen_t addrlen = sizeof(snl);
228 int len;
229
230 /* ignore interrupt system call error */
231 do {
232 len = recvfrom(handle->fd, buf, sizeof(buf), 0, (struct sockaddr *) &snl, &addrlen);

--- 23 unchanged lines hidden (view full) ---

256 nlh = NLMSG_NEXT(nlh, len);
257 }
258 } while (1);
259
260 return -1; /* never here */
261}
262
263static int
276 /* waiting for reply loop */
277 do {
278 socklen_t addrlen = sizeof(snl);
279 int len;
280
281 /* ignore interrupt system call error */
282 do {
283 len = recvfrom(handle->fd, buf, sizeof(buf), 0, (struct sockaddr *) &snl, &addrlen);

--- 23 unchanged lines hidden (view full) ---

307 nlh = NLMSG_NEXT(nlh, len);
308 }
309 } while (1);
310
311 return -1; /* never here */
312}
313
314static int
315nflog_send_config_msg(const pcap_t *handle, u_int8_t family, u_int16_t group_id, const struct my_nfattr *mynfa)
316{
317 return netfilter_send_config_msg(handle, (NFNL_SUBSYS_ULOG << 8) | NFULNL_MSG_CONFIG, 1, family, group_id, mynfa);
318}
319
320static int
264nflog_send_config_cmd(const pcap_t *handle, u_int16_t group_id, u_int8_t cmd, u_int8_t family)
265{
266 struct nfulnl_msg_config_cmd msg;
267 struct my_nfattr nfa;
268
269 msg.command = cmd;
270
271 nfa.data = &msg;

--- 15 unchanged lines hidden (view full) ---

287 nfa.data = &msg;
288 nfa.nfa_type = NFULA_CFG_MODE;
289 nfa.nfa_len = sizeof(msg);
290
291 return nflog_send_config_msg(handle, AF_UNSPEC, group_id, &nfa);
292}
293
294static int
321nflog_send_config_cmd(const pcap_t *handle, u_int16_t group_id, u_int8_t cmd, u_int8_t family)
322{
323 struct nfulnl_msg_config_cmd msg;
324 struct my_nfattr nfa;
325
326 msg.command = cmd;
327
328 nfa.data = &msg;

--- 15 unchanged lines hidden (view full) ---

344 nfa.data = &msg;
345 nfa.nfa_type = NFULA_CFG_MODE;
346 nfa.nfa_len = sizeof(msg);
347
348 return nflog_send_config_msg(handle, AF_UNSPEC, group_id, &nfa);
349}
350
351static int
295nflog_activate(pcap_t* handle)
352nfqueue_send_verdict(const pcap_t *handle, u_int16_t group_id, u_int32_t id, u_int32_t verdict)
296{
353{
354 struct nfqnl_msg_verdict_hdr msg;
355 struct my_nfattr nfa;
356
357 msg.id = htonl(id);
358 msg.verdict = htonl(verdict);
359
360 nfa.data = &msg;
361 nfa.nfa_type = NFQA_VERDICT_HDR;
362 nfa.nfa_len = sizeof(msg);
363
364 return netfilter_send_config_msg(handle, (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_VERDICT, 0, AF_UNSPEC, group_id, &nfa);
365}
366
367static int
368nfqueue_send_config_msg(const pcap_t *handle, u_int8_t family, u_int16_t group_id, const struct my_nfattr *mynfa)
369{
370 return netfilter_send_config_msg(handle, (NFNL_SUBSYS_QUEUE << 8) | NFQNL_MSG_CONFIG, 1, family, group_id, mynfa);
371}
372
373static int
374nfqueue_send_config_cmd(const pcap_t *handle, u_int16_t group_id, u_int8_t cmd, u_int16_t pf)
375{
376 struct nfqnl_msg_config_cmd msg;
377 struct my_nfattr nfa;
378
379 msg.command = cmd;
380 msg.pf = htons(pf);
381
382 nfa.data = &msg;
383 nfa.nfa_type = NFQA_CFG_CMD;
384 nfa.nfa_len = sizeof(msg);
385
386 return nfqueue_send_config_msg(handle, AF_UNSPEC, group_id, &nfa);
387}
388
389static int
390nfqueue_send_config_mode(const pcap_t *handle, u_int16_t group_id, u_int8_t copy_mode, u_int32_t copy_range)
391{
392 struct nfqnl_msg_config_params msg;
393 struct my_nfattr nfa;
394
395 msg.copy_range = htonl(copy_range);
396 msg.copy_mode = copy_mode;
397
398 nfa.data = &msg;
399 nfa.nfa_type = NFQA_CFG_PARAMS;
400 nfa.nfa_len = sizeof(msg);
401
402 return nfqueue_send_config_msg(handle, AF_UNSPEC, group_id, &nfa);
403}
404
405static int
406netfilter_activate(pcap_t* handle)
407{
297 const char *dev = handle->opt.source;
298 unsigned short groups[32];
299 int group_count = 0;
408 const char *dev = handle->opt.source;
409 unsigned short groups[32];
410 int group_count = 0;
411 nftype_t type = OTHER;
300 int i;
301
412 int i;
413
302 if (strncmp(dev, NFLOG_IFACE, strlen(NFLOG_IFACE)) == 0) {
303 dev += strlen(NFLOG_IFACE);
414 if (strncmp(dev, NFLOG_IFACE, strlen(NFLOG_IFACE)) == 0) {
415 dev += strlen(NFLOG_IFACE);
416 type = NFLOG;
304
417
305 /* nflog:30,33,42 looks nice, allow it */
306 if (*dev == ':')
307 dev++;
308
418 } else if (strncmp(dev, NFQUEUE_IFACE, strlen(NFQUEUE_IFACE)) == 0) {
419 dev += strlen(NFQUEUE_IFACE);
420 type = NFQUEUE;
421 }
422
423 if (type != OTHER && *dev == ':') {
424 dev++;
309 while (*dev) {
310 long int group_id;
311 char *end_dev;
312
313 if (group_count == 32) {
314 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
315 "Maximum 32 netfilter groups! dev: %s",
316 handle->opt.source);

--- 13 unchanged lines hidden (view full) ---

330 dev = end_dev;
331 }
332 if (*dev != ',')
333 break;
334 dev++;
335 }
336 }
337
425 while (*dev) {
426 long int group_id;
427 char *end_dev;
428
429 if (group_count == 32) {
430 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
431 "Maximum 32 netfilter groups! dev: %s",
432 handle->opt.source);

--- 13 unchanged lines hidden (view full) ---

446 dev = end_dev;
447 }
448 if (*dev != ',')
449 break;
450 dev++;
451 }
452 }
453
338 if (*dev) {
454 if (type == OTHER || *dev) {
339 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
340 "Can't get netfilter group(s) index from %s",
341 handle->opt.source);
342 return PCAP_ERROR;
343 }
344
345 /* if no groups, add default: 0 */
346 if (!group_count) {
347 groups[0] = 0;
348 group_count = 1;
349 }
350
351 /* Initialize some components of the pcap structure. */
352 handle->bufsize = 128 + handle->snapshot;
353 handle->offset = 0;
455 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
456 "Can't get netfilter group(s) index from %s",
457 handle->opt.source);
458 return PCAP_ERROR;
459 }
460
461 /* if no groups, add default: 0 */
462 if (!group_count) {
463 groups[0] = 0;
464 group_count = 1;
465 }
466
467 /* Initialize some components of the pcap structure. */
468 handle->bufsize = 128 + handle->snapshot;
469 handle->offset = 0;
354 handle->linktype = DLT_NFLOG;
355 handle->read_op = nflog_read_linux;
470 handle->read_op = netfilter_read_linux;
356 handle->inject_op = netfilter_inject_linux;
357 handle->setfilter_op = install_bpf_program; /* no kernel filtering */
358 handle->setdirection_op = NULL;
359 handle->set_datalink_op = NULL;
360 handle->set_datalink_op = netfilter_set_datalink;
361 handle->getnonblock_op = pcap_getnonblock_fd;
362 handle->setnonblock_op = pcap_setnonblock_fd;
363 handle->stats_op = netfilter_stats_linux;
364
365 /* Create netlink socket */
366 handle->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
367 if (handle->fd < 0) {
368 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't create raw socket %d:%s", errno, pcap_strerror(errno));
369 return PCAP_ERROR;
370 }
371
471 handle->inject_op = netfilter_inject_linux;
472 handle->setfilter_op = install_bpf_program; /* no kernel filtering */
473 handle->setdirection_op = NULL;
474 handle->set_datalink_op = NULL;
475 handle->set_datalink_op = netfilter_set_datalink;
476 handle->getnonblock_op = pcap_getnonblock_fd;
477 handle->setnonblock_op = pcap_setnonblock_fd;
478 handle->stats_op = netfilter_stats_linux;
479
480 /* Create netlink socket */
481 handle->fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
482 if (handle->fd < 0) {
483 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't create raw socket %d:%s", errno, pcap_strerror(errno));
484 return PCAP_ERROR;
485 }
486
372 handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
373 if (handle->dlt_list != NULL) {
374 handle->dlt_list[0] = DLT_NFLOG;
375 handle->dlt_list[1] = DLT_IPV4;
376 handle->dlt_count = 2;
377 }
487 if (type == NFLOG) {
488 handle->linktype = DLT_NFLOG;
489 handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
490 if (handle->dlt_list != NULL) {
491 handle->dlt_list[0] = DLT_NFLOG;
492 handle->dlt_list[1] = DLT_IPV4;
493 handle->dlt_count = 2;
494 }
378
495
496 } else
497 handle->linktype = DLT_IPV4;
498
379 handle->buffer = malloc(handle->bufsize);
380 if (!handle->buffer) {
381 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't allocate dump buffer: %s", pcap_strerror(errno));
382 goto close_fail;
383 }
384
499 handle->buffer = malloc(handle->bufsize);
500 if (!handle->buffer) {
501 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't allocate dump buffer: %s", pcap_strerror(errno));
502 goto close_fail;
503 }
504
385 if (nflog_send_config_cmd(handle, 0, NFULNL_CFG_CMD_PF_UNBIND, AF_INET) < 0) {
386 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_CFG_CMD_PF_UNBIND: %s", pcap_strerror(errno));
387 goto close_fail;
388 }
505 if (type == NFLOG) {
506 if (nflog_send_config_cmd(handle, 0, NFULNL_CFG_CMD_PF_UNBIND, AF_INET) < 0) {
507 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_CFG_CMD_PF_UNBIND: %s", pcap_strerror(errno));
508 goto close_fail;
509 }
389
510
390 if (nflog_send_config_cmd(handle, 0, NFULNL_CFG_CMD_PF_BIND, AF_INET) < 0) {
391 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_CFG_CMD_PF_BIND: %s", pcap_strerror(errno));
392 goto close_fail;
393 }
511 if (nflog_send_config_cmd(handle, 0, NFULNL_CFG_CMD_PF_BIND, AF_INET) < 0) {
512 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_CFG_CMD_PF_BIND: %s", pcap_strerror(errno));
513 goto close_fail;
514 }
394
515
395 /* Bind socket to the nflog groups */
396 for (i = 0; i < group_count; i++) {
397 if (nflog_send_config_cmd(handle, groups[i], NFULNL_CFG_CMD_BIND, AF_UNSPEC) < 0) {
398 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't listen on group group index: %s", pcap_strerror(errno));
516 /* Bind socket to the nflog groups */
517 for (i = 0; i < group_count; i++) {
518 if (nflog_send_config_cmd(handle, groups[i], NFULNL_CFG_CMD_BIND, AF_UNSPEC) < 0) {
519 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't listen on group group index: %s", pcap_strerror(errno));
520 goto close_fail;
521 }
522
523 if (nflog_send_config_mode(handle, groups[i], NFULNL_COPY_PACKET, handle->snapshot) < 0) {
524 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_COPY_PACKET: %s", pcap_strerror(errno));
525 goto close_fail;
526 }
527 }
528
529 } else {
530 if (nfqueue_send_config_cmd(handle, 0, NFQNL_CFG_CMD_PF_UNBIND, AF_INET) < 0) {
531 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFQNL_CFG_CMD_PF_UNBIND: %s", pcap_strerror(errno));
399 goto close_fail;
400 }
401
532 goto close_fail;
533 }
534
402 if (nflog_send_config_mode(handle, groups[i], NFULNL_COPY_PACKET, handle->snapshot) < 0) {
403 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFULNL_COPY_PACKET: %s", pcap_strerror(errno));
535 if (nfqueue_send_config_cmd(handle, 0, NFQNL_CFG_CMD_PF_BIND, AF_INET) < 0) {
536 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFQNL_CFG_CMD_PF_BIND: %s", pcap_strerror(errno));
404 goto close_fail;
405 }
537 goto close_fail;
538 }
539
540 /* Bind socket to the nfqueue groups */
541 for (i = 0; i < group_count; i++) {
542 if (nfqueue_send_config_cmd(handle, groups[i], NFQNL_CFG_CMD_BIND, AF_UNSPEC) < 0) {
543 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't listen on group group index: %s", pcap_strerror(errno));
544 goto close_fail;
545 }
546
547 if (nfqueue_send_config_mode(handle, groups[i], NFQNL_COPY_PACKET, handle->snapshot) < 0) {
548 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "NFQNL_COPY_PACKET: %s", pcap_strerror(errno));
549 goto close_fail;
550 }
551 }
406 }
407
408 if (handle->opt.rfmon) {
409 /*
410 * Monitor mode doesn't apply to netfilter devices.
411 */
412 pcap_cleanup_live_common(handle);
413 return PCAP_ERROR_RFMON_NOTSUP;

--- 13 unchanged lines hidden (view full) ---

427 return 0;
428
429close_fail:
430 pcap_cleanup_live_common(handle);
431 return PCAP_ERROR;
432}
433
434pcap_t *
552 }
553
554 if (handle->opt.rfmon) {
555 /*
556 * Monitor mode doesn't apply to netfilter devices.
557 */
558 pcap_cleanup_live_common(handle);
559 return PCAP_ERROR_RFMON_NOTSUP;

--- 13 unchanged lines hidden (view full) ---

573 return 0;
574
575close_fail:
576 pcap_cleanup_live_common(handle);
577 return PCAP_ERROR;
578}
579
580pcap_t *
435nflog_create(const char *device, char *ebuf)
581netfilter_create(const char *device, char *ebuf, int *is_ours)
436{
582{
583 const char *cp;
437 pcap_t *p;
438
584 pcap_t *p;
585
586 /* Does this look like an netfilter device? */
587 cp = strrchr(device, '/');
588 if (cp == NULL)
589 cp = device;
590
591 /* Does it begin with NFLOG_IFACE or NFQUEUE_IFACE? */
592 if (strncmp(cp, NFLOG_IFACE, sizeof NFLOG_IFACE - 1) == 0)
593 cp += sizeof NFLOG_IFACE - 1;
594 else if (strncmp(cp, NFQUEUE_IFACE, sizeof NFQUEUE_IFACE - 1) == 0)
595 cp += sizeof NFQUEUE_IFACE - 1;
596 else {
597 /* Nope, doesn't begin with NFLOG_IFACE nor NFQUEUE_IFACE */
598 *is_ours = 0;
599 return NULL;
600 }
601
602 /*
603 * Yes - is that either the end of the name, or is it followed
604 * by a colon?
605 */
606 if (*cp != ':' && *cp != '\0') {
607 /* Nope */
608 *is_ours = 0;
609 return NULL;
610 }
611
612 /* OK, it's probably ours. */
613 *is_ours = 1;
614
439 p = pcap_create_common(device, ebuf);
440 if (p == NULL)
441 return (NULL);
442
615 p = pcap_create_common(device, ebuf);
616 if (p == NULL)
617 return (NULL);
618
443 p->activate_op = nflog_activate;
619 p->activate_op = netfilter_activate;
444 return (p);
445}
446
447int
620 return (p);
621}
622
623int
448netfilter_platform_finddevs(pcap_if_t **alldevsp, char *err_str)
624netfilter_findalldevs(pcap_if_t **alldevsp, char *err_str)
449{
450 pcap_if_t *found_dev = *alldevsp;
451 int sock;
452
453 sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
454 if (sock < 0) {
455 /* if netlink is not supported this is not fatal */
456 if (errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT)
457 return 0;
458 snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't open netlink socket %d:%s",
459 errno, pcap_strerror(errno));
460 return -1;
461 }
462 close(sock);
463
464 if (pcap_add_if(&found_dev, NFLOG_IFACE, 0, "Linux netfilter log (NFLOG) interface", err_str) < 0)
465 return -1;
625{
626 pcap_if_t *found_dev = *alldevsp;
627 int sock;
628
629 sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER);
630 if (sock < 0) {
631 /* if netlink is not supported this is not fatal */
632 if (errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT)
633 return 0;
634 snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't open netlink socket %d:%s",
635 errno, pcap_strerror(errno));
636 return -1;
637 }
638 close(sock);
639
640 if (pcap_add_if(&found_dev, NFLOG_IFACE, 0, "Linux netfilter log (NFLOG) interface", err_str) < 0)
641 return -1;
642 if (pcap_add_if(&found_dev, NFQUEUE_IFACE, 0, "Linux netfilter queue (NFQUEUE) interface", err_str) < 0)
643 return -1;
466 return 0;
467}
644 return 0;
645}
468